Weekly Threat Bulletin – November 11th, 2026

APT29 exploits Apple vulnerability CVE-2024-27834 to deliver info-stealing malware

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog following active exploitation of the medium-severity Apple vulnerability. Carrying a CVSS score of 5.5, this improper authentication flaw allows attackers with arbitrary read and write capabilities to bypass Pointer Authentication (PAC). Although Apple patched the vulnerability in May 2024 across iOS, iPadOS, macOS, tvOS, watchOS, and Safari, the Russian state-sponsored hacking group APT29 (Cozy Bear) has actively exploited it. The threat actors utilize a zero-click exploit chain combining CVE-2024-27834 with CVE-2025-43529, a WebKit remote code execution vulnerability, to deploy information-stealing payloads and harvest browser cookies. These attacks are delivered through compromised legitimate websites, spoofed domains, and a supply chain attack targeting the Plerdy SEO Tracker. Federal Civilian Executive Branch (FCEB) agencies must apply the relevant updates to mitigate these risks by November 18, 2026.

Severity: Critical

Threat details and IOCs

Mitigation advice

• Prioritize and deploy security updates for all corporate Apple devices to patch CVE-2024-27834 and CVE-2025-43529. Ensure devices are updated to at least iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5.
• Update web filters, firewalls, and DNS blocklists with indicators of compromise (IOCs) associated with the APT29 campaign mentioned in the Sekoia report to prevent connections to malicious websites.

Compliance best practices

• Implement a robust vulnerability management program that includes asset inventory, regular scanning, risk-based prioritization, and defined service-level agreements (SLAs) for patching critical and actively exploited vulnerabilities.
• Deploy and configure an Endpoint Detection and Response (EDR) solution on all endpoints to monitor for and alert on suspicious post-exploitation activities, such as browser processes attempting to access sensitive data or executing unauthorized code.
• Establish a third-party risk management process to vet and continuously monitor all external scripts, plugins, and services before they are integrated into corporate websites. Implement Subresource Integrity (SRI) where possible to ensure third-party scripts have not been tampered with.
• Implement an ongoing security awareness training program that educates employees on identifying malicious websites, recognizing social engineering tactics, and reporting suspicious activity.

Microsoft patches Windows Paint RCE vulnerability CVE-2026-83844

Microsoft has patched a high-severity remote code execution vulnerability in Microsoft Paint, tracked as CVE-2026-83844, which carries a CVSS score of 8.1. The flaw stems from an out-of-bounds memory read error (CWE-125) that occurs when the application parses data packets and image memory. A remote attacker exploiting this vulnerability over a local network can send a specially crafted packet to an affected service, causing the application to read past its buffer bounds and execute arbitrary code on the host machine without user interaction. The vulnerability affects all Microsoft Paint builds prior to version 11.2609.401.0 on Windows 10 and Windows 11 systems. Although there is currently no evidence of active exploitation or public exploit code in the wild, users and enterprise administrators should immediately update Microsoft Paint to version 11.2609.401.0 or later via the Microsoft Store to mitigate the risk of memory corruption.

Severity: Critical

Threat details and IOCs

Mitigation advice

• Use a PowerShell script, such as 'Get-AppxPackage Microsoft.Paint | Select-Object Name, Version', across all Windows 10 and Windows 11 endpoints to identify systems with Microsoft Paint versions prior to 11.2609.401.0.
• Use your endpoint management tool to deploy the Microsoft Paint update (version 11.2609.401.0 or newer) from the Microsoft Store for Business to all affected corporate devices.
• If Microsoft Paint is not a business-critical application, use an application control solution like AppLocker or a similar feature in your endpoint security suite to block the execution of mspaint.exe on endpoints until they are patched.

Compliance best practices

• Develop and implement a comprehensive, automated patch management policy that includes applications from the Microsoft Store, ensuring timely deployment of security updates across all endpoints without manual intervention.
• Deploy an application whitelisting solution, such as Windows Defender Application Control, to enforce a policy of least privilege that only allows approved, business-essential applications to run on endpoints.
• Configure network security monitoring tools to detect and alert on anomalous east-west traffic between workstations, which could indicate attempts to exploit local network vulnerabilities like CVE-2026-83844.

Google Chrome 157 patches critical vulnerability CVE-2026-121156 and 212 other flaws

Google has released Chrome version 157 (specifically build 157.0.8103.38 for Linux and builds 157.0.8103.38/.39 for Windows and macOS) to address 213 security vulnerabilities, including seven critical, 77 high, 75 medium, and 54 low-severity flaws. The seven critical vulnerabilities primarily involve memory-handling issues: buffer overflows in Dawn (CVE-2026-121156 and CVE-2026-121247), memory corruption in ANGLE (CVE-2026-121229), and use-after-free defects in WebGL (CVE-2026-121246), Prerender (CVE-2026-121035), Geometry (CVE-2026-121203), and Core (CVE-2026-121126). High-severity fixes address V8 type confusion, PDFium memory-safety flaws, and authorization weaknesses in BackgroundFetch and FileSystem. While there are no reports of active exploitation for these vulnerabilities, users and administrators are advised to verify and update their installations to the patched builds to mitigate potential risks.

Severity: Critical

Threat details and IOCs

Mitigation advice

• Prioritize and immediately deploy the Google Chrome update to version 157.0.8103.38 or higher on all corporate Windows, macOS, and Linux devices.
• Use an asset inventory or endpoint management tool to run a scan across all managed devices to confirm that Google Chrome has been successfully updated to version 157.0.8103.38 or higher.
• Send a company-wide communication instructing users to manually check for and apply the latest Google Chrome update by navigating to 'Help > About Google Chrome' and restarting the browser.

Compliance best practices

• Establish or improve an automated patch management system that enforces patching of third-party applications, like web browsers, within a strict SLA (e.g., 48 hours for critical vulnerabilities).
• Use Group Policy (GPO) or a Mobile Device Management (MDM) platform to create and enforce browser hardening policies that disable non-essential features, such as automatic media execution or JavaScript JIT compilation, for the general user population.
• Implement and maintain strict egress filtering rules on the corporate firewall to deny all outbound traffic by default, only allowing connections to known-good destinations and services required for business operations.

Anthropic declines to fix ThisBash vulnerability in Claude Dispatch

A critical design vulnerability, dubbed "ThisBash," in Anthropic's Claude Dispatch, Claude Cowork, and Claude Code Remote Control features allows attackers to achieve remote code execution (RCE) across corporate boundaries. Discovered by Forever Security researcher Gal Weizman, the flaw enables any malicious or hijacked browser extension with access to `claude.ai` to control Claude Desktop by exploiting shared web and desktop sessions. The attack chain involves registering a content script on `claude.ai`, opening a hidden popup to `https://claude.ai/cowork/agent`, retrieving the desktop session ID via `GET /v1/sessions?tags=cowork-dispatch-local`, and force-prompting the desktop agent to execute commands—such as installing malicious npm packages—while automatically bypassing user approval prompts. Because Claude allows account sharing across multiple devices, this vulnerability enables lateral movement from an employee's personal home computer to a corporate network. Despite being notified of the flaw in May 2026, Anthropic has declined to patch the underlying design weakness, leaving users exposed even as the vulnerable Dispatch feature remains active for existing Pro, Max, and Ultra subscribers.

Severity: Critical

Threat details and IOCs

Mitigation advice

• If your organization uses Claude, immediately disable the 'Claude Cowork', 'Claude Dispatch', and 'Claude Code Remote Control' features for all users via the administrative console.
• Configure your firewall or web proxy to block and alert on traffic to the URL 'https://claude.ai/cowork/agent' and any API calls to the endpoint '/v1/sessions?tags=cowork-dispatch-local'.
• Issue a security bulletin to all employees warning them not to install any browser extensions from un-trusted sources and to report any unusual behavior from their Claude applications.

Compliance best practices

• Implement a browser extension allow-listing policy using Group Policy (GPO) or a Mobile Device Management (MDM) solution to permit only approved, business-critical extensions and block all others by default.
• Develop and enforce an Acceptable Use Policy (AUP) that explicitly prohibits logging into personal AI or cloud service accounts on corporate-owned devices.
• Create and deploy custom detection rules in your Endpoint Detection and Response (EDR) platform to alert on suspicious child processes, such as command shells or package managers (e.g., npm), being spawned by the Claude Desktop application process.
• Implement an application control or whitelisting solution, such as Windows Defender Application Control or AppLocker, to prevent the execution of unauthorized applications, including unapproved AI desktop agents, on user endpoints.

*sshole vulnerability in OpenSSH and Alpine Linux allows passwordless login

A decade-old vulnerability nicknamed "*sshole" allows remote attackers to bypass authentication and log into certain configurations of Alpine Linux and other musl-based distributions without a password. This security flaw exists in the interaction between OpenSSH and the musl libc alternative when Pluggable Authentication Modules (PAM) are not utilized. To exploit the vulnerability, a target system must contain an active, passwordless account designated by a "*" in the `/etc/shadow` file, alongside at least one other account utilizing a SHA256 or SHA512 password hash from which the SSH daemon borrows a salt. An attacker can then gain immediate access on a single connection by entering a password string exceeding 256 characters. Although default root accounts configured to prohibit password logins remain secure, compromised accounts with sudo or doas privileges can be leveraged for root escalation. Both Alpine and OpenSSH have released patches to mitigate this vulnerability, which currently lacks a CVE designation but threatens millions of systems, including containerized environments and embedded devices.

Severity: Critical

Threat details and IOCs

Mitigation advice

• Run the command `sshd -T | grep -i -E "passwordauthentication|usepam"` on all Linux systems to identify hosts running OpenSSH without PAM and with password authentication enabled.
• On all musl-based Linux systems, review the `/etc/shadow` file to identify any accounts configured with a `*` in the password field, as these are the primary targets for this exploit.
• On all identified vulnerable Alpine Linux systems, including container images, apply the latest security patches provided by the vendor to fix the vulnerability.
• On vulnerable systems where patching cannot be immediately performed, edit the `/etc/ssh/sshd_config` file to set `PasswordAuthentication no` and restart the SSH service.

Compliance best practices

• Implement a security policy to disable password-based SSH authentication across all Linux environments and enforce the exclusive use of key-based authentication.
• Develop and maintain a comprehensive software bill of materials (SBOM) for all deployed assets, including servers, containers, and embedded devices, to enable rapid identification of systems running specific libraries like musl.
• Implement network segmentation to isolate IoT, embedded, and other difficult-to-patch devices. Restrict all inbound SSH access from the internet, requiring access through a bastion host or VPN.
• Establish a recurring quarterly process to audit user and service accounts, ensuring that passwordless accounts do not have unnecessary sudo or other privileged access, in adherence with the principle of least privilege.
• Establish a golden image pipeline for container base images. Mandate the use of these approved, hardened images and integrate vulnerability scanning into the CI/CD process to block the deployment of vulnerable containers.