Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Original title: ⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
The Hacker News recap leads with attempts to exploit OpenSSH CVE-2026-123158 (SSHole, CVSS 8.1) on musl-based Linux with PAM disabled, including Alpine’s default server. Other items include CWPdoor via a trojanized Control Web Panel binary, an APT flaw (CVE-2026-109518) on Debian and Ubuntu, CERT-In’s Crafty Falcon activity against Indian BFSI firms, a patched Zyxel GS1900 zero-day, a hijacked cPGuard update channel, and an mSecure password-reset warning.
Unconfirmed: mSecure has not said whether customer secrets were exposed; OpenSSH figures are recorded attempts, not confirmed successful logins.
- CVE-2026-123158 allows sign-in to accounts with no password set.
- As of November 9, 20 attempts were logged from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.
- Zyxel CVE-2026-107441 is an unauthenticated LAN out-of-bounds write used to steal configs and credentials.
- Kapibala deployed JITTERLY and the SIXZUT rootkit; cPGuard’s CDN was abused on November 2.
- mSecure told users to change passwords and reset 2FA but did not say what was accessed.
Impact: Remote sign-in, root code execution, stolen switch credentials, backdoors
| Product | Affected |
|---|---|
| OpenSSH | musl C library builds with PAM disabled, including Alpine default |
| Debian and Ubuntu APT | HTTP sources with retry enabled |
| Zyxel GS1900 series | — |
- 1.Review Alpine and other musl OpenSSH servers that have PAM disabled and blank-password accounts.
- 2.Check Zyxel GS1900 switches for the vendor fix and for JITTERLY or SIXZUT.
- 3.mSecure customers should change passwords, reset 2FA, and review passkeys.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1078 Valid Accounts
- Threat actors
- Crafty FalconKapibalaRed Heron
- Countries
- India
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107441 | Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0 | 8.8 | — | ||
| CVE-2026-109518 | Man-in-the-middle RCE in APT on Debian and Ubuntu | 7.7 | <1% | PoC ×2 | |
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | amazonses.com | ed domain's SPF configuration ("amzonses[.]com" instead of "amazonses[.]com") authorized at least 32,066 unique IP addresses to send |
| domain | amzonses.com | ins. In one case, a misspelled domain's SPF configuration ("amzonses[.]com" instead of "amazonses[.]com") authorized at least 32,066 |
| domain | opsshield.com | to have gotten in through its billing application at manage.opsshield[.]com and logged in to a customer account they had registered. |
| domain | vercel.com | the rollout of Device Bound Session Credentials (DBSC) for vercel[.]com to make it harder for stealer malware to siphon session c |
| ipv4 | 136.0.141.71 | ate.sh" is used to download "cwpsrv" from a remote server ("136.0.141[.]71") and replace the legitimate file on the system. "The dow |
| ipv4 | 45.32.117.34 | iver malware. The activity originates from the IP addresses 45.32.117[.]34 and 156.246.94[.]183. A single AI-augmented threat actor |
From the original article
13 min read at thehackernews.com
A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.