Cyber Recap Week 45: WordPress Mugged Mid-Move, Zyxel's Patch Missed, Paint Goes Store-Only

Welcome to week 45, where the lessons are brutal and the patch notes are lying. Updates are only as safe as the three minutes they take to run. A patched device is only patched if the vendor patched the right bug. And Paint, yes, MS Paint, now has a security drama. Let's go.

WordPress: Robbed While Moving House

CISA added CVE-2026-119977 in WordPress Core to its KEV catalog, the list of bugs attackers are actively using. It's a TOCTOU race condition (time-of-check vs. time-of-use: someone swaps the furniture between you checking the room and walking in). During a full core upgrade, staging paths sit around in predictable, web-reachable places. Hit them at the right moment and you get unauthenticated code execution on the server. CVSS 8.1.

Wordfence counted more than 18,500 attack requests against the installer paths in the first 21 hours after disclosure, and 12,632 blocked attacks in 24 hours at the time of reporting. US federal agencies had until November 6 to patch. You don't get a deadline, you get attackers. Patches have been out since late October: update core, check your auto-updates and grep your logs for hits on setup-config.php.

# Check and update WordPress (WP-CLI)
wp core version
wp core check-update
wp core update

# Look for installer hits in the access log (adjust the path)
grep -i "setup-config.php" /var/log/nginx/access.log* | tail -n 50

Zyxel: Great Patch, Wrong Door

Remember the roughly 1,000 hijacked Zyxel switches from late summer? Everyone blamed CVE-2026-7273, a bug patched back in June. Binarly now showed the attackers were using a completely different, previously unknown flaw. A real zero-day. The June patch did exactly nothing against these attacks. Plot twist worthy of M. Night Shyamalan.

The new bug is CVE-2026-107441, an out-of-bounds write in the CGI program of the GS1900 series firmware (CVSS 8.8) that lets unauthenticated attackers run commands via crafted HTTP requests. Ten GS1900 models are affected. Per SecurityWeek, Zyxel shipped fixes on October 23 and published its advisory on November 3. Update the firmware and get that web UI off the internet. Rule of thumb: a switch login belongs on a management network, not in a shop window.

D-Link: Zero-Days Included, Patch Sold Separately

D-Link warns of multiple zero-days in the DGS-3130-30TS switch across several firmware versions. They live in the D-Link Discovery Protocol (DDP, how devices find each other on the network) and allow theft of sensitive device data, unauthorized config changes, leaked SNMP communities and forced reboots. CVE IDs and a firmware fix: not yet.

Attackers do need to be on your network first. Which, judging by how Norbert taped the guest Wi-Fi password to the front desk, is more of a speed bump than a wall. Until the patch lands, D-Link recommends:

• Disable DDP.
• Remove unneeded or default SNMP community strings.
• Allow SSH, web UI and SNMP only from an isolated management network.
• Keep an offline backup of the config.
• Watch logs for unexpected config changes, reboots and factory resets.

Paint: The Update Windows Update Ghosted

Yes, Paint. Microsoft fixed CVE-2026-83844, a remote code execution bug (out-of-bounds read) in Windows Paint, rated Important, CVSS 8.1. According to The Hacker News it isn't being exploited yet. The catch: the fix in version 11.2609.401.0 only ships through the Microsoft Store, not Windows Update. And since the CVE record and NVD still list an older version as fixed, some scanners will happily wave outdated installs through.

Paint is installed per user and may also sit around as a provisioned package for new accounts. So check from an admin PowerShell, update anything below 11.2609.401.0 through the Store (or the Store app update scan in Intune) and check again. Nobody uses Paint? Consider removing it. Barbara from accounting will survive, she draws her charts in Excel anyway.

# List Paint versions for all users (admin PowerShell)
Get-AppxPackage -AllUsers -Name Microsoft.Paint |
  Select-Object Version, @{ n = 'Users'; e = { $_.PackageUserInformation.UserSecurityId.Username -join ', ' } }

# Check the provisioned package for new users
Get-AppxProvisionedPackage -Online |
  Where-Object DisplayName -eq 'Microsoft.Paint' | Select-Object Version

Quick Hits

• Binance heist: per The Hacker News, the FBI attributes the theft to North Korea's TraderTraitor group. Figures: 6.43 billion US dollars across 11 blockchains, 2.85 billion frozen.
• MadApe phishing kit: Group-IB describes a Microsoft device code phishing kit using business-themed PDF lures and fake document-sharing pages. Why even MFA doesn't save you there is in this week's blog post.

Patch, verify, verify again. And next time you update, watch more than the progress bar. Turn on MFA. Think purple.