[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fks2FUrHn3NOsd0IvsLvK_fqZFu7S2SRmUAxtMeWOEYM":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a3f85752-2188-4547-ac5c-5f4f37cb1c4f","Security Affairs newsletter Round 603 by Pierluigi Paganini – INTERNATIONAL EDITION","security-affairs-newsletter-round-603-by-pierluigi-paganini-international-editio-634b36","A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches One Product Isn’t the Problem: […]","The Security Affairs newsletter Round 603 highlights a range of cybersecurity topics including AI-powered hacking tools, exposed servers, and breaches in South Korean banks. It also features advisories from CISA on exploited vulnerabilities in SonicWall, Apple, and WordPress, alongside discussions on APT29's mobile targeting and the XCPE botnet.","Security Affairs newsletter Round 603 covers AI hacking, exposed servers, bank breaches, and CISA advisories.","https:\u002F\u002Fsecurityaffairs.com\u002F202649\u002Fsecurity\u002Fsecurity-affairs-newsletter-round-603-by-pierluigi-paganini-international-edition.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fsecurityaffairs-newsletter.jpg","2026-11-08T13:48:43+00:00","2026-11-08T15:00:26.167809+00:00",7,[17,20,23,25,27,30],{"name":18,"type":19},"SonicOS SSLVPN","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":19},"GPT-6",{"name":26,"type":22},"OpenAI",{"name":28,"type":29},"APT29","threat_actor",{"name":31,"type":19},"Barracuda ESG","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-58868","Critical Android Bug",[21,26,18],{"controls":62,"vendors":149},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":36,"name":122,"problem":123,"products":124},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[150,156],{"slug":151,"name":152,"logo_path":153,"roles":154},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[155],"affected",{"slug":157,"name":21,"logo_path":158,"roles":159},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[155],{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":172},"cisa-flagged-exploits-in-sonicwall-apple-wordpress-underscore-persistent-patching-failures","CISA-Flagged Exploits in SonicWall, Apple & WordPress Underscore Persistent Patching Failures","This newsletter round-up highlights a recurring and dangerous pattern: widely-used platforms such as SonicWall, Apple products, and WordPress are being actively exploited in the wild, with CISA issuing emergency advisories to prompt urgent remediation. The root problem is that organizations consistently fail to apply available patches before threat actors — including sophisticated APT groups like APT29 — weaponize known vulnerabilities. Exposed servers and botnets like XCPE further demonstrate that unpatched and misconfigured internet-facing assets remain low-hanging fruit for attackers. This matters not only for individual organizations but also for critical sectors like banking, as demonstrated by breaches in South Korean financial institutions. Without a disciplined, risk-prioritized vulnerability management lifecycle, defenders will always be reacting too slowly to adversaries who move quickly once exploits are publicly known.",[165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":173,"MITRE ATT&CK T1566: Phishing":174,"NIST SP 800-53 SI-2: Flaw Remediation":175,"OWASP A06:2021 Vulnerable and Outdated Components":176,"CIS Control 7: Continuous Vulnerability Management":177,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":178,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":179},"NIS2 requires essential and important entities — including financial institutions like those breached in South Korea — to implement incident handling and vulnerability management practices that would mandate timely response to CISA-level advisories.","APT29's known tactics include phishing as an initial access vector against mobile and desktop targets; awareness of this technique reinforces the need for layered defenses beyond patching, including user training and endpoint detection.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined time periods — directly addressing the failure to patch widely-known vulnerabilities flagged by CISA.","The WordPress and SonicWall exploits directly exemplify the risk of running outdated or unpatched components; OWASP A06 specifically calls for continuous monitoring and prompt updating of all third-party software and appliances.","CISA advisories confirm active exploitation of flaws in SonicWall, Apple, and WordPress; a continuous vulnerability management program with mandatory remediation deadlines would have ensured patches were applied before threat actors could exploit them.","This control mandates timely identification and remediation of technical vulnerabilities in used software and systems, which would have driven action on the publicly disclosed SonicWall, Apple, and WordPress flaws before exploitation occurred.","APT29's mobile targeting and breaches in South Korean banks highlight that exposed assets lacking strong access controls amplify the impact of unpatched vulnerabilities, making proper identity and access management a critical compensating control."]