This briefing covers 20 cybersecurity and geopolitics stories published around Sunday, November 15, 2026, and 18 disclosed vulnerabilities (CVE-2026-122662, CVE-2026-125449, CVE-2026-125769, CVE-2026-125832 and others). Each entry links to the original reporting.
The Defense Department renamed its Chief Digital and AI Office the 'Super Intelligence Office' following a Trump executive directive replacing 'artificial intelligence' with 'super intelligence' in federal communications.
The US government dismantled North Korea's 'FaceStealer' social engineering campaign, which stole over $400 million in cryptocurrency. The disruption exposes Pyongyang's continued reliance on crypto theft to fund sanctions-evading state programs.
A public exploit enables remote command injection via the set_table function in DrayTek Vigor2960 1.5.1.6's mainfunction.cgi; patch to 1.5.1.7 available. DrayTek edge devices are recurring targets for state-sponsored actors seeking persistent network footholds.
A remotely exploitable path traversal flaw in DrayTek Vigor2960 1.5.1.6's doWebBackup action is now publicly disclosed; version 1.5.1.7 fixes it. Unpatched edge devices with public exploits available represent immediate opportunistic targeting risk.
A critical hard-coded credentials vulnerability (CVSS 10.0) in D-Link DSL-6740C's FTP daemon is publicly exploitable with no patch confirmed. Hard-coded credentials in end-of-life D-Link hardware have historically been weaponized by botnet operators at scale.
A public exploit enables remote stack-based buffer overflow via the id/password arguments in D-Link DIR-600L 2.17's authentication.cgi, scoring CVSS 10.0. End-of-life consumer routers with public RCE exploits are prime recruitment targets for state-linked botnets.
A public exploit targets a remote stack-based buffer overflow in TRENDnet TEW-657BRM 1.00.1's upgrade_flash.cgi; the vendor has not confirmed the vulnerability. Vendor denial without a patch leaves users exposed with no mitigation path.
A remote out-of-bounds write in TRENDnet TEW-657BRM 1.00.1's mini_httpd setup.cgi is publicly exploitable; the vendor has not confirmed or patched the flaw. Paired with CVE-2026-129352 on the same device, the attack surface compounds with no remediation available.
A publicly available exploit abuses insufficient authenticity verification in Tenda AC18's firmware upgrade handler, enabling remote firmware replacement. Unsigned firmware upload flaws allow persistent implant delivery, a technique favored by China-linked actors targeting SOHO infrastructure.
A remotely exploitable path traversal via the filename argument in DrayTek Vigor2960 1.5.1.6's app_guest_export function is now public; fix is version 1.5.1.7. Three CVEs disclosed against the same device in one day signals coordinated researcher or adversary attention to this platform.
A hard-coded credentials flaw (CVSS 8.4) in D-Link DIR-850L FW1.20WWb03's consolepwd binary is publicly exploitable with local access. Post-compromise local credential abuse enables persistent privileged access on widely deployed home and SMB routers.
A critical stack-based buffer overflow in D-Link DIR-600L 2.17b02's HNAP handler (CVE-2026-129354, CVSS 10.0) is remotely exploitable with a public exploit already released. End-of-life D-Link hardware with no patch pipeline means this becomes an immediate weaponization vector for botnet operators.
CVE-2026-125449 (CVSS 8.8) enables PHP object injection via deserialization in Testimonial Slider plugin versions through 3.0.2. Any authenticated attacker can chain this against the WordPress ecosystem's long tail of unpatched installs.
CVE-2026-125769 (CVSS 9.8) allows privilege escalation via incorrect privilege assignment in Advanced Form Integration plugin through version 2.11.3. A low-privileged subscriber can silently acquire admin access on affected WordPress sites.
CVE-2026-125832 (CVSS 8.5) exposes WP Data Access plugin through version 5.5.92 to SQL injection via improper input neutralization. Database exfiltration is achievable on any site running the unpatched plugin.
CVE-2026-122662 (CVSS 9.8) enables PHP object injection through deserialization in Document Library Pro versions before 4.2.2. Critical severity and wide plugin deployment make this a high-priority patch target for WordPress administrators.
CVE-2026-129483 (CVSS 9.3) allows unauthenticated attackers to authenticate as any user in Cyrus SASL through 2.1.28 by sending a public value A equal to N, forcing a zero shared secret. Any service using Cyrus SASL's SRP mechanism is fully compromised without credential theft.
CVE-2026-129465 exposes an IDOR vulnerability in Zr.Admin.NET (commits af07ffc–eb9228a) allowing any authenticated user to overwrite the admin's phone number and seize account control via SMS login. The exploit chain requires no elevated privileges to initiate, lowering the attack barrier significantly.
CVE-2026-129464 (CVSS 8.8) in Zr.Admin.NET (commits 0ee1ab8–eb9228a) lets any authenticated user read arbitrary server files including appsettings, exposing JWT secret keys used to forge administrator tokens. Token forgery elevates a standard user to full administrative control with no additional steps.
CVE-2026-129261 (CVSS 9.3) in Kingston FURY CTRL RGB Software through 2.0.66.0 exposes kernel-level IOCTL calls in NTIOLib_X64.sys without adequate access controls. Local attackers can abuse this driver weakness for privilege escalation on Windows endpoints running Kingston RGB software.