Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
74
Malware
JITTERLY
- Mentions · 7d4
- Mentions · 30d4
- All mentions5
- First seenSep 26, 2026
- Last mentioned2h ago
Timeline
5 articles · newest firstZyxel GS1900 zero-day exploited in wild despite patch
Attackers used CVE-2026-107441 to compromise nearly 1,000 Zyxel switches after it was misattributed to a patched flaw.
70
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel patched CVE-2026-107441 after Kapibala exploited it to compromise 996 GS1900 switches and steal credentials; the flaw bypassed a prior patch for CVE-2026-7273.
75
Hackers Exploit Zyxel GS1900 Zero-Day in the Wild
Patch for CVE-2026-7273 left switches vulnerable to new CVE-2026-107441 remote root command execution.
80
Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
Red Heron exploited Gitea CVE-2026-60004 to steal repositories and deploy the JITTERLY backdoor and SIXZUT rootkit.
78
Related CVEs
by mentions- Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0
- CVE-2026-72733%8.8Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2026-1231581%8.1Password bypass in OpenSSH before 10.6p2 on musl without PAM
- CVE-2026-109518<1%7.7Man-in-the-middle RCE in APT on Debian and Ubuntu
Appears with
- Sixzutmalware · 5
- Red Heronthreat actor · 4
- Zyxelvendor · 4
- Kapibalathreat actor · 2
- GS1900product · 2
- HestiaCPproduct · 1
- industrial automation organizationvictim · 1
- CISAorganization · 1
- Crafty Falconthreat actor · 1
- OPSSHIELDvendor · 1
- XLaborganization · 1
- CERT-Inorganization · 1
- Giteaproduct · 1
- OpenSSHproduct · 1
- Acronisorganization · 1
- GreyNoiseorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.