Mon, 9 November 2026Cybersecurity news & threat intel
CriticalVulnerabilities

Zyxel switch hacks traced to a true zero-day, not an old bug

Attacks first blamed on a patched flaw actually used CVE-2026-107441, an out-of-bounds write that allows OS commands through crafted HTTP requests.

CVE-2026-107441ZyxelNetwork gear
Updated 9 Nov 2026

Attacks first blamed on a patched flaw actually used CVE-2026-107441, an out-of-bounds write that allows OS commands through crafted HTTP requests.

What to do

Treat this as urgent. Check whether you run the affected product, apply the vendor fix, and review logs for signs of compromise from before the patch.

Original reporting: SecurityWeek

Original reporting: SecurityWeek

Discussion

0 comments

Sign in to join the discussion.

Get the Weekly Wire

The week's exploited vulnerabilities and breaches, in one email.

More Vulnerabilities

CriticalVulnerabilities

Attackers hit OpenSSH 'SSHole' flaw within hours of disclosure

A newly disclosed OpenSSH bug can let attackers sign in to accounts that have no password set. Researchers saw exploitation attempts almost immediately, and one honeypot was taken to root. Audit for passwordless accounts and update OpenSSH as soon as your distribution ships the fix.

OpenSSHLinuxRoot access
The Hacker News