Things are breaking hard on the internet.

A concentrated run of security releases has hit operating systems, web frameworks, runtimes, networking tools, certificate bundles, and shared dependencies. One vulnerable library can reach thousands of applications. Attackers do not wait for a convenient maintenance window.

This expands the short checklist NVK published on October 25. Share it with the people who depend on you for technical help.

This is a general security advisory. It is not notice of a new incident affecting Coinkite or COLDCARD.

Do These First

  1. Update the operating system and browser on every phone, tablet, and computer you use.
  2. Protect your primary email account with a passkey or hardware security key. That inbox is usually the recovery path for everything else.
  3. Replace reused passwords. Move important accounts away from SMS-based authentication where a better option is available.
  4. Update your router, VPN, firewall, NAS, and anything else reachable from the internet.
  5. Confirm that your important backups are offline or immutable and can actually be restored.
  6. Review active sessions, account-recovery methods, email forwarding rules, and connected applications. Remove anything you do not recognize or use.

What Changed Since October 25

The first checklist went out on October 25. The disclosures kept coming.

  • Apple shipped security updates across supported iPhone, iPad, Mac, Safari, Apple Watch, Apple TV, and Vision Pro branches on October 26.
  • The November Android security bulletin includes critical remote-code-execution and privilege-escalation fixes.
  • Chrome 157 shipped with 213 security fixes, including seven listed as critical. Mozilla followed with Firefox 159.0.1.
  • Between October 26 and November 4, CISA added 12 vulnerabilities to its Known Exploited Vulnerabilities Catalog. The affected products include PHP, Brotli, Linux, Adobe Commerce/Magento, VMware ESX, GitLab, Cisco ASA/FTD, Ivanti Connect Secure, WordPress, and Apple products.

The last point matters: these are not only high severity scores. CISA added them because there is evidence of exploitation. Patch exposed systems first.

For You and Your Family

Update everything

Turn on automatic updates where they make sense. Check the devices that sit quietly for months: old phones, tablets, home routers, smart TVs, cameras, printers, NAS boxes, and travel laptops.

Do not stop at the operating system. Update browsers, password managers, messaging apps, remote-access software, cryptocurrency wallets, and browser extensions. Delete software and extensions you no longer use.

Restart the application or device after updating, then verify the running version. Browsers often download an update but continue running the old code until they restart.

Use passkeys or hardware security keys

Use passkeys when a service supports them. For your primary email, password manager, domain registrar, cloud account, and financial accounts, use a hardware security key when possible. Register a spare key and store it safely.

Keep recovery codes offline. A strong login with a weak recovery process is still a weak account.

Move away from SMS authentication

SMS is better than no second factor, but phone numbers can be reassigned or SIM-swapped. Prefer a passkey, hardware security key, or an authenticator app such as 2FAS. Remove obsolete phone numbers and recovery addresses from important accounts.

Add a PIN and port-out lock to your mobile-carrier account if your carrier offers them. These do not make SMS strong authentication, but they add another barrier against number theft.

Lock down your domain name

If you own a domain, protect the registrar and DNS account like your primary email. Use a passkey or hardware security key, keep recovery separate, and enable a transfer or registry lock where available. A stolen domain can be used to impersonate you, reset accounts, and redirect email or downloads.

Use a password manager

Every account should have a unique password. The password manager itself needs a strong, unique master password, modern MFA, tested recovery, and an offline copy of its recovery material.

Consider Lockdown Mode

People who may be targeted because of their work, wealth, public profile, or access should consider Apple Lockdown Mode. It deliberately removes some convenience to reduce the attack surface. Similar hardening is available on other platforms.

Never follow unsolicited “support” instructions

No legitimate support agent needs your passwords, authentication codes, seed words, BIP-39 passphrase, private keys, or remote control of a device holding those secrets.

If someone contacts you, stop. Open the company’s official site yourself and start a new support request there. Do not use the link or phone number in the message.

Back up what matters

Keep encrypted backups of important files. Keep at least one copy offline or immutable. Test restoration before you need it. A synchronized folder is not enough: ransomware and accidental deletion can synchronize too.

For Bitcoin Holders

Treat general-purpose computers and phones as hostile to wallet secrets. Never type a seed phrase, BIP-39 passphrase, private key, dice sequence, PIN, backup password, or decrypted backup into a website, chat, email, cloud note, or internet-connected computer.

For COLDCARD:

As of November 6, 2026, the current standard releases are 5.6.3 for Mk4 and Mk5 and 1.5.3Q for Q. Do not rely on version numbers copied from old articles, videos, or social posts. Check the official pages when you update.

For savings whose loss would materially harm you, use layers. Generate fresh wallets with private physical dice, consider a strong BIP-39 passphrase, and consider multisig when you can operate and recover it correctly. Test the complete recovery process before funding the wallet.

For IT Teams

Inventory the attack surface

You cannot patch what you do not know exists. Inventory public IP addresses, domains, cloud services, VPNs, firewalls, routers, identity providers, administration panels, CI systems, package registries, and third-party integrations.

Remove public administration interfaces

Do not expose a dashboard, hypervisor, NAS login, database console, or remote desktop service merely because it has a password. Put administration behind a VPN or private access layer, restrict the source network, and require phishing-resistant MFA.

Disable unused services and old accounts. Rotate credentials that have been shared, embedded in scripts, or present on a compromised endpoint.

If an internet-facing device was exposed while a known-exploited flaw was present, patching is only the first step. Preserve logs, check the vendor’s compromise guidance, rotate credentials stored on the device, and look for new accounts, persistence, and unexpected configuration changes.

Patch the whole dependency chain

Updating an application is not always enough. Check the runtime, framework, native libraries, base container, operating system, build image, lockfile, and transitive dependencies. Rebuild and redeploy from a clean base after the underlying packages are fixed.

Treat package installation as code execution

Package managers, build scripts, and GitHub Actions run code. Pin dependencies and Actions to reviewed versions or commit hashes. Use lockfiles, provenance checks, a cooldown before adopting brand-new packages, isolated CI runners, and short-lived tokens. Do not give an automated build more credentials than it needs.

GitHub introduced a package firewall after what it called a recent flood of malware attacks at package-install time. Enterprise tooling is optional; the threat is not.

Check known exploitation

Use the CISA Known Exploited Vulnerabilities Catalog to prioritize vulnerabilities already being used in attacks. Then review vendor advisories for the systems you actually run. Severity scores alone do not tell you what attackers are doing today.

Isolate untrusted devices

Put cameras, televisions, appliances, guest devices, and other IoT equipment on networks that cannot reach employee workstations, production services, or backup systems. Restrict outbound traffic where practical.

Protect and test backups

Keep multiple generations. Make at least one copy offline or immutable. Separate backup administration from normal user and domain credentials. Test restoration and record how long it takes.

Current Developer and Infrastructure Updates

The following list was checked on November 6, 2026. It is a starting point, not a complete inventory. Check the linked vendor notice before deploying.

Project Current action
Apple Install the newest security release offered for your supported iPhone, iPad, Mac, Safari, Apple Watch, Apple TV, or Vision Pro. Apple released updates across current and older supported branches on October 26.
Android Install the November update from your device maker. A 2026-11-05 security patch level covers the complete November Android bulletin where applicable.
Chrome Update to Chrome 157 or later, restart it, and check the running version. Chrome 157 included 213 security fixes.
Firefox Update to Firefox 159.0.1 or later.
WordPress Update immediately to 7.1.4 or the current security release for your maintained branch. Check PHP, plugins, themes, the web server, and the host separately.
GitLab Self-managed 19.2, 19.3, and 19.4 installations must be at least 19.2.8, 19.3.5, or 19.4.2. Prefer the current supported release. CISA lists CVE-2026-97229 as exploited.
PHP Use 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Windows builds were refreshed as -1 packages after the Brotli security update. PHP 8.6 release candidates are not production releases.
Node.js The October fixes began at 22.23.4, 24.22.1, and 26.12.1. Current supported-line releases include 22.23.4, 24.22.2, and 26.13.0. Upgrade within your supported line.
Next.js Do not remain below fixed versions 15.5.28 or 16.4.1. Current releases in those lines are 15.5.29 and 16.4.5.
sharp Upgrade to 0.35.5 or later.
Go Upgrade supported branches to at least 1.26.10 or 1.27.3 for the October crypto/x509 fixes.
curl Upgrade to 8.23.0 or later. Check applications that bundle libcurl separately from the operating system.
certifi Upgrade to 2026.10.23. Rebuild environments and containers that copied an older CA bundle.
DOMPurify Upgrade to 3.4.17 or later. Versions 3.4.4 through 3.4.16 are affected by the linked advisory.
Tailscale Upgrade clients and servers to 1.104.5 or later. Review the 1.104.4 security fixes, especially where Tailscale SSH or Serve is enabled.

If a package is embedded in an appliance or managed service, ask the vendor which fixed version it shipped. A green dashboard does not prove that a vulnerable library disappeared from the product.

If You Suspect a Compromise

Do not rotate credentials from the device you think is compromised.

  1. Disconnect or isolate the affected system without destroying logs.
  2. Preserve relevant logs, alerts, disk images, and timestamps.
  3. Move to a known-clean device and network.
  4. Invalidate active sessions, API tokens, application passwords, and recovery links—not only the main password.
  5. Rotate exposed credentials and recovery methods.
  6. Check email forwarding rules, account recovery settings, new administrators, connected applications, and recently installed software.
  7. Contact the affected provider through its official security channel and, when appropriate, your insurer, incident-response firm, and law enforcement.

Most security work is boring: update, verify, restart, test, and repeat. Do it before the exploit arrives, not after.