On November 6, 2026, the company Zyxel released emergency fixes for a serious security bug. It was a zero-day, which means hackers were already using it before a fix existed. Through this bug, they broke into almost 1,000 network switches around the world. They stole administrator passwords and copies of setup files. The break-ins were quiet, and company defenses didn’t stop them.
How the Attackers Got In
The bug is in the web login page of ten models in Zyxel’s GS1900 switch family. A network switch is like a traffic cop for an office. It connects computers, printers and servers so they can talk to each other.
BleepingComputer reported that the flaw is an out-of-bounds write bug. In simple words, the switch’s software accepts data without checking if it has enough room to store it. An attacker doesn’t need a password. They send a broken web request that overflows the memory. That lets them run their own commands and take full control of the switch.
The Mix-Up Over an Older Patch
For months, defense teams were confused. The monitoring group GreyNoise saw hackers break into 996 switches. At first, security teams blamed an older bug that Zyxel tried to fix in June. Even the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned about that older bug.
Then the security firm Binarly studied the switch software and found a big mistake. The June fix missed the real way in. The attackers knew this, so they kept using that open door until the new updates arrived.
What Nobody Knows Yet
Investigators still have open questions. No security firm has proved which group or country is behind the attacks. Some clues point to skilled hacking groups, but there’s no solid proof.
Nobody has said which companies or schools owned the hacked switches. We also don’t know if the attackers left hidden back doors to come back later. And we don’t know if they sold the stolen files to other criminals on the dark web.
Our Analysis
We think this mess shows a bad habit in tech. Teams work hard to update laptops and phones, but forget the switches sitting in dusty closets. Switches run quietly in the background, so people think they don’t need check-ups. That false comfort is dangerous.
When a company ships a weak fix, customers think they’re safe while a back window stays wide open. Hardware makers should test their fixes against real hacking tricks, not just assume their code works.
What Switch Owners Should Do Now
If your team uses these Zyxel switches, install the newest updates right away. Then block the web admin page from the public internet. Reset every password, remove users you don’t know, and watch network traffic closely to make sure nobody is still hiding inside.
