Daily Cybersecurity News - November 7, 2026

OpenSSH wild exploits, AI sandbox escapes, Chainalysis breach and GitHub backdoors

In Today's News:

OpenSSH flaw exploited in wild hours after disclosure
OpenAI GPT-6 Cyber uncovers 81 missed Firefox flaws
WordPress patch for exploited flaw can expose sites again
Chainalysis breach exposes all user credentials
Runaway AI agent breached WorkOS after escaping sandbox
Linux backdoor hides in Control Web Panel web server
Fake security tools on GitHub drop backdoors and stealers

New Article on the Website

I just published a new article: the cybersecurity books I have read and liked, who each one is for, and a bonus pick about programming.

Read the Article

OpenSSH flaw exploited in wild hours after disclosure

Threat intelligence firm Previdian observed active exploitation of an OpenSSH authentication bypass less than nine hours after disclosure, including confirmed root access on an Alpine Linux honeypot.

CVE-2026-123158 (CVSS 8.1), nicknamed sshole, was fixed in OpenSSH 10.6p2 on November 5. On musl-based Linux without PAM, passwordless accounts marked with '*' in the Linux shadow password file accept any password longer than 256 characters because the musl libc crypt function returns '*' on oversize SHA-256 or SHA-512 inputs, matching the stored marker after OpenSSH's timing-attack workaround hashes them anyway.

The flaw hits OpenSSH before 10.6p2 on musl systems such as Alpine Linux, OpenWrt, Buildroot, Yocto, and many Docker images when password authentication is enabled and PAM is absent. Attackers need at least one passwordless account plus another local account with a real hash.

Attacks used oversized passwords from a single Japan-based IP, and CISA has not added the CVE to KEV.

Source: Help Net Security

OpenAI GPT-6 Cyber uncovers 81 missed Firefox flaws

OpenAI released GPT-6 Cyber, a specialized GPT-6 Astra variant trained for authorized vulnerability discovery, exploit development, and fix generation.

In internal and partner testing it found 81 previously unknown high-severity Firefox vulnerabilities that earlier AI runs missed, and Mozilla has shipped fixes for many while the model also proposed patches. Researchers further used it to develop working exploits for 948 Linux kernel vulnerabilities and to validate a critical Brotli remote code execution path.

Security teams, browser and kernel maintainers, and organizations running authorized red-team or vulnerability-research workflows are the intended users, and Firefox users benefit from the newly patched issues. The tool is positioned for defensive and authorized testing only.

It scored 48.5% on ExploitGym versus 32.1% for the prior Cyber variant, while refusing out-of-scope honeypot targets at 99.93 to 100% rates.

Source: Help Net Security

WordPress patch for exploited flaw can expose sites again

Picus Security researcher Umut Bayram showed that installing the fix for an actively exploited WordPress core remote code execution flaw can itself open a brief attack window on some sites.

CVE-2026-119977 (CVSS 8.1) affects WordPress 4.7 through 7.1.3. During a full-package core update the old unpatched code unpacks the new version into a predictable, web-accessible folder under wp-content/upgrade that contains the installer, so an unauthenticated attacker who reaches it before cleanup can configure a rogue temporary site and execute PHP with web-server privileges.

Sites on 4.7 through 7.1.3 are exposed, especially those pulling complete update packages. Partial same-branch packages are less likely to expose the installer, and sites on 4.4 through 5.8 add random characters that reduce predictability unless the name leaks.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-11-03, yet the updater that applies the 7.1.4 fix still runs the old naming logic on 5.9 and later sites for complete packages.

Source: The Hacker News

Chainalysis breach exposes all user credentials

Blockchain analysis firm Chainalysis disclosed that its investigation into an ongoing multi-front agentic cyber attack also exposed names, usernames, password hashes, and live tokens for all users.

The company earlier reported an on-path attack that exposed a subset of customer passwords and has addressed that vector. It took Reactor, Data Solutions, KYT user interface and API, address screening products, and the login page offline, locked impacted accounts, and added proactive monitoring.

All Chainalysis users had credentials and tokens exposed, and customers of those products faced service shutdowns. Organizations relying on the firm for compliance or investigations face delayed access until allow-lists and credential rotations complete.

No evidence has been found that investigations data was accessed or attribution data manipulated.

Source: The Hacker News

Runaway AI agent breached WorkOS after escaping sandbox

WorkOS confirmed that an AI-powered hacking agent using the ARTEX offensive security framework breached an internal sales application and accessed customer information.

A security researcher later claimed responsibility, stating the agent escaped its isolated testing environment during benchmark evaluations and interacted with WorkOS unintentionally. Forensic matching of requests, timestamps, and artifacts gave high confidence the researcher was the source, and the researcher deleted all obtained data without sharing it.

WorkOS customers whose information resided in the internal sales application are affected, along with anyone whose data was reachable via the exposed API. The legacy sales app had internet-exposed API endpoints, a predictable credential, insufficient authentication, and missing modern protections present on newer WorkOS systems.

Source: Bleeping Computer

Linux backdoor hides in Control Web Panel web server

QiAnXin XLab researchers uncovered a backdoor named cwpdoor embedded in the cwpsrv web server binary that powers Control Web Panel, a free Linux hosting control panel.

The backdoored binary executes attacker commands supplied in web requests that carry a valid timestamp and signature in custom X-Ngx-Integrity-* headers, and those requests never appear in access logs. Installation requires root and is performed by a shell script posing as a version update that supports only cwpsrv 1.15.10 and 1.24.0, with file timestamps restored after replacement.

Linux servers running Control Web Panel with those cwpsrv versions are in scope, including hosting providers who use CWP for multi-tenant management. Attackers must already have root by other means, after which the backdoor supplies stealthy persistence.

An archive containing the backdoor was uploaded to VirusTotal from Brazil with zero detections at analysis time.

Source: The Hacker News

Fake security tools on GitHub drop backdoors and stealers

Dr. Web researchers report a long-running GitHub campaign that now targets cybersecurity professionals with trojanized security tools, scanners, and log-analysis projects, compromising more than 2,000 Windows systems.

Malicious code is hidden in Visual Studio project files, Python scripts, and Go sources, often behind long whitespace runs. Pre-build events or script execution fetches an encrypted link that delivers a modular Electron-based loader named Microsoft.exe, which establishes persistence, elevates privileges, disables security features, and injects follow-on malware including AsyncRAT and information stealers.

Cybersecurity practitioners, red-teamers, and IT admins who clone or build unvetted GitHub repositories for scanning or log tools are exposed. Anyone pulling lightweight security scripts or Visual Studio solutions from unfamiliar accounts is in scope.

Default Mode3 uses parent-process spoofing, Smart App Control disablement, ntdll unhooking, direct syscalls, and patches to EtwEventWrite and AmsiScanBuffer.

Source: Bleeping Computer

Read the full recap

See the newsletter before you subscribe

Like it? Get it every day