The Exploit Bulletin — Thursday, November 5, 2026: 3 issues require action
Thursday, November 5, 2026 — 3 issues require action. If you run none of the software below, you are done.
Affects: Zyxel · npm/screenshot-desktop · Prusa Buddy
1. Unauthenticated OS command execution via web-UI out-of-bounds write in Zyxel GS1900 switches (CVE-2026-107441)
REMOTE CODE EXECUTION · CRITICAL · CVSS 8.8
Zyxel announced the 2.90 Patch 3 firmware in an advisory on 2026-11-03 and Binarly reports that the earlier fix for CVE-2026-7273 does not stop the exploit attackers are using, so any GS1900 that only took the previous patch remains open to unauthenticated command execution and credential theft until this build is installed.
An out-of-bounds write in the CGI program behind the GS1900 series web management interface lets an attacker who can reach that interface execute OS commands on the switch with a single crafted HTTP request and no login. Zyxel describes the attacker as LAN-based, but reports describe roughly 1,000 switches compromised worldwide with configuration files and credentials stolen, so switches whose management interface is reachable from untrusted networks are the practical target.
Affected: Zyxel GS1900-8 firmware 2.90(AAHH.2)C0 and earlier; Zyxel GS1900-8HP firmware 2.90(AAHI.2)C0 and earlier; Zyxel GS1900-10HP firmware 2.90(AAZI.2)C0 and earlier; Zyxel GS1900-16 firmware 2.90(AAHJ.2)C0 and earlier; Zyxel GS1900-24 firmware 2.90(AAHL.2)C0 and earlier; Zyxel GS1900-24E firmware 2.90(AAHK.2)C0 and earlier; Zyxel GS1900-24EP firmware 2.90(ABTO.2)C0 and earlier; Zyxel GS1900-24HPv2 firmware 2.90(ABTP.2)C0 and earlier; Zyxel GS1900-48 firmware 2.90(AAHN.2)C0 and earlier; Zyxel GS1900-48HPv2 firmware 2.90(ABTQ.2)C0 and earlier
How to Test: Log in to the switch web management interface and check the firmware version: any listed GS1900 model running a 2.90(xxxx.2)C0 build or earlier is vulnerable, including units that already installed the earlier fix for CVE-2026-7273. Determine whether the web management interface is reachable from the internet or any untrusted network segment. Because attackers have used this flaw to steal configuration files and credentials, treat any exposed unpatched switch as potentially compromised: review the running configuration for unauthorized changes or accounts, and rotate the admin password and any other credentials stored in the switch configuration.
How to Patch: Upgrade to the Patch 3 firmware for your model: GS1900-8 2.90(AAHH.3)C0, GS1900-8HP 2.90(AAHI.3)C0, GS1900-10HP 2.90(AAZI.3)C0, GS1900-16 2.90(AAHJ.3)C0, GS1900-24 2.90(AAHL.3)C0, GS1900-24E 2.90(AAHK.3)C0, GS1900-24EP 2.90(ABTO.3)C0, GS1900-24HPv2 2.90(ABTP.3)C0, GS1900-48 2.90(AAHN.3)C0, GS1900-48HPv2 2.90(ABTQ.3)C0. Until the upgrade is applied, restrict the web management interface to a trusted management network and remove any internet exposure.
Evidence: VulnCheck KEV · Canadian Centre for Cyber Security AV26-1114 Update 1: CVE-2026-107441 exploited in the wild · BleepingComputer: zero-day exploited to compromise nearly 1,000 GS1900 switches and steal configs/credentials · The Hacker News: earlier patch fails to block the exploit in use; Patch 3 fixes CVE-2026-107441 · Write-up describing the exploit found on attacker infrastructure
2. Malware published in npm package screenshot-desktop
SUPPLY-CHAIN COMPROMISE · CRITICAL
The registry flagged the malicious versions on 4 Nov; developer and CI machines that pulled them may already have leaked credentials, tokens and keys.
GitHub's Advisory Database has flagged screenshot-desktop, an npm package for taking desktop screenshots, as malware (GHSA-q2mc-9hgr-vmx2). Any machine that installed or ran the malicious versions should be treated as fully compromised, and all secrets on it should be rotated.
Affected: npm/screenshot-desktop (malicious versions as listed in GHSA-q2mc-9hgr-vmx2)
How to Test: Run npm ls screenshot-desktop, or grep package-lock.json, yarn.lock and pnpm-lock.yaml in all repos for screenshot-desktop and compare the versions with GHSA-q2mc-9hgr-vmx2. Check CI caches and build images as well. On any host with a matching version, look for unexpected outbound connections, new persistence entries and unknown processes from the time of install.
How to Mitigate: Remove the malicious versions and pin a known-good version, or remove the dependency. Rebuild affected hosts and CI runners from clean images. From a different computer, rotate every secret, token and key that was on an affected machine.
Evidence: Vendor confirmed
3. Network RCE chain in Buddy firmware before 7.0.0 (Prusa 3D printers)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · HIGH
Prusa has published its own advisory for 15 printer models urging an update to firmware 7.0.0, the fix is already available, and the researcher states PoC exploit code will be released publicly.
A researcher reports 14 findings in Prusa Buddy firmware, the most serious (PFB-008, preliminary CVSS 8.1) a stack buffer overflow in the Connect SEND_FILE_INFO handler that yields full controller code execution, reproduced on a physical MK4S. The headline RCE has a precondition: the attacker must control the Prusa Connect endpoint the printer talks to, or be able to MITM that traffic — no printer credentials are needed. The write-up also fuzzed the local PrusaLink/Connect HTTP path, G-code parsing and the USB/FAT path. Prusa fixed every finding in firmware 7.0.0; CVE ids are requested but not yet assigned.
Affected: Buddy firmware before 7.0.0
How to Test: Check each printer's firmware version in the menu or web UI; any Buddy-board printer (MK4S, MK4, MK3.9, MK3.5, CORE One and the other listed models) running firmware below 7.0.0 is affected. The report notes the overflow is driven by an over-length Connect SEND_FILE_INFO path (463+ bytes); review Connect/PrusaLink exposure.
How to Patch: Update affected printers to Buddy firmware 7.0.0 or later now; until updated, keep printers off untrusted networks and do not expose PrusaLink/Connect to the internet, and ensure the printer only talks to a trusted Connect endpoint.
Evidence: Researcher write-up of Buddy firmware RCE chain
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
