Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
74
Threat actor
Red Heron
- Mentions · 7d2
- Mentions · 30d4
- All mentions8
- First seenSep 21, 2026
- Last mentioned2d ago
Timeline
8 articles · newest firstZyxel GS1900 switches remain vulnerable to root command execution
Zyxel GS1900 Patch 2 fails to block zero-day allowing unauthenticated root access; Patch 3 fixes CVE-2026-107441
75
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel patched CVE-2026-107441 after Kapibala exploited it to compromise 996 GS1900 switches and steal credentials; the flaw bypassed a prior patch for CVE-2026-7273.
75
Hackers Exploit Zyxel GS1900 Zero-Day in the Wild
Patch for CVE-2026-7273 left switches vulnerable to new CVE-2026-107441 remote root command execution.
80
Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
Red Heron exploited Gitea CVE-2026-60004 to steal repositories and deploy the JITTERLY backdoor and SIXZUT rootkit.
78
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.
82
Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
Chinese hackers exploited ZyXEL CVE-2026-7273 on GS1900 switches in 48 countries; CISA added it to KEV.
82
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.
80
Related CVEs
by mentions- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0
- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2026-3490969%10.0Unauthenticated Path Traversal in Ubiquiti UniFi OS Devices
- CVE-2026-3491090%10.0Unauthenticated Command Injection in Ubiquiti UniFi OS Devices
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
- CVE-2026-54569<1%9.8SENAITE.CORE: The SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing…
- CVE-2023-543912%9.3Authentication bypass in Proxmox VE login API (libpve-access-control)
- CVE-2026-56271<1%9.3Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and…
- CVE-2026-797565%8.7Unauthenticated OS Command Injection in Nuclio Dashboard (Local/Docker Platform)
Appears with
- Zyxelvendor · 7
- GS1900product · 4
- WordPressproduct · 4
- JITTERLYmalware · 4
- SIXZUTmalware · 4
- Giteaproduct · 4
- GreyNoiseorganization · 4
- CISAorganization · 3
- Ubiquitivendor · 3
- FlowiseAIproduct · 2
- Acronisorganization · 2
- Nuclioproduct · 2
- UniFi OSproduct · 2
- Giteavendor · 2
- SENAITE LIMSproduct · 2
- PAN-OS GlobalProtectproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.