Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

November 2026 Threat Watch

As of November 3, a new WordPress exploitation listing joins VPN exposure and identity abuse on the defender agenda. Prioritize exposed systems, verified account recovery, and control of connected apps.

Download the PDF, 633 KB Talk to the SOC

At a glance

TR-02 · Technology risk

  • 3 Defensive priorities in this watch
  • Nov 3 2026 source review date
Status
Ongoing risk. Official exploitation records and identity guidance reviewed November 3, 2026; underlying events retain their own dates.
Reviewed
November 3, 2026
New catalog entry
WordPress CVE-2026-119977, November 3[1]
VPN exposure
Ivanti Connect Secure vulnerability chain[1]
Identity pattern
Impersonated IT staff, followed by SaaS data theft[3]
App access
Consent grants require a separate security review[4]

What happened

Today's WordPress exploitation listing puts public applications on the November agenda. Z7's three priorities are exposed systems, verified account recovery, and app access. [1]

  • WordPress released version 7.1.4 on October 28, fixing an upgrade-process weakness that can permit remote code execution. Confirm the security update on every site you operate or outsource. [2]
  • CISA's October 30 Ivanti entries link CVE-2026-118527 and CVE-2026-111357 with CVE-2026-104935. Review the complete vendor remediation. [1]
  • Google documented January 2026 calls impersonating IT staff, stolen sign-on credentials and MFA codes, and unauthorized MFA device enrollment before cloud data theft. These are dated observations, not newly reported November incidents. [3]
  • Microsoft guidance updated October 21 explains a different route: a user can grant a malicious app access through a legitimate consent screen. A trusted sign-in domain does not establish that the app deserves access. [4]

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Reach the exposed system

    WordPress documents an upgrade-process route to code execution. Z7 recommends matching every public service to its owner and applicable advisory. [2]

  2. Persuade the account holder

    An alternative route starts with an apparent IT support call. In Google's January cases, the caller obtained credentials and MFA codes and added another MFA device. [3]

  3. Use the resulting authority

    A compromised session can reach the SaaS applications available to that user. A consented app can separately exercise its granted data permissions. These are distinct access paths. [3][4]

  4. Create a data-loss incident

    Google observed cloud data theft supporting extortion. Defenders need both an access investigation and an assessment of which records left the tenant. [3]

Who is at risk

Exposure follows the systems and permissions you actually operate. This is a defensive selection, not a global victim ranking.

  • Website owners relying on hosting agencies to manage WordPress updates. [2]
  • Organizations with the Ivanti products named in the catalog entries. [1]
  • Cloud users who can be persuaded to change authentication or approve unfamiliar applications. [3][4]

Sectors in scope

  • Organizations operating public WordPress sites
  • Organizations using Ivanti Connect Secure
  • Employers and service providers using cloud identity and SaaS
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition3 changes

  1. November 3: CISA added the WordPress issue, with a November 6 catalog remediation date. Private organizations should determine their applicable requirements.

    Source 1

  2. October 28: WordPress issued the security release that addresses the upgrade-process weakness.

    Source 2

  3. October 21: Microsoft updated its consent-phishing guidance, including how to investigate suspicious applications.

    Source 4

What to do now

In priority order, highest impact first.

  1. Do firstAssign owners to the public sites and VPNs in your inventory.

    Compare actual exposure with the catalog and product guidance; confirm outsourced systems with their operators. [1][2]

  2. Complete the WordPress security update and verify the result.

    The vendor recommends immediate updating; retain the installed version and change record as evidence. [2]

  3. Review the entire Ivanti advisory for affected appliances.

    The catalog links multiple vulnerabilities; confirm the complete vendor remediation with the appliance owner. [1]

  4. Rehearse a suspicious support call with the help desk.

    Z7 recommends independent verification before changing authentication, plus phishing-resistant MFA where supported, based on the observed call-to-enrollment sequence. [3]

  5. Investigate unfamiliar app grants and preserve the logs.

    Microsoft recommends reviewing permissions, application audit activity, and user sign-ins; scope affected data before closing the incident. [4]

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
behavior A caller claiming to be IT requests an MFA update, followed by an unfamiliar authentication device. [3]
behavior Unexpected application permissions or suspicious application activity in Entra audit and sign-in logs. [4]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    Known Exploited Vulnerabilities Catalog, version 2026.11.03 (opens in a new tab) CISA · November 3, 2026 · raw.githubusercontent.com
  2. [2]
    WordPress 7.1.4 (opens in a new tab) WordPress · October 28, 2026 · wordpress.org
  3. [3]
    Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft (opens in a new tab) Google Threat Intelligence Group · January 30, 2026 · cloud.google.com
  4. [4]
    Protect against consent phishing (opens in a new tab) Microsoft · Updated October 21, 2026 · learn.microsoft.com

Z7 Weekly Intelligence

We aim for one email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • TR-03Technology risk ongoing risk

    PHP2Shell needs patching and investigation

    TakeawayThis November 3 review explains how to verify runtime fixes, investigate earlier activity, and avoid false reassurance.

    • 2 PHP2Shell vulnerabilities addressed
    • Oct 17 2026 earliest Amazon sensor attempt
    • PHP2Shell
    • Technology risk
    • Operators of PHP web applications
    PDF655 KB
  • TR-01Technology risk ongoing risk

    Post-quantum deadlines set, attack estimates fall

    TakeawayInventory your cryptography, turn on hybrid key exchange, and put PQC into every purchase.

    • Dec 31, 2030 federal deadline for PQC key establishment
    • 70% of browser traffic to Cloudflare uses hybrid ML-KEM
    • Technology risk
    • Federal agencies and contractors
    PDF783 KB
  • RW-01Ransomware group active

    Part 1 of 2

    Qilin still tops most ransomware counts

    TakeawayPatch VPN gateways and require MFA first.

    • 165 Qilin incidents ZeroFox counted in August 2026
    • 17 months consecutive months as the most active group (ZeroFox)
    • Qilin
    • Ransomware group
    • Manufacturing
    PDF860 KB

What does this mean for your security?

Bring your questions about exposure, defenses and cost. Talk with our team about what applies to your environment and where to start.

Book a security conversationAsk Zeus Call 844-974-8669
Ask Zeus AI assistant