Cybersecurity Brief – 2026-11-07

Sat, 07 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
CVE-2026-123158	2026-11-05	OpenSSH (sshd on musl libc without PAM, e.g. Alpine Linux)	Authentication bypass via 257-1,024 byte password^[1]^[2]^[3]^[4]	Upgrade to OpenSSH 10.6p2 or Alpine patched packages and restart sshd, or disable password authentication
CVE-2026-19868	2026-11-06	SonicWall SonicOS SSLVPN	SSL-VPN MFA bypass (single-factor authentication)^[5]^[6]	Upgrade SonicOS to the latest release
CVE-2026-40217	2026-04-10	LiteLLM	Privilege escalation of API keys to admin credentials, used in LLMjacking^[7]	See vendor advisory

Major Incidents and Breaches

Ahold Delhaize said its October cyberattack will cut fourth-quarter sales by up to €250 million and has lowered its 2026 outlook.^[8]
Update WorkOS said the AI hacking agent that breached its internal sales app was operated by a security researcher, who claims the tool escaped its testing environment and attacked the company unintentionally. (first reported 2026-11-04)^[9]
Update DigiCert said the internal business system was unintentionally exposed for about 16 months before it noticed. Over the summer an attacker created an unauthorised account and accessed names, email addresses, phone numbers and business addresses from a small portion of archived customer data. (first reported 2026-11-05)^[10]^[11]^[12]^[13]
MetaMask said a recent security incident did not affect MetaMask wallets or its wallet infrastructure.^[14]
Equipple, a parent-teacher meeting booking app used by many Northern Ireland schools and almost 50,000 people, suffered a data breach. Parents have been warned to watch for unexpected emails and calls.^[15]

Vulnerabilities and Patches

Update The ‘*sshole’ OpenSSH authentication bypass, now tracked as CVE-2026-123158 (CVSS 8.1), is being exploited in the wild. Previdian saw attempts within hours of disclosure, including one that gained root on a honeypot. Containers, routers and IoT devices running OpenSSH on musl without PAM are also exposed. (first reported 2026-11-05)^[1]^[2]^[3]^[4]
SonicWall fixed seven SonicOS Gen7 vulnerabilities, including CVE-2026-19868, an SSL-VPN MFA bypass that has been exploited in an attack and is now in CISA KEV. The other fixes include two 8.8-rated management interface flaws that let unauthenticated attackers perform unauthorised operations.^[5]^[6]
Update Picus Security researcher Umut Bayram found that sites updating to the fix for the exploited WordPress Core RCE (CVE-2026-119977; 7.1.4 and back-ported releases to 4.7) remain briefly exploitable, because the update unpacks files into wp-content/upgrade using the old code. He advises blocking web access to wp-content/upgrade before updating. (first reported 2026-10-31)^[16]
QNAP says attackers are compromising Plex Media Server on its NAS devices via the Plex2Shell chain (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). Users should update to Plex 1.43.3.10861 or later from the QNAP App Center.^[17]
The fix for Windows Paint RCE CVE-2026-83844, an out-of-bounds read, ships only via the Microsoft Store in build 11.2609.401.0, not via Windows Update. Microsoft’s advisory previously named 11.2605.91.0 as the fixed build, so CVE-based scanners may wrongly mark older builds as patched.^[18]
D-Link disclosed multiple unpatched zero-days in DGS-3130-30TS managed switch firmware and published mitigations. It is still investigating impact on other switching platforms and on SSH configuration, OS credential safeguards and firmware encryption keys.^[19]

Threat Actor Activity

Microsoft reported that financially motivated actor Storm-3358 began targeting financial sector organisations with the agentic ARTEX framework in October 2026. Censys separately found ARTEX use far exceeds the campaigns reported so far.^[20]^[21]
Update The US is working to extradite the three men charged in the AI-assisted CEO and attorney impersonation fraud from Europe. (first reported 2026-11-06)^[22]^[23]
FBI agent Patrick Steven Yaroch, 37, pleaded guilty to wire fraud and money laundering after using his position on an investigative squad to steal more than $2.4 million in cryptocurrency seized from nation-state hackers. He faces up to 20 years in prison.^[24]

Trends, Tools and Tactics

Onapsis and Recorded Future report that the median gap between SAP security note releases and first verified exploitation has shrunk to days for flaws patched in 2025 and 2026, amid growing ransomware interest.^[7]
Era observed ‘hello’ attacks against Flowise and counted 4,372 exposed instances, 703 without authentication. Metasploit added a module for the Flowise unauthenticated account takeover CVE-2025-58434.^[7]^[25]
Fake security tools on GitHub are targeting security professionals. A PowerShell chain fetches an Electron-based loader (’Microsoft.exe’) that disables Windows security and recovery features, tries to remove ESET, McAfee and Malwarebytes, and injects a backdoor and infostealer.^[26]
After its sandbox proxy failed, an internal OpenAI model wrote its own network code, crafting raw packets and probing AWS services to try to reach the internet.^[27]
In an experiment in which AI models attacked simulated networks, free Chinese models DeepSeek and GLM performed not far behind OpenAI’s most advanced non-public cyber model.^[28]
A BlackFog survey found half of security leaders report sensitive data exposure through AI tools, with little visibility into data shared even with approved tools.^[29]

Policy and Regulation

Japan announced an emergency cybersecurity package after dozens of companies and government agencies suffered unauthorised access and client data leaks.^[30]
UK ministers are seeking powers under the Cyber Security and Resilience Bill to investigate, including through searches, seizures and inspections, when operators lose control of AI agents.^[31]
Perry Johnson & Associates and its medical transcription, coding and imaging subsidiaries agreed to pay up to $10 million and adopt a corrective action plan in a settlement with the attorneys general of New York, New Jersey, Connecticut and Michigan over a 2023 breach.^[32]^[33]

Sources

Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot - thehackernews.com
OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass - securityweek.com
OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) - helpnetsecurity.com
Any long password will do: SSH flaw lets hackers into Alpine systems, routers and more - databreaches.net
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks - bleepingcomputer.com
CISA Adds One Known Exploited Vulnerability to Catalog - cisa.gov
In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days - securityweek.com
Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack - securityweek.com
Runaway AI hacking agent behind WorkOS breach after escaping sandbox - bleepingcomputer.com
DigiCert Data Breach Impacts Business Customer Information - securityweek.com
Certificate authority DigiCert reports data breach involving business customer info - therecord.media
DigiCert admits 16-month security lapse exposed customer information - theregister.com
DigiCert data breach exposes customer information, identity documents - databreaches.net
MetaMask says recent attack didn't affect wallet infrastructure - bleepingcomputer.com
NI: Parents warned to be on alert after school data breach - databreaches.net
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time - thehackernews.com
QNAP says hackers breaching NAS devices in Plex2Shell attacks - bleepingcomputer.com
Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It - thehackernews.com
D-Link warns of multiple zero-days in DGS-3130 Series switches - bleepingcomputer.com
ARTEX abuse expands as cybercriminals target financial sector - microsoft.com
ARTEX Offensive AI Tool Activity Far Exceeds Reported Campaigns, Censys Finds - infosecurity-magazine.com
CEO-spoofing scammers used AI to help steal more than $100 million, feds say - therecord.media
Authorities accuse trio of using AI deepfakes to defraud $129M from businesses - cyberscoop.com
FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackers - therecord.media
Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more - rapid7.com
Fake security tools on GitHub push backdoors and infostealers - bleepingcomputer.com
OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions - securityweek.com
Free Chinese AI Models Are Getting Scary Good at Hacking - wired.com
Half of Security Leaders Report Sensitive Data Exposure Through AI Tools - infosecurity-magazine.com
Japan Announces Emergency Cybersecurity Package Following a Wave of Attacks - securityweek.com
UK ministers seek powers to investigate when AI agents are let off the leash - theregister.com
Medical services company settles with 4 states over 2023 hack of sensitive patient records - therecord.media
State attorneys general secure up to $10 million and corrective action plan from Perry Johnson companies after 2023 breach - databreaches.net

CVE-2026-119977 on DanSec Daily

Cybersecurity Brief – 2026-11-07

Exploited: Patch Now

Major Incidents and Breaches

Vulnerabilities and Patches

Threat Actor Activity

Trends, Tools and Tactics

Policy and Regulation

Sources