Daily briefing · November 5, 2026
BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in Brazil
Automated Vexday summary · sources: NVD, CISA KEV, EPSS
Verdict of the day — attention1 seen before CISA
The verdict for November 5 is ATTENTION: no vulnerability has become a ready-made weapon and none was added to the CISA KEV that day, but one flaw was already seen exploited by VulnCheck ahead of CISA. CVE-2026-119757 in BTCPay Server stands out, exposing LND credentials that can lead to theft of funds, alongside a wave of critical entries in Apache Juneau. Of the 383 new CVEs, 33 were critical.
Today’s brief
- CVE-2026-119757 (BTCPay Server, CVSS 9.3) was observed exploited by VulnCheck before CISA, an early warning of real-world use.
- Apache Juneau accounts for eight of the ten highlights, all rated CVSS 10.0, covering path traversal, XSS, response splitting, CSRF and credential/log leakage.
- CVE-2026-111490 (Matchpoint, CVSS 9.9) is an IDOR that exposes personal and financial data and allows modification of third-party accounts.
- Brazil keeps seeing new ransomware victims, including MAPFRE Brasil, Solutis Tecnologias and a state health secretariat.
Critical highlights
1
Unauthenticated attackers can retrieve LND .macaroon credential files from BTCPay Server before 2.4.2 and take full control of the node, including moving funds. Exploitation was seen by VulnCheck before CISA confirmation, so treat it as an active threat and prioritize patching.
2
Path traversal in Apache Juneau's DirectoryResource microservice lets a client read, write or delete files outside the configured root when the view, upload or delete options are enabled (all off by default). Risk is concentrated in deployments that turned those features on.
3
HTML serialization in Juneau does not encode variable substitutions in the page chrome, so request-derived values (headers, form data, path) can be reflected unencoded, enabling cross-site scripting in affected applications.
4
Juneau's REST server passed header values and redirect targets to the servlet container unchecked, so applications that set them from request data may allow CRLF injection and HTTP response splitting.
5
Juneau's RestClient keeps credential headers (Authorization, Cookie, API keys) when following redirects to another host, port or from HTTPS to HTTP, so a malicious or compromised server could capture secrets.
6
The Juneau REST server returns the internal exception class and message in a "Thrown" header and potentially in the error body, even with stack traces disabled, handing implementation details to remote clients that can aid further attacks.
7
The default Juneau call logger writes request headers such as Authorization and Cookie in cleartext for requests ending in server errors, so anyone who can trigger an error can get credentials into logs readable by whoever accesses them.
8
A "content" query parameter that replaces the request body is enabled by default on all methods in Juneau, including GET, letting a cross-site link deliver an attacker-chosen body without a CORS preflight and bypassing method- or content-type-based CSRF defenses.
9
When parsing values into java.lang.Class properties, Juneau loaded the named class with initialization enabled, so input naming a classpath class runs its static initializer. Impact depends on the classes present in the application.
10
The MatchPoint API trusts the actingasuser header without authorization checks, and sequential identifiers allow access to personal, banking and financial data, private messages and physical-access QR codes, as well as modification of third-party accounts.
Ransomware today
Newly discovered victims in recent days include MAPFRE Brasil 2026 (Destello group, financial services), Coemi Imóveis, Solutis Tecnologias and the Secretaria de Estado de Saúde (all thegentlemen), Sistel (Aoqin), Interativa Plasticos/Interplast (medusalocker) and centratamagroup.com (lockbit5). Over the past 30 days the most active groups were thegentlemen (7 victims, all in Brazil), N0n (6), qilin (4) and emperador (4).
MAPFRE Brasil 2026 BRDestello · Financial Services
Coemi Imóveis BRthegentlemen · Retail & E-Commerce
Solutis Tecnologias BRthegentlemen · Technology
Sistel BRAoqin · Technology
Secretaria de Estado de Saúde BRthegentlemen · Government & Defense
Interativa Plasticos (Interplast) BRmedusalocker · Manufacturing
centratamagroup.com BRlockbit5 · Other
thegentlemen 7N0n 6qilin 4emperador 4Eclipse 2incransom 2
Active groups & APTs
Groups with the most Brazilian victims listed on leak sites are lockbit5 (55), thegentlemen (42), lockbit3 (39), ransomhub, of Russian origin (35), Akira (24) and arcusmedia (23). All of them are marked as targeting Brazil, which shows sustained pressure from several ransomware operations on the country.
Brazil focus
Recent Brazilian victims span financial services (MAPFRE Brasil 2026), technology (Solutis Tecnologias, Sistel), government and defense (Secretaria de Estado de Saúde), retail (Coemi Imóveis, Punta Shopping), manufacturing (Interplast) and other sectors (centratamagroup.com). The group thegentlemen appears in three of these cases, including a public health body, which underscores the exposure of public and private sectors alike.
MAPFRE Brasil 2026Destello · Financial Services
Solutis Tecnologiasthegentlemen · Technology
SistelAoqin · Technology
Secretaria de Estado de Saúdethegentlemen · Government & Defense
Coemi Imóveisthegentlemen · Retail & E-Commerce
centratamagroup.comlockbit5 · Other
Interativa Plasticos (Interplast)medusalocker · Manufacturing
Punta Shoppingemperador · Retail & E-Commerce
Today’s recommendation: Update BTCPay Server to version 2.4.2 or later immediately and rotate any LND macaroons that may have been exposed; for Apache Juneau, apply the vendor's fixes, review the DirectoryResource settings and sanitize logs that may contain credentials.
With flaws being exploited before official confirmation and ransomware groups hitting Brazilian organizations steadily, the practical question is whether your own exposed surface carries any of these risks, and the only reliable way to know is to test and validate it regularly.Knowing the flaw exists is half the job; the other half is knowing if it affects you. Start with a no-cost exposure test.Meet the Autonomous AI Pentest Agent →Previous briefings
November 5, 2026 — BTCPay Server macaroon leak leads a day of critical flaws, with a Juneau cluster and heavy ransomware pressure in BrazilNovember 4, 2026 — Sogou Input Method flaw seen exploited before CISA, as critical router and AI-platform bugs pile upNovember 3, 2026 — Ivanti Connect Secure flaw under active exploitation as a wave of CVSS 10.0 router and Qihoo 360 bugs landsNovember 2, 2026 — WordPress RCE spotted by VulnCheck ahead of CISA leads a day of critical flaws in plugins, routers and enterprise accessNovember 1, 2026 — Quiet KEV Day, but a Wave of CVSS 10.0 Flaws Hits WAVLINK, Linksys and AI SandboxesOctober 31, 2026 — WordPress Plugins Under Fire: Four Flaws Seen Exploited Before CISA ConfirmationOctober 30, 2026 — Five CVEs seen exploited before CISA, led by a critical Dahua RCE and a Gravity Forms flawOctober 29, 2026 — Calm day on the KEV front, but critical flaws in WS_FTP, Langflow and WordPress plugins demand attentionOctober 28, 2026 — Early VulnCheck Warnings on a WooCommerce Plugin and Cisco ASA Lead a Day of Critical FlawsOctober 27, 2026 — Adobe Campaign Classic Hit by a Wave of Critical Flaws as VulnCheck Flags Early ExploitationOctober 26, 2026 — Calm day on the KEV front, but a wave of 10.0 CVSS flaws demands attentionOctober 25, 2026 — Quiet KEV Day, but Authentication Bypasses and Unauthenticated Flaws Lead the DisclosuresOctober 24, 2026 — Calm day on the exploitation front, but critical deserialization and injection flaws pile up in WordPress plugins and PostizOctober 23, 2026 — Calm day on the exploitation front, but critical flaws in Wasmtime, Postiz and LMS platforms demand patchingview full archive →