Threat intelligence: vulnerabilities and ransomware from 30 October to 5 November 2026

From 30 October to 5 November 2026 there were 277 ransomware claims on leak sites, 21% above the average of the previous four weeks, and CISA added two new Ivanti Connect Secure flaws to its KEV catalog. The bulletin covers exploited vulnerabilities, the most active groups and sectors, Italian and European advisories and the questions to put to applicants.

Threat intelligence from 30 October to 5 November 2026 · by cybercoverinsurance

In brief

Ransomware claims published on leak sites reached 277, against an average of 228 over the previous four weeks. The Gentlemen group accounts for 50 of them, all recorded on 31 October 2026 (ransomware.live).
CISA added four entries to its catalog of exploited vulnerabilities (KEV), against an average of 8 a week. Two concern Ivanti Connect Secure, the VPN already hit in October by a chain of flaws that leads to code execution as root without authentication (CISA KEV).
On 4 November 2026 the European Commission, ENISA, Europol and the EU CSIRTs Network reported incidents on commercial refrigeration systems in several Member States, with a new wave on 1 and 2 November (ENISA).

Exploited vulnerabilities

Ivanti Connect Secure: two flaws that complete a chain already exploited

On 30 October 2026 CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV (CISA KEV). The first lets a user already present on the appliance gain root privileges (CVSS 3.1: 7.0). The second lets an authenticated attacker upload files with content of their choice to a known location on disk (CVSS 3.1: 4.3) (NVD).

On their own, the two flaws have medium scores. The risk comes from combining them with CVE-2026-104935, the authentication bypass added to the KEV on 13 October 2026. According to Volexity the chain gives code execution as root without credentials, has been exploited since 3 October 2026 and worked even on appliances updated to version 22.8R2.4 (Volexity). The fix for the privilege escalation was released on 29 October 2026 (Ivanti).

Two details matter for the assessment. Volexity notes that Ivanti's Integrity Checker may not detect the compromise, because the attacker changes code in memory and restores the configuration. The deadline set by CISA for US federal agencies was 2 November 2026 for CVE-2026-111357 and 13 November 2026 for CVE-2026-118527. EPSS puts the probability of exploitation in the next 30 days below 1% for both, a value that does not account for the exploitation already documented (FIRST EPSS).

WordPress: code execution during the update

On 3 November 2026 CISA added CVE-2026-119977 to the KEV. It affects WordPress from version 4.7 to 7.1.3. During a full core update, WordPress uses predictable temporary paths reachable from the web: in that window an attacker without credentials can execute code on the server (CVSS 3.1: 8.1) (NVD). The fixed version 7.1.4 was released on 28 October 2026, with fixes backported to earlier branches down to 4.7, and installs itself on sites with automatic updates turned on (WordPress). The CISA deadline for US federal agencies is 6 November 2026.

Other entries

CVE-2024-27834, Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS: lets an attacker who can already read and write memory bypass Pointer Authentication (CVSS 3.1: 5.5). The flaw has been fixed since May 2024 but was added to the KEV only on 4 November 2026: CISA publishes no details on the exploitation, which therefore concerns devices left without updates (CISA KEV, Apple).
According to CISA, none of the four entries is known to be used in ransomware campaigns. All four also appear in ENISA's European vulnerability database (EUVD).

Ransomware

From 30 October to 5 November 2026 ransomware.live recorded 277 claims on the leak sites of criminal groups, against an average of 228 over the previous four weeks. These are statements by the groups, not verified incidents (ransomware.live).

Groups. The Gentlemen is the most active with 50 claims, against an average of 22, all recorded on 31 October 2026. Next come Qilin (24), N0n (22), SafePay and MedusaLocker (18 each). SafePay and MedusaLocker were almost absent in the previous four weeks, with averages of 3 and 0.5.
Sectors. Manufacturing 41 (average 31), professional services 33, technology 27, healthcare 20, finance 14. For 68 claims the sector is not stated.
Countries. United States 97, Germany 18, United Kingdom 9, Mexico 8. For 45 claims the country is not stated.

Italy and Europe

Claims in Italy. Four: one in professional services (Emperador group), one in hospitality and one unclassified (The Gentlemen), one unclassified (PixelLeaks) (ransomware.live).
Phishing. In the week from 24 to 30 October 2026 CERT-AGID counted 121 campaigns, 76 targeting Italy. The most used theme is fines (25 campaigns, using the PagoPA, SEND and ACI brands), and the most widespread malware is Remcos. 965 indicators of compromise were shared with accredited bodies (CERT-AGID).
AI models. On 4 November 2026 CERT-AGID published a study on how an open-weight model can learn a hidden behaviour that activates only when a specific MCP server is present, generating requests to external sites. The risk grows when the tools connected to the model change over time, because initial checks are not enough (CERT-AGID).
Commercial refrigeration. The joint statement of 4 November 2026 refers to incidents since 11 October 2026 on commercial refrigeration systems in several Member States, without naming them, and asks operators to reduce the exposure of their systems immediately and to follow the advisories of national CSIRTs (ENISA). The French supermarket case was analysed on this site on 14 October 2026 (CyberCoverInsight).

For insurers

Impact for insurersMedium

Ransomware claims rose by 21% and the Ivanti VPN remains exposed to a chain already exploited, but new KEV entries are half the average and none is linked to ransomware campaigns.

A chain exploited without credentials on a corporate VPN is an accumulation risk signal: it is worth checking how many insureds in the portfolio use Ivanti Connect Secure. The same applies to refrigeration systems hit in several EU countries over the same period.