Enquire

AL-TOUCH / SECURITY BRIEF

Security brief | 2026-11-06

Brand updates, public security notices and practical business actions, collected weekly.

Every Friday09:00 · Hong Kong time

Automatic public-source selection · source and licence links included

This edition: major vulnerabilities and fixes

Critical · source ratingIncus has an arbitrary file write on its client due to trusted image hashVersions and remediation

GitHub Advisory Database · Source updated

Affected / fixed versions

  • go / github.com/lxc/incus/v7/cmd/incusdAffected < 7.2.0Fixed version 7.2.0

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-4.0

Critical · source ratingIncus has an argument injection in backup compression algorithm leading to AFW and ACEVersions and remediation

GitHub Advisory Database · Source updated

Affected / fixed versions

  • go / github.com/lxc/incus/v7/cmd/incusdAffected < 7.2.0Fixed version 7.2.0

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-4.0

Critical · source ratingCVE-2026-77596 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingCVE-2026-111489 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Known exploited · CISA KEVCVE-2024-27834 | Apple Multiple ProductsVersions and remediation

CISA KEV · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Prioritise exposed assets. Apply vendor fixes or mitigations; restrict access or discontinue the affected product if no mitigation is available. CISA federal-agency directives are not Hong Kong statutory deadlines.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC0-1.0

Critical · source ratingIncus has an arbitrary file read+write on host via rootfs/ symlink in malicious imageVersions and remediation

GitHub Advisory Database · Source updated

Affected / fixed versions

  • go / github.com/lxc/incus/v7/cmd/incusdAffected < 7.2.0Fixed version 7.2.0

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-4.0

Critical · source ratingIncus has arbitrary file read+write on host via templates/ symlink in malicious imageVersions and remediation

GitHub Advisory Database · Source updated

Affected / fixed versions

  • go / github.com/lxc/incus/v7/cmd/incusdAffected < 7.2.0Fixed version 7.2.0

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-4.0

Critical · source ratingCVE-2026-111490 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingCVE-2026-111494 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingvm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)Versions and remediation

GitHub Advisory Database · Source updated

Affected / fixed versions

  • npm / vm2Affected Not specified by the source; verification requiredFixed version 3.11.6

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-4.0

Critical · source ratingCVE-2026-119757 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingIncus has an arbitrary file write on host via `exec-output` symlink in crafted imageVersions and remediation

GitHub Advisory Database · Source updated

Affected / fixed versions

  • go / github.com/lxc/incus/v7/cmd/incusdAffected < 7.2.0Fixed version 7.2.0

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-4.0

ISSUE 2026.11.06

A selection from approved public-source feeds over the previous seven days, with original links, dates and practical follow-up.

Coverage2026-10-30 — 2026-11-06
Read this edition ↓
Original network and data-security concept illustration
Original concept illustration · not an incident photograph
Key takeaway

Match notices to your assets, confirm vendor guidance, and prioritise patching and recovery readiness.

AL-TOUCH / WEEKLY EDITION

This edition: news and business action

Automatically selected records are compiled from their original sources, without independent confirmation of each item. Check vendor advice against your actual products, versions and deployment.

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

Incus has an arbitrary file write on its client due to trusted image hash

GitHub Advisory Database lists GHSA-f6m5-xw2g-xc4x for package github.com/lxc/incus/v7/cmd/incusd, with affected range < 7.2.0.

Business impact and suggested action

Compiled / adapted by AL-Touch · CC-BY-4.0

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

Incus has an argument injection in backup compression algorithm leading to AFW and ACE

GitHub Advisory Database lists GHSA-v6mj-8pf4-hhw4 for package github.com/lxc/incus/v7/cmd/incusd, with affected range < 7.2.0.

Business impact and suggested action

Compiled / adapted by AL-Touch · CC-BY-4.0

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

CVE-2026-77596 | NVD vulnerability record

NVD published this record on 2026-11-05 and last updated it on 2026-11-05.

Business impact and suggested action

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

CVE-2026-111489 | NVD vulnerability record

NVD published this record on 2026-11-05 and last updated it on 2026-11-05.

Business impact and suggested action

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

CVE-2024-27834 | Apple Multiple Products

CISA added CVE-2024-27834 to its known exploited vulnerabilities catalogue on 2026-11-04. The affected product is Apple Multiple Products.

Business impact and suggested action

Compiled / adapted by AL-Touch · CC0-1.0

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

GitHub Advisory Database lists GHSA-2q3f-q5pq-g8wv for package github.com/lxc/incus/v7/cmd/incusd, with affected range < 7.2.0.

Business impact and suggested action

Compiled / adapted by AL-Touch · CC-BY-4.0

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

Incus has arbitrary file read+write on host via templates/ symlink in malicious image

GitHub Advisory Database lists GHSA-vxp5-584q-c479 for package github.com/lxc/incus/v7/cmd/incusd, with affected range < 7.2.0.

Business impact and suggested action

Compiled / adapted by AL-Touch · CC-BY-4.0

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

CVE-2026-111490 | NVD vulnerability record

NVD published this record on 2026-11-05 and last updated it on 2026-11-05.

Business impact and suggested action

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

CVE-2026-111494 | NVD vulnerability record

NVD published this record on 2026-11-05 and last updated it on 2026-11-05.

Business impact and suggested action

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

GitHub Advisory Database lists GHSA-m5w8-4gq2-6f8x for package vm2.

Business impact and suggested action

Compiled / adapted by AL-Touch · CC-BY-4.0

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

CVE-2026-119757 | NVD vulnerability record

NVD published this record on 2026-11-05 and last updated it on 2026-11-05.

Business impact and suggested action

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Cybersecurity concept illustration, not an incident photograph
Original concept illustration · not an incident photograph
Automatic selectionSource published

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

GitHub Advisory Database lists GHSA-73hr-m85f-64v9 for package github.com/lxc/incus/v7/cmd/incusd, with affected range < 7.2.0.

Business impact and suggested action

Compiled / adapted by AL-Touch · CC-BY-4.0

READ / REVIEW / ACT

Turn information into practical improvements

Publication dates may differ from incident dates. Apply recommendations to the actual versions, systems and risks in your environment.

88-question security assessment →Discuss business security →
Sources, licences and permitted use

GovCERT.HK ↗ · Reference link / review required

HKCERT ↗ · Approved automatic source · CC-BY-3.0-HK

PCPD ↗ · Reference link / review required

Hong Kong Monetary Authority ↗ · Reference link / review required

Securities and Futures Commission ↗ · Reference link / review required

Hong Kong Police CyberDefender ↗ · Reference link / review required

CISA KEV ↗ · Approved automatic source · CC0-1.0

UK NCSC ↗ · Approved automatic source · Open Government Licence v3.0

Australian Cyber Security Centre ↗ · Reference link / review required

Singapore CSA / SingCERT ↗ · Reference link / review required

JPCERT/CC ↗ · Reference link / review required

CERT-EU ↗ · Reference link / review required

ANSSI / CERT-FR ↗ · Approved automatic source · Licence Ouverte / Open Licence v2.0

Canadian Centre for Cyber Security ↗ · Reference link / review required

New Zealand NCSC ↗ · Reference link / review required

CNCERT/CC ↗ · Reference link / review required

CERT-In ↗ · Reference link / review required

FBI / IC3 ↗ · Reference link / review required

NIST NVD ↗ · Approved automatic source · NIST non-SRD data public-service reuse grant

CVE Program ↗ · Reference link / review required

FIRST EPSS ↗ · Reference link / review required

CERT/CC ↗ · Reference link / review required

OWASP Foundation ↗ · Reference link / review required

GitHub Advisory Database ↗ · Approved automatic source · CC-BY-4.0

Microsoft MSRC ↗ · Reference link / review required

Google Cloud Security Bulletins ↗ · Approved automatic source · CC-BY-4.0

Apple Security Releases ↗ · Reference link / review required

Cisco PSIRT ↗ · Reference link / review required

Fortinet FortiGuard PSIRT ↗ · Reference link / review required

Palo Alto Networks PSIRT ↗ · Reference link / review required

Mozilla Security Advisories ↗ · Reference link / review required

Ivanti Security Advisory ↗ · Reference link / review required

Broadcom / VMware Security Advisories ↗ · Reference link / review required

Dell Security Advisories ↗ · Reference link / review required

HPE Security Bulletins ↗ · Reference link / review required

Lenovo Product Security ↗ · Reference link / review required

Oracle Security Alerts ↗ · Reference link / review required

Synology Security Advisories ↗ · Reference link / review required

Veeam Knowledge Base ↗ · Reference link / review required

WebRAY ↗ · Reference link / review required

Huorong Security ↗ · Reference link / review required

ToDesk ↗ · Reference link / review required

Adobe PSIRT ↗ · Reference link / review required

GlobalSign ↗ · Reference link / review required

xFusion PSIRT ↗ · Reference link / review required

Zenarmor Release Notes ↗ · Reference link / review required

The Hacker News ↗ · Reference link / review required

BleepingComputer ↗ · Reference link / review required

SecurityWeek ↗ · Reference link / review required

Hacker News community ↗ · Reference link / review required

Compiled by AL-Touch · each item links to its original source. This is the website edition; email delivery is arranged separately.