If you need help patching any of these or any other products, please get in touch with us.

This week was dominated by an OpenSSH authentication flaw that attackers began probing within hours of disclosure, ransomware hitting outdated Synology NAS devices, and three new additions to CISA’s Known Exploited Vulnerabilities (KEV) catalog. AI tooling also kept showing up on both sides of the fight, from leaked secrets in Claude Code projects to AI-driven intrusions at blockchain firms.

Products to watch this week

  • OpenSSH (SSHole, CVE-2026-123158): OpenSSH released 10.6p2 as an emergency fix for a critical flaw that lets attackers log in to accounts with no password set, such as key-only accounts, by sending a very long password, affecting builds on the musl C library with PAM disabled, such as some Alpine Linux servers (The Hacker News). Exploitation attempts started within hours of disclosure, with attackers gaining root on a honeypot, so update affected systems and containers now (The Hacker News).
  • Synology DSM: Synology is urging customers to update DiskStation Manager after ransomware gangs began exploiting a flaw patched back in December 2024 to encrypt data on outdated NAS devices (The Hacker News).
  • Ubuntu (APT): A flaw in APT lets an attacker who can tamper with package downloads swap a verified package for their own and run code as root; Debian, Ubuntu and the APT developers published advisories on November 4 (The Hacker News).
  • Ubuntu (Linux kernel TCP, CVE-2026-98432): A 9.8-rated use-after-free in the kernel’s IPv4 TCP code is reachable by a remote, unauthenticated attacker; Red Hat has shipped fixed kernels, while Ubuntu’s fixes for its three newest LTS releases were still in the opt-in testing channel at the time of reporting (The Hacker News).
  • Apple (CVE-2024-27834): CISA added this older pointer-authentication bypass affecting iOS, iPadOS, macOS, Safari, tvOS and watchOS to the KEV catalog after reports that it is being used to deliver info-stealing malware (CISA KEV, The Hacker News). Separately, a Russia-linked APT29 watering-hole campaign targeted iOS and Android users through compromised websites and a hijacked web analytics script (The Hacker News).
  • Claude: Apiiro found 1,122 public GitHub repositories where Claude Code’s “Yes, and don’t ask again” option had saved commands, including passwords and API keys, into a project settings file; check that these files aren’t committed and rotate any exposed secrets (The Hacker News). Researchers also showed that a malicious browser extension could abuse the Claude Dispatch feature to make Claude Desktop run code on a user’s computer (The Hacker News).
  • Microsoft: The fix for Windows Paint remote code execution flaw CVE-2026-83844 ships only through the Microsoft Store (build 11.2609.401.0), not Windows Update, so check that Store updates are allowed on managed devices (The Hacker News).

No major new issues were reported this week for Docker, Podman, AlmaLinux, nginx, pfSense, AnyDesk, TeamViewer, UniFi Network Application, MeshCentral, WireGuard or OpenVPN.

Exploited vulnerabilities and patches

  • WordPress Core (CVE-2026-119977): CISA added this race condition, which lets unauthenticated attackers run code during the core upgrade window, to the KEV catalog (The Hacker News). The researcher who found it warns that sites can be exposed one last time while installing the fix because the update unpacks its files using the site’s old, unpatched code, so follow the researcher’s guidance while updating (The Hacker News).
  • SonicWall SonicOS SSLVPN (CVE-2026-19868): CISA added this MFA bypass, which can let a user with valid credentials for another authentication method get around SAML-enforced MFA, to the KEV catalog on November 6 (CISA KEV, SonicWall advisory). SonicWall also said it won’t patch two flaws in end-of-life GMS 9.5.2 and earlier (The Hacker News).
  • Zyxel GS1900 switches: Binarly found that Zyxel’s earlier fix for an exploited zero-day didn’t block the attack, and Zyxel has released new firmware for 10 GS1900 models (The Hacker News).
  • Barracuda Email Security Gateway: Two flaws, including CVE-2026-116606 (CVSS 9.3), can be chained for unauthenticated root access; patches are out and watchTowr has published the attack chain (The Hacker News).
  • Android (CVE-2026-58868): Google’s November bulletin fixes a critical zero-click remote code execution flaw in Android 14 through 17, delivered with patch level 2026-11-01 or later (The Hacker News).
  • Also patched: a critical Ruby on Rails Active Storage file-write flaw fixed in 8.1.4.1 and 8.0.5.2 (The Hacker News), Xen hypervisor flaws allowing cross-VM memory access (The Hacker News), and an exploited BTCPay Server flaw affecting 2.4.1 and earlier (The Hacker News).

Breaches, ransomware and supply chain attacks

  • cPGuard: An attacker hijacked the cPGuard update channel on November 2 and pushed a backdoor that collected password hashes; about 2,950 customer Linux servers ran the script (The Hacker News).
  • Chainalysis and Chainstack: Chainalysis said an AI-driven attack exposed names, usernames, password hashes and live tokens for all users, and Chainstack reported a production breach it ties to the same large-scale campaign (Chainalysis, Chainstack).
  • Binance: The exchange said its record $6.43 billion theft started with fake job interviews targeting two engineers and a tampered Homebrew installation (The Hacker News).
  • mSecure: The password manager’s developer urged customers to change passwords, reset 2FA and remove passkeys after suspicious activity (The Hacker News).
  • Refrigeration controllers: Attackers remotely warmed fridges and freezers at supermarkets across Europe, and U.S. agencies warned that internet-exposed refrigeration controllers are being targeted to cause disruption, fire hazards and inventory loss (Europe, U.S. warning).
  • Control Web Panel: Researchers found a backdoored web server on compromised CWP hosting servers that runs attacker commands without leaving entries in access logs (The Hacker News).

Threat actors and takedowns

  • AI misuse: Google warned that “LLMjacking”, hijacking enterprise access to AI services with stolen API keys, is costing some companies up to $1 million in cloud charges (The Hacker News).
  • China-aligned SlippyNunchucks: The group hijacked insecure DNS requests from the Windows version of Sogou Input Method to deploy the DarkVigil backdoor (The Hacker News).
  • Russia-aligned Gorbag: ESET reports the group is exploiting a WinRAR flaw to deliver data-stealing malware to Ukrainian organizations (The Hacker News).
  • Takedowns: Tech firms dismantled a botnet that turned 1.3 million TV boxes into proxies (KrebsOnSecurity), and Russian police arrested three suspected members of the VasyGrek (Fluffy Wolf) group (The Hacker News).

What to do this week

Update OpenSSH on any musl-based (for example Alpine) systems and containers, bring Synology DSM, Apple devices and WordPress sites fully up to date, and keep an eye out for Ubuntu’s regular kernel update for CVE-2026-98432. If you use Claude Code, make sure its local settings files aren’t committed to shared repositories and rotate any secrets that were.