Morning Threat Brief: An old Apple bug joins KEV as APT29 poisons websites, a perfect 10 Metabase flaw is still being hit, DreamHost confirms a two month breach, and WhiteArmor names Unilever

Good morning. An Apple flaw patched 18 months ago is being exploited again, this time in a campaign that turns ordinary websites into traps for unpatched phones. A perfect 10 Metabase flaw is still being hit months after its fix, DreamHost confirmed attackers lived in its File Manager for two months, and a new ransomware group put Unilever on its leak site. Update your phone, patch Metabase, and reset any DreamHost password you reused.

1. An old Apple bug joins KEV as APT29 poisons websites: update the phone you forgot about (CVE-2024-27834). CISA added Apple CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4, with a federal remediation deadline of November 18. The flaw is an improper authentication issue in WebKit that lets an attacker who already has arbitrary read and write capability bypass Pointer Authentication, the hardware check that stops memory corruption from becoming code execution. It carries a CVSS score of 5.5, and on its own it breaks nothing: it is one link in an exploit chain. Apple fixed it on May 13, 2024 in iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5, with iOS 16.7.8 for older devices. The KEV listing follows Sekoia research on a campaign it calls Poisoned Source, discovered in mid-October and attributed to APT29 with moderate to high confidence. Sekoia found three routes to the same payload: malicious JavaScript injected into compromised legitimate websites, lookalike domains acting as reverse proxies, including america250.holiday mirroring the America250 site and theowo.club mirroring a London hotel, and a one week compromise of the Plerdy SEO tracker, August 27 to September 3, which is loaded by thousands of sites. A profiling script Sekoia calls UltimateFingerprinter maps the device, then the delivery server answers with a chain for that platform. Chain A hits iOS 16.7 with CVE-2025-43529 plus CVE-2024-27834 and steals browser cookies. Chain B hits iOS 18.5 with the DarkSword kit, five flaws, and takes full device data: messages, WhatsApp and Telegram databases, iCloud Keychain, Wi-Fi passwords, contacts, photos, and iCloud Drive. Chain C hits Android Chrome versions 139 through 145, except 143, with CVE-2026-3910 and CVE-2025-27038, delivering AndroSnitch for Chrome data and Wi-Fi passwords. Sekoia is clear on two points: there are no zero-days here, every flaw was patched before the campaign began, and a fully updated phone is not vulnerable. Attribution to APT29 is Sekoia's assessment, not a proven fact, and Sekoia says it is unclear whether the campaign targeted specific visitors or compromised as many unpatched devices as possible. Update every iPhone, iPad, and Mac, especially older devices still on iOS 16.7, and treat a phone that has missed updates as the exposed one.

2. Perfect 10 Metabase flaw is still being hit: the fix is three months old and the warning is new (CVE-2026-72898). Singapore's Cyber Security Agency warned on November 4 that attackers are actively exploiting CVE-2026-72898, a CVSS 10.0 SQL injection flaw in Metabase, and that a proof of concept exploit is publicly available. An unauthenticated attacker can inject SQL through the password reset endpoint and gain administrator access to the instance, including the credentials for every connected database. This is a fresh warning about an old flaw, not a new bug: Metabase fixed it on August 6, confirmed active exploitation at the time, and CISA added it to KEV on August 11. Metabase Cloud customers were patched automatically. Self-hosted installs were not, and that is who the warning is for. Affected versions are 0.58.0 through 0.63.4, with fixed releases 58.24, 59.21, 60.17, 61.11, 62.9, and 63.5. Metabase says a POST to /api/session/reset_password that returns a 400 error, followed by a GET to /api/user/current that returns 200, means the instance has likely been compromised. Update to the fixed release for your branch, and if you cannot patch yet, block access to the /api/session/reset_password endpoint. After patching, follow Metabase's post-upgrade security guidance and check whether any admin accounts were created before the fix.

3. DreamHost confirms a two month breach: check your FTP password and your inbox rules. Web host DreamHost confirmed on November 4 that attackers exploited a flaw in its web-based File Manager at files.dreamhost.com and stayed in for about two months, from August until discovery on October 23. The attacker obtained FTP and SFTP usernames and passwords for customers who logged into File Manager between August and October 23, and reached certain webmail systems, where session information and credentials for a limited number of webmail users may have been exposed. The notice says email contents and files stored on FTP and SFTP servers may also have been accessed. DreamHost says it found no evidence that control panel logins or billing details were accessed, and it does not store full card numbers. The company says fewer than 10 percent of its roughly 400,000 paying customers were affected, terminated active sessions, reset passwords for accounts it believes were affected, and is offering one year of Equifax credit monitoring. DreamHost has not named the software or the flaw, and declined to say why the intrusion went undetected for two months. If you or anyone on your account logged into DreamHost File Manager between August and October 23, change the FTP, SFTP, and webmail passwords, check website files for unauthorized changes, and review webmail forwarding rules and filters for anything you did not set.

4. WhiteArmor names Unilever in a $15 million claim: UNVERIFIED, and that is the point. On November 4 the ransomware group WhiteArmor listed Unilever on its leak site, claiming 79 gigabytes across 1.8 million files in three regions, with a $15 million Bitcoin demand. The listing gives a detailed breakdown of the alleged haul: 665,000 contacts, 5,500 OTM accounts with roles and logins, 14 million locations, 3.8 million shipments, 229 million status records, 13,800 invoices, and 838,000 distributor loyalty profiles and ledgers. Ransomware.live discovered the listing on November 4 at 20:57 UTC and notes WhiteArmor is a newly discovered group, so the claim should be treated with caution until independently verified. Unilever has not confirmed a breach, no stolen data has been published, and no independent verification exists. WhiteArmor first appeared in October 2026 and has listed about a dozen victims since, including J.B. Hunt, Hisense, and Echo Global Logistics, all as claims. Treat this as a claim, not a confirmed breach, and watch for confirmation before repeating the numbers. The defensive lesson is about the group, not the victim: new extortion groups list big names fast, and a leak site listing is a claim until evidence lands.

Warning: the WordPress KEV deadline lands tomorrow, Friday, November 6. If WordPress is still unpatched, patch it today. The new Apple KEV entry is due November 18, and the second Ivanti flaw, CVE-2026-118527, is due Friday, November 13.

Full writeups: kevintswaney.com/vuln-watch
Indicators to hunt: kevintswaney.com/ioc-library

New CISA KEV additions today: one, Apple CVE-2024-27834, added November 4. The catalog stands at 1,768 entries, last updated November 4.

← kevintswaney.com