Search — “Red Heron”

Binarly reports that CVE-2026-107441, an out-of-bounds write in the CGI program of Zyxel GS1900 series switch firmware, was exploited in the wild as a zero-day to hack almost 1,000 devices, in attacks previously attributed to a Chinese hacking group. According to Zyxel, an unauthenticated attacker can achieve OS command execution via crafted HTTP requests. The brief reports new firmware released for 10 affected models; the source states Zyxel's fixes rolled out October 23 and the advisory was published November 3, while the source reports the earlier CVE-2026-7273 patch did not block this exploitation. Hunters should look for unusual HTTP requests to GS1900 CGI endpoints and unexpected OS command execution on these switches.