Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
74
Vendor
mSeven Software
- Mentions · 7d7
- Mentions · 30d7
- All mentions7
- First seenNov 3, 2026
- Last mentioned2h ago
Timeline
7 articles · newest firstmSecure warns users of suspicious activity
mSeven Software detected suspicious activity in mSecure but did not disclose details, scope or affected users.
50
mSecure password manager encrypted database stolen
mSeven Software warns customers who synced with mSecure Cloud to change passwords and remove passkeys after an encrypted database was stolen.
55
mSecure Password Manager Reports Suspicious Activity Urging Password Changes
Company advises users to change all stored passwords after detecting suspicious activity.
45
mSecure warns customers about suspicious activity
mSeven Software urges mSecure users to change passwords, reset 2FA and remove passkeys after suspicious activity on November 3, 2026.
20
mSecure urges password and passkey resets after suspicious activity
mSeven has not said whether vaults were accessed, how many customers are affected, or what occurred.
62
mSecure tells users to reset passwords and will not say why
A November 3 customer email recommends password, 2FA, and passkey changes but names no exposed data.
62
Related CVEs
by mentions- Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0
- CVE-2026-1231581%8.1Password bypass in OpenSSH before 10.6p2 on musl without PAM
- CVE-2026-109518<1%7.7Man-in-the-middle RCE in APT on Debian and Ubuntu
Appears with
- mSecureproduct · 5
- Red Heronthreat actor · 1
- OPSSHIELDvendor · 1
- mSecure password managerproduct · 1
- mSecurevendor · 1
- Crafty Falconthreat actor · 1
- mSecure usersvictim · 1
- Kapibalathreat actor · 1
- XLaborganization · 1
- CERT-Inorganization · 1
- Zyxelvendor · 1
- GS1900product · 1
- JITTERLYmalware · 1
- OpenSSHproduct · 1
- Control Web Panelproduct · 1
- CWPdoormalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.