decrypted · 5 november 2026 · vulnerabilities and patching · uk policy and law · digital sovereignty

Zyxel's June patch did not stop the switch attacks, because the flaw was a different one

The patch that was meant to close the hole did not close it. Zyxel has fixed a zero-day, a flaw attackers used before any fix existed, in its GS1900 small network switches. Nearly 1,000 were compromised in attacks blamed on a different bug, patched in June. Switches are unglamorous kit, which is rather the point.

What actually happened

Attacks began around 17 August. GreyNoise, a threat monitoring firm, counted 996 compromised devices across 48 countries and on 21 September blamed CVE-2026-7273, a flaw Zyxel patched in June. (A CVE number is the public reference every known flaw gets.) Then Binarly, a firmware security company, took the attackers' script apart and found it still worked against all ten firmware releases carrying the June fix. Zyxel confirmed a new flaw, CVE-2026-107441, on 11 October and published its advisory on 3 November, according to BleepingComputer.

How the trick works

Think of a bouncer who checks the guest list by reading the tally at the top of the clipboard. The June patch added that check. The attackers altered the tally first, so the check passed and the crowd walked in.

Technically, the switch's web management page copies a request into a fixed-size space. Attackers corrupted the parameter counter the new checks relied on before it was validated. An unauthenticated attacker sending crafted web requests can then run operating system commands. SecurityWeek gives it a severity score of 8.8 out of 10. Zyxel's advisory puts the attacker on the LAN, the local network; BleepingComputer says only network access.

What the defender sees

Very little. A switch runs no security agent and rarely logs usefully. The recovered script collected configurations, hashed root credentials and network information: a map of your estate and a head start on guessing passwords elsewhere. GreyNoise suspects a Chinese-speaking actor, which is its attribution, not proven fact. BleepingComputer says it remains unclear whether the exploit was built to defeat the June fix or abused a related flaw that fix missed. Zyxel's advisory does not say whether it saw exploitation; that claim comes from Binarly, as SecurityWeek reports.

The Secure by Design lesson

The June fix treated a symptom. The flaw class is trusting numbers that arrive with a request, such as lengths and counts. Secure by Design means validating each at the boundary, in one place, rather than patching overflows one by one. A management page should also never be reachable from ordinary user networks. Put switch administration on its own small network, open to a few named machines, and this flaw becomes far harder to use: an afternoon's work for most sites. Check your models against Zyxel's advisory: builds ending .2)C0 and earlier are vulnerable, and the fix ends .3)C0. Either way, first attack to public advisory took about eleven weeks.

Also this week

Competition: the CMA's Microsoft consultation closes on 13 November. The Competition and Markets Authority proposed on 16 October to designate Microsoft with strategic market status in its business software ecosystem, covering Word, Excel, Outlook, PowerPoint, Teams and, increasingly, Copilot. The CMA says over a million UK businesses and public bodies use these products. It stresses that designation does not assume wrongdoing, and it has proposed no conduct requirements yet. Its roadmap does ask whether customers can freely choose AI tools, how Microsoft bundles its security products, and whether customers have a real choice of cloud for their software licences. Those are control questions, not abstract competition law. If your organisation runs on Microsoft, responding is your chance to say what lock-in costs you. The CMA expects a final decision in February 2027, with a further cloud update in spring 2027.

Cloud: the cost of concentration. Channel 4 News reported on 20 October that a Google Cloud outage caused hours of disruption to banks, businesses and the UK Government website, and asked whether the UK has lost its digital sovereignty. Google blamed a "power event" without detail, and sources there said they saw no evidence of malicious activity. ITPro put the outage at eight hours. The sources I could check give no cause beyond that phrase, so treat any fuller explanation as unconfirmed. This was not an attack, and that is the lesson: resilience is a design decision made long before the bad afternoon. If one provider's failure stops your payments or your public service, ask where your tested fallback is, and when you last actually used it.

Sources

Want a second pair of eyes on how your network equipment is administered? get in touch.