Zyxel patches zero-day exploited in switches

Zyxel released security updates on October 22 to fix CVE-2026-107441, a zero-day vulnerability exploited by the Kapibala threat actor. Hackers compromised nearly 1,000 devices across 48 countries, stealing credentials from ten GS1900 switch models. The flaw allowed unauthenticated attackers to execute commands, bypassing a June patch for CVE-2026-7273.