by sig9
Hacker Wars - November 04, 2026
Your daily dose of infosec chaos
Watering holes are back on the menu: a large-scale campaign is hitting iOS and Android phones with zero-click exploits, while a hijacked security-tool updater proves your defenders’ software can betray you too. WordPress has a flaw under active exploitation in the middle of upgrades, 69GB of Philippine government data took a walk, and yes, someone is hacking industrial refrigerators. Grab coffee and check your patch levels.
Watering Holes Serve Zero-Click Exploits To iOS And Android
A campaign tied to Russian hackers is compromising legitimate sites - and standing up fake portals - to hit visiting phones with n-day exploits that need zero interaction from the victim. The catch with n-days: they are bugs that already have fixes, so this is less about exotic zero-days and more about the ocean of devices that never got patched.
What to do: Patch phones and browsers everywhere, and treat “we already applied that update” as a prompt to verify, not to relax.
CISA Flags WordPress Core Flaw Exploited During Upgrades
CISA added a high-severity WordPress Core bug (CVE-2026-119977, CVSS 8.1) to its known-exploited list, and attackers are triggering it while sites run their software upgrades. It is a time-of-check to time-of-use race, which is a fancy way of saying the gap between “this looks safe” and “now I do it” is wide enough to drive a payload through - and WordPress is roughly half the web.
What to do: Update to the patched WordPress release right away and review logs from recent maintenance windows for anything that wandered in mid-upgrade.
cPGuard Autoupdate Hijacked To Push Backdoors And Stealers
Attackers broke into the update infrastructure of cPGuard, a web security suite, and used its autoupdate to deliver a backdoor and a data-stealing script to trusting servers. There is a special irony in your protection tool serving the malware, and a serious lesson: anything with push access to your fleet is a crown jewel, vendor or not.
What to do: If you run cPGuard, follow the vendor’s remediation steps, rotate credentials on affected hosts, and verify update signatures instead of trusting autoupdate blindly.
Philippine Government Breach Exposes 69GB Of Migrant Worker Data
An unknown operator exfiltrated SQL Server backups from the Philippine Overseas Employment Administration in under half an hour, making off with 69GB of data on migrant workers. This is a population that scammers already target relentlessly, and datasets like this power convincing spear-phishing and identity fraud for years after the breach fades from the news.
What to do: Expect targeted scams impersonating agencies - unsolicited contacts demanding fees or documents deserve extreme skepticism, and report them instead of replying.
European Fridge Attacks Put Cold-Chain Security In The Spotlight
Fresh attacks on European refrigeration gear show the usual OT recipe: internet connectivity bolted on for convenience, remote access left wide open, and security practices that assume no one would ever hack a fridge. Beyond spoiled food, the same setup runs temperature-controlled infrastructure in pharma, labs, and hospitals - where “the chiller went offline” is a much bigger problem than warm milk.
What to do: Segment OT networks from IT, inventory every internet-exposed controller, and force remote access through a VPN or jump host.
That’s it for today. Remember: the best incident is the one you prevented.
Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown
This bulletin is provided for informational purposes. Contact us for tailored security analysis.