Threat of the Week
OpenSSH "SSHole" (CVE-2026-123158, CVSS 8.1) lets an attacker sign in to accounts without a password. It affects Linux systems running OpenSSH on musl with PAM disabled, including Alpine's default configuration. As of November 9, 20 exploitation attempts from 13 IP addresses had been recorded.
Top Stories
- APT package verification flaw (CVE-2026-109518, CVSS 7.7) — with HTTP sources and retries enabled, a network man-in-the-middle can get Debian/Ubuntu APT to install an unverified package whose maintainer scripts run as root.
- Zyxel GS1900 switches (CVE-2026-107441, CVSS 8.8) — an unauthenticated out-of-bounds write reachable over crafted HTTP from the LAN. About 1,000 devices were compromised by a group tracked as Kapibala (Red Heron), which deployed the JITTERLY backdoor and SIXZUT rootkit.
- CWPdoor — a trojanized
cwpsrvbinary for Control Web Panel acts as a passive backdoor triggered by specific HTTP headers and suppresses logging. - cPGuard (OPSSHIELD) — attackers used compromised credentials, entering through a billing app and a self-registered customer account, to push a malicious script via the update CDN on November 2.
- Crafty Falcon — India's CERT-In warned of an AI-assisted actor targeting banking, financial services, and insurance firms, re-targeting victims after incomplete remediation and striking on holidays and weekends.
- mSecure — users were told to change passwords, reset 2FA, and consider removing passkeys after suspicious activity; scope was not disclosed.
Trending CVEs
Products with notable CVEs this week include INFINITT PACS, Synology DSM, Google Android, Xen, Debian apt, WatchGuard, Cisco, rsync, Google Chrome, Microsoft Paint, SonicWall SonicOS, and OpenSSH. Check vendor advisories and prioritize internet-facing systems.
Around the Cyber World
- Qilin ransomware — over 900 claimed victims so far in 2026, following more than 1,000 in 2025.
- Compromised sites — researcher Scott Helme found about 15,579 sites serving skimmers and exploit kits, with 135M+ monthly visits.
- Reachy Mini robot (JFrog) — five chained flaws allow passwordless sudo to root and control of the robot's motors.
- GeoVision camera software (Huntress) — repeated malware delivery via exploitation.
- BOSSAI (Acronis) — a single AI-augmented actor, believed to be in Taiwan, runs a mesh of 12 AI agents and targeted hundreds of organizations in 11 countries.
- Refrigeration controllers (SecurityScorecard) — compromised Dixell/Copeland XWEB PRO units are used as proxies and spam senders in an SMTP botnet.
- PhantomDOM (ZeroBEC) — browser-in-the-middle phishing that mirrors the DOM to hijack Microsoft 365 sessions.
- Secrets revocation (Truffle Security) — a program to help issuers revoke 1.4 million leaked, live secrets found on GitHub, Docker Hub, npm, and Hugging Face.
- QNAP — Plex2Shell attacks exploit Plex Media Server flaws; update to 1.43.3.10861 or later.
- DigiCert — an internet-exposed system left for 16+ months let attackers access archived customer contact data and business documents.
- Law enforcement — OFAC sanctioned four individuals and 41 entities tied to Southeast Asian scam compounds, and a former FBI employee pleaded guilty to stealing about $2.47M in crypto.
- Gnosis Pay — unauthorized access on November 3 exposed customer data from a legacy card system; 3D Secure is now mandatory.
- Doctor Web — over 2,000 PCs infected via trojanized GitHub security projects delivering AsyncRAT, a clipper, and an infostealer.
What to Do This Week
- Patch OpenSSH and APT on Alpine, Debian, and Ubuntu fleets; disable HTTP APT sources.
- Patch or isolate Zyxel GS1900 switches and hunt for the JITTERLY and SIXZUT indicators.
- Update QNAP Plex Media Server and review Control Web Panel hosts for the trojanized binary.
- Audit exposed refrigeration and IoT controllers, and keep them off the public internet.