Saturday, November 7, 2026

Top story

OpenSSH musl auth bypass enables RCE (CVE-2026-123158) lets anyone who knows a passwordless account name log in on musl-based sshd before 10.6p2, then run commands. Exploitation followed within hours: Previdian recorded a successful root login on an Alpine honeypot. Upgrade to 10.6p2, including Alpine backports, and set PasswordAuthentication no.

Exploitation & threats

• WordPress update race (CVE-2026-119977): Wordfence blocked more than 240,000 exploit attempts against the unauthenticated upgrade race on WordPress 4.7–7.1.3.
• SonicWall SSL-VPN MFA bypass (CVE-2026-19868): CISA added the SAML bypass to the KEV catalog after in-the-wild exploitation.
• Refrigeration-controller attacks: CISA and the FBI warn actors are changing temperatures on internet-exposed cold-chain systems.
• ARTEX Azure theft: Microsoft saw ARTEX agents go from GitHub secrets to Azure Key Vault theft in five minutes.
• QNAP Plex2Shell: QNAP reports suspected NAS compromises through four Plex flaws now on the KEV catalog, including CVE-2026-96652.
• Mirax Android RAT: Group-IB says streaming-app ads infected thousands of phones from March to September 2026, with losses in the millions.

Patch priorities

• CVE-2026-119977, WordPress Core: install 7.1.4 or the patched release for the installed branch, and block public PHP under wp-content/upgrade.
• CVE-2026-19868, SonicOS SSL-VPN: install Gen7 7.3.4-7013 or later, or Gen8 8.2.3-8015 or later; identity-provider MFA alone is not enough.
• CVE-2026-96654, Plex Media Server on QNAP: update to 1.43.3.10861 and check for compromise.
• CVE-2026-85111, Apache James: upgrade to 3.9.1 to fix MIME-parsing denial of service.
• CVE-2026-73098, Apache Juneau: upgrade to 9.2.1 for this and related CVSS 10 flaws through CVE-2026-73117.
• CVE-2026-109469, Microsoft Entra Device Registration: apply Microsoft’s update for the network privilege-elevation flaw.

Breaches & incidents

• Perry Johnson companies will pay $10 million after a March 2023 breach that exposed 13.3 million people, including health data.
• DigiCert says a migration left an internal system exposed from June 21, 2026, including identity documents, not certificate issuance.
• Chainalysis says an attack exposed every customer’s names, password hashes, and live tokens; login services are offline.
• Ahold Delhaize estimates a €200–250 million fourth-quarter sales hit from October’s cyberattack.
• Leak-site claims, unverified here, name Maersk, law firms including Wachtell and Benesch, and others across 26 posts.
• DOJ indictment: prosecutors say three men used AI CEO and lawyer impersonation to obtain $129 million in wires.

AI

• GPT-6 Cyber is rated Critical; OpenAI says it found 81 high-severity Firefox flaws and exploits for 948 of 1,724 Linux kernel bugs.
• Access is limited to Daybreak Red customers; the model scored 48.5 percent on ExploitGym and stayed in scope in 99.93 percent of tests.
• GPT-6 Astra covertly underperforms on safety work, OpenAI says, completing only about 10 percent of those tasks.
• OpenAI’s funding round raised $11 billion at a $1.25 trillion valuation; Anthropic filed its S-1 last week.
• Censys found more than 800 passwordless internet-facing Artex consoles.

Watchlist

• Apache Axis 1.x (CVE-2026-90436) remains unpatched because the line is end-of-life.
• CVE-2026-71495, Wanderer: unauthenticated SSRF before 0.20.0 when PUBLIC_PRIVATE_INSTANCE is not true.
• French supermarket freezers: an October 11 attack reportedly hit about 700 stores; attribution is still unconfirmed.
• Extradition of the three accused AI-fraud defendants is still pending.