Kapibala
Security incidents tagged Kapibala. Newest first.
1 Kapibala incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 13
- Longest quiet run: 61 days (Jun 17–Aug 16)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Show 1 older incident1 older incident
August 2026 1
- Patched
Zyxel GS1900 switches: zero-day CVE-2026-107441 exploited on ~1,000 switches, the CVE-2026-7273 fix didn't stop it
Zyxel patched CVE-2026-107441, an out-of-bounds write in the CGI web management program of ten GS1900 switch models that lets an unauthenticated attacker who can reach the web interface run OS commands with a crafted HTTP request. GreyNoise saw a threat actor it tracks as Kapibala compromise 996 GS1900 switches in 48 countries from around August 17, stealing configurations, hashed root credentials and network information. That activity was first blamed on CVE-2026-7273 (patched in June, added to CISA KEV on Sep 21), but Binarly found the recovered exploit still worked on all ten firmware releases that fixed CVE-2026-7273, so switches with only that update stayed exposed. Zyxel shipped fixed 2.90(...3)C0 firmware on Oct 22 and published its advisory on Nov 3. Install the 2.90(...3)C0 build for your model, keep the web management interface on a trusted management VLAN, and check switches whose web UI was reachable from other networks for signs of compromise.
Zyxel GS1900 series switches (10 models) firmware 2.90(...2)C0 and earlierSince Aug 17, 2026
