Weekly recap: SSHole OpenSSH bypass exploited, Zyxel GS1900 zero-day, cPGuard update hijack and other threats
This weekly recap groups several incidents, and its lead story is the SSHole authentication bypass in OpenSSH (CVE-2026-123158, CVSS 8.1). As of November 9, 2026, the article counts 20 exploitation attempts from 13 unique IP addresses in nine countries, and the flaw needs musl libc with PAM disabled, a configuration that includes the default Alpine Linux OpenSSH server. The most urgent item for a defender is the Zyxel GS1900 zero-day (CVE-2026-107441, CVSS 8.8), which an unauthenticated LAN attacker can use through a crafted HTTP request and which has already compromised about 1,000 switches. Other items include a supply-chain backdoor pushed through the cPGuard update channel by OPSSHIELD's compromised CDN access, the CWPdoor trojanized Control Web Panel daemon, and a Debian and Ubuntu APT flaw (CVE-2026-109518, CVSS 7.7) that needs HTTP sources with retries enabled and a man-in-the-middle position. The article also lists a long batch of high-severity CVEs to patch first, and it covers AI-assisted campaigns, ransomware and fraud news that carry lower direct urgency.
Entenda a falha
A vulnerabilidade
The most severe flaw is CVE-2026-107441 (CVSS 8.8), an out-of-bounds write in Zyxel GS1900 series switches. A LAN-based attacker with no authentication can send a crafted HTTP request and potentially run OS commands. Zyxel has fixed it, but the articles give no version numbers. Next is CVE-2026-123158, "SSHole" (CVSS 8.1), an OpenSSH authentication bypass that lets someone sign in to accounts with no password set. It affects OpenSSH on musl libc with PAM disabled, which includes the default Alpine Linux OpenSSH server, in versions before 10.6p2. Third is CVE-2026-109518 (CVSS 7.7) in APT on Debian and Ubuntu. If APT uses HTTP sources with retries enabled, an attacker positioned between the host and the mirror can get an unverified package installed, and its maintainer scripts run as root. The other CVEs in the recap are only listed as patch priorities.
Como funciona
For the Zyxel switch, an HTTP request reaches the device's web interface from the local network, and the crafted content makes the firmware write outside the memory it should, which can lead to OS command execution. For SSHole, a login attempt reaches an OpenSSH server running on musl libc without PAM, and the server accepts the sign-in for an account that has no password set instead of rejecting it. For APT, the host fetches packages from an HTTP mirror with retries enabled. An attacker in the network path can interfere so that a package which failed verification is still installed, and its maintainer scripts then run with elevated privileges. The articles do not describe the exact code steps for any of the three.
Por que é vulnerável
The Zyxel flaw is a memory-safety error: an out-of-bounds write when handling a crafted HTTP request. For SSHole, the articles say only that the bypass appears when OpenSSH runs on musl libc with PAM disabled and an account has no password, so the root cause is a flaw in how that configuration handles empty passwords. The articles do not give more detail, and the fix is in OpenSSH 10.6p2. For APT, the cause is that under HTTP sources with retry settings enabled, a package that did not pass verification can still be installed. The articles do not explain the fix.
Como foi descoberta
The Zyxel GS1900 flaw came to light as a zero-day exploited in the wild: attackers compromised nearly 1,000 devices to steal configuration files and credentials before Zyxel fixed it. The activity is attributed to a Chinese-speaking actor tracked as Kapibala (Red Heron), which deployed the JITTERLY backdoor and the SIXZUT rootkit. SSHole was disclosed recently, and as of November 9, 2026 the article counts 20 exploitation attempts from 13 unique IP addresses in nine countries. The APT flaw was described in an advisory from Amazon. The articles do not say who found any of the three or how.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No article mentions a published proof of concept. Working exploitation exists, though: the Zyxel flaw was used in real attacks to deploy the JITTERLY backdoor and SIXZUT rootkit, and SSHole has 20 recorded exploitation attempts. No public copy of either exploit is cited. Treat both as urgent, since they are already being used against real targets.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 12:17.
Linha do tempo
-
Weekly recap: SSHole OpenSSH bypass exploited, Zyxel GS1900 zero-day, cPGuard update hijack and other threats
ler a análise desta fonte ocultar
This weekly recap groups several incidents, and its lead story is the SSHole authentication bypass in OpenSSH (CVE-2026-123158, CVSS 8.1). As of November 9, 2026, the article counts 20 exploitation attempts from 13 unique IP addresses in nine countries, and the flaw needs musl libc with PAM disabled, a configuration that includes the default Alpine Linux OpenSSH server. The most urgent item for a defender is the Zyxel GS1900 zero-day (CVE-2026-107441, CVSS 8.8), which an unauthenticated LAN attacker can use through a crafted HTTP request and which has already compromised about 1,000 switches. Other items include a supply-chain backdoor pushed through the cPGuard update channel by OPSSHIELD's compromised CDN access, the CWPdoor trojanized Control Web Panel daemon, and a Debian and Ubuntu APT flaw (CVE-2026-109518, CVSS 7.7) that needs HTTP sources with retries enabled and a man-in-the-middle position. The article also lists a long batch of high-severity CVEs to patch first, and it covers AI-assisted campaigns, ransomware and fraud news that carry lower direct urgency.