Daily briefing · November 4, 2026
Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile up
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
The verdict for November 4 is ATTENTION: no vulnerability has reached weaponized status, but one is under active exploitation and one (CVE-2026-120422, Sogou Input Method) was observed by VulnCheck before any CISA confirmation, an early warning of real-world abuse. The day brought 419 new CVEs, 39 of them critical, with a cluster of CVSS 10.0 flaws in Edimax, Comfast and Linksys routers with public proofs of concept and unresponsive vendors. AI and web platforms (Yuxi, GPUStack, Rails Active Storage) also stand out with authentication and isolation failures.
Today’s brief
- CVE-2026-120422 (Sogou Input Method) was seen exploited by VulnCheck before CISA: treat it as already in use.
- Four CVSS 10.0 flaws in Edimax, Comfast and Linksys routers have public PoCs, and the vendors did not respond.
- AI platforms Yuxi and GPUStack have critical flaws involving tenant isolation and authentication bypass.
- Rails Active Storage (ImageMagick) can expose secrets such as secret_key_base; Brazil continues under heavy ransomware pressure.
Critical highlights
1
Sogou Input Method for Windows fetches configuration over unencrypted HTTP in SGTool.exe, letting an attacker who can manipulate traffic replace server responses with malicious configurations. Exploitation was observed by VulnCheck before CISA, which signals practical abuse and justifies priority.
2
Remote command injection in the Edimax BR-6208AC (/goform/mp), CVSS 10.0, with a public PoC and no vendor response. Exposed devices are likely to remain unpatched, so isolate or replace them.
3
Path traversal in the multipart parser of the Comfast CF-WR632AX, remotely exploitable, with a public exploit and silence from the vendor. It can expose or alter files on the router, so restrict access to the management interface.
4
Missing authentication in the Setup Wizard of the Linksys E5350 allows remote manipulation of the router password setting. With a public exploit and no vendor reply, the risk of device takeover is high.
5
OS command injection via the ping/traceroute parameters in the Linksys E5350, remotely exploitable with a public exploit. Combined with CVE-2026-121933 on the same model, it makes the device a prime target.
6
In Yuxi (0.6.0.beta1 to 0.7.1), weak isolation between Docker sandboxes and application services lets a low-privileged user reach other tenants' sandboxes, files and secrets. In multi-tenant environments, this means cross-tenant data exposure.
7
GPUStack before 2.2.0 treated loopback requests as the built-in administrator by default, and a same-host reverse proxy could make remote requests appear local. The result is potential remote administrative access to the GPU cluster.
8
A use-after-free in IBM Watson Speech Services Cartridge (4.0.0 to 5.4.0) allows remote code execution. Affected environments should prioritize applying the vendor's fix.
9
In activestorage before 8.1.4.1, ImageMagick processing without a security policy can allow server reads and writes, including reading secret_key_base. Leaking that key can compromise Rails sessions and signed data.
10
Incorrect privilege assignment in Crocoblock JetFormBuilder (through 3.6.7.1) allows privilege escalation. On WordPress sites, this can lead to elevated access and full site takeover.
Ransomware today
Recently discovered victims include Interativa Plasticos (Interplast), in manufacturing, claimed by medusalocker, and centratamagroup.com, claimed by lockbit5. Over the last 30 days the most active groups were N0n (6 victims), qilin, emperador and thegentlemen (4 each), with Eclipse and medusalocker at 2 each, all of them with Brazilian victims.
Interativa Plasticos (Interplast) BRmedusalocker · Manufacturing
centratamagroup.com BRlockbit5 · Other
N0n 6qilin 4emperador 4thegentlemen 4Eclipse 2medusalocker 2
Active groups & APTs
Among the groups tracked, lockbit5 leads in Brazilian victims listed on leak sites (55), followed by lockbit3 and thegentlemen (39 each), ransomhub (35, of Russian origin), Akira (24) and arcusmedia (23). All of them target Brazil.
Brazil focus
Recent Brazilian victims span several sectors: manufacturing (Interativa Plasticos, P&B Textiles, GTL Concreto e Logística, Prafesta), retail (Punta Shopping, Animart Pet Stores) and healthcare (bio3g.com). The groups involved include medusalocker, lockbit5, emperador, qilin and N0n, which shows manufacturing and retail as recurring targets.
Interativa Plasticos (Interplast)medusalocker · Manufacturing
centratamagroup.comlockbit5 · Other
Punta Shoppingemperador · Retail & E-Commerce
bio3g.comqilin · Healthcare
P&B Textilesqilin · Manufacturing
Animart Pet Storesqilin · Retail & E-Commerce
GTL Concreto e Logística LTDAemperador · Manufacturing
Prafesta Ind. e Com. de Embalagens LtdaN0n · Manufacturing
Today’s recommendation: Prioritize checking whether Sogou Input Method is present on Windows endpoints and block or inspect its HTTP configuration traffic. Remove management interfaces of the Edimax, Comfast and Linksys routers from the internet, update GPUStack, Yuxi, Rails Active Storage and JetFormBuilder, and apply the ImageMagick security policy.
With so many flaws in exposed devices and platforms, the question is not only what was published today but whether any of it is reachable in your own environment, which only regularly validating your attack surface can answer.Every CVE above is a possible door — find out which ones are open in your environment with a free attack-surface check.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →