Daily Cybersecurity News – November 6, 2026
CyberRecaps is supported by its readers. We may earn an affiliate commission at no extra cost to you if you buy through a link on this page.
OpenSSH SSHole flaw exploited hours after disclosure
HighWhat happened
Threat intelligence firm Previdian observed exploitation of an OpenSSH authentication bypass just hours after disclosure, confirming successful root access on an Alpine Linux honeypot.
Tracked as CVE-2026-123158 (CVSS 8.1 High) and nicknamed sshole, the flaw lets remote attackers log into certain passwordless accounts using any password longer than 256 characters. It was fixed in OpenSSH 10.6p2 on November 5. The issue stems from musl libc's crypt() returning "*" for overlong SHA-256/SHA-512 inputs, which matches the "*" placeholder in /etc/shadow for disabled-password accounts, combined with an older OpenSSH timing-mitigation path.
Previdian saw the first attempt under nine hours after CVE publication from a single Japan-based IP that used oversized passwords and ran recon commands. CISA has not added it to KEV.
Who is affected
OpenSSH versions before 10.6p2 on Linux systems using musl libc without PAM, with password authentication enabled and accounts holding only "*" in the password field (plus at least one account with a real hash).
Primarily Alpine Linux (default openssh-server builds), plus OpenWrt, Buildroot, Yocto, and many Docker images. Passwordless accounts such as root or key-only deploy users are at risk if reachable on port 22.
Why it matters
A single connection grants login without credentials on widely deployed lightweight and container systems. Attackers can scan millions of SSH ports cheaply and succeed every time the conditions match.
Rapid exploitation aided by AI shrinks the patch window. Operators of Alpine-based infrastructure, edge devices, and containers face immediate unauthorized access risk leading to full compromise.
How it could have been prevented
Upgrade to OpenSSH 10.6p2 or the backported packages for your Alpine branch (or equivalent distro fix) and restart sshd.
If patching is delayed, set PasswordAuthentication no and rely on keys only. Audit /etc/shadow for "*" accounts and confirm PAM is in use where possible. Restrict SSH exposure with firewalls or jump hosts.
Relevant professional terms
- Authentication bypass
- A flaw that lets an attacker gain access without providing valid credentials the system normally requires.
- musl libc crypt() behavior
- The C library routine that hashes passwords; on musl it rejects inputs over 256 bytes for certain algorithms and returns a sentinel "*" that can collide with disabled-account markers.
OpenAI pipeline generates 948 Linux root exploits in 30 hours
MediumHow it works
- Vulnerability discovery: agents select high-value, reachable kernel code and flag candidates.
- Dynamic validation: reproduce findings in sandboxed VMs with runtime evidence.
- Exploitability assessment: craft PoCs for info leaks or LPE.
- Patch generation: produce candidate fixes.
- Human review: researchers vet exploit, patch, and severity before reporting.
What happened
OpenAI detailed an agentic pipeline using an upcoming cyber-focused AI model that, in a mid-October 2026 run lasting about 30 hours, identified 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 working local privilege escalation (LPE) exploits plus 291 information-leak PoCs.
The run cost $1.2 million in API credits (roughly $1,279 per LPE). Agents discovered at least 10 novel Linux exploitation techniques, including new object-spray, page-grooming, data-only, and type-confusion methods. Human researchers reviewed outputs before reporting. This builds on earlier GPT-5.5-Cyber results.
Who is affected
Linux kernel maintainers, distribution vendors, and any organization running unpatched Linux systems where local privilege escalation could be chained after initial access.
The research targeted a commonly used desktop Linux distribution with standard protections (KASLR, SMEP, SMAP) enabled. Findings are being upstreamed as patches.
Why it matters
Frontier AI can now autonomously discover, validate, exploit, and patch hundreds of kernel bugs at scale and low relative cost, compressing the defender advantage.
The same capabilities are available to attackers, raising the volume of viable zero-days and novel techniques. Builders must assume rapid AI-assisted discovery of remaining flaws in core OS code.
Relevant professional terms
- Local privilege escalation (LPE)
- A vulnerability that lets a low-privileged user on a machine gain higher privileges, often root or SYSTEM.
- Agentic pipeline
- A multi-stage autonomous system of AI agents that sequentially discover, validate, exploit, and patch vulnerabilities with minimal human intervention until final review.
CWPdoor malware backdoors Linux servers via Control Web Panel
HighWhat happened
Researchers at QiAnXin XLab identified CWPdoor, a stealthy Linux backdoor that replaces the legitimate cwpsrv binary of Control Web Panel (CWP) with a malicious version.
The malware acts as a passive backdoor, remaining dormant until triggered by a specially crafted HTTP request carrying encrypted headers. It uses AES-256-CBC encryption and RSA signatures for command execution while suppressing server logs. An installer script posing as an update deploys it (requiring prior root). The campaign appears linked to the long-running Ebury botnet. Samples target cwpsrv 1.15.10 and 1.24.0.
Who is affected
Linux servers running Control Web Panel (formerly CentOS Web Panel), a popular free hosting administration tool. XLab identified over 340,000 publicly exposed CWP instances.
Hosting providers and administrators of multi-tenant web, email, and DNS servers are primary targets. Evidence of real-world use includes a VirusTotal upload containing both CWPdoor and Ebury components.
Why it matters
A replaced core binary gives attackers silent, logged-suppressed remote command execution on servers that manage numerous customer sites and services.
Linkage to Ebury (nearly 400,000 historical compromises) raises the scale of potential impact. Detection is difficult because the panel functions normally until the magic request arrives.
How it could have been prevented
Inspect for the ngx_http_integrity_helper socket, suspicious helper processes, strings containing X-Ngx-Integrity in the cwpsrv binary, and leftover cwpsrv.prev-* backups.
If compromised, replace the malicious binary with a clean one from a trusted source, update CWP to the latest version, rotate all administrative credentials, and hunt for Ebury or other implants. Restrict panel exposure and monitor binary integrity.
Relevant professional terms
- Backdoor
- Malware that gives an attacker remote access to a system while hiding its presence from normal users and logs.
- Passive trigger via signed headers
- A stealth technique where the implant ignores ordinary traffic and activates only on cryptographically authenticated custom HTTP headers, suppressing log entries for those requests.
Barracuda Email Gateway flaws chain to root without login
HighWhat happened
Two flaws in Barracuda Email Security Gateway can be chained for unauthenticated root command execution. watchTowr detailed the attack chain after Barracuda released patches.
CVE-2026-116606 (CVSS 9.3) is an authorization bypass allowing an unauthenticated attacker to restore a crafted configuration backup and alter global settings. CVE-2026-111560 (CVSS 8.6) is a command injection in the timezone field that runs as root but normally requires admin rights; the bypass supplies that access. Neither is in CISA KEV and no exploitation has been reported. A failed password-change path returns a low-privilege role that leaves backup restore open; backups use a hardcoded checksum secret that can be forged.
Who is affected
Barracuda Email Security Gateway versions earlier than 9.4.0.030 (fixed in 9.4.0.030 and later). The command-injection issue also affects Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway, but those still require admin authentication.
Any organization with the ESG admin interface reachable (especially from the internet) is exposed to the full unauthenticated chain.
Why it matters
Email security appliances sit at the perimeter and process sensitive traffic; root access lets attackers implant persistence, pivot, or disable filtering.
Barracuda ESG was previously hit by UNC4841 via a different zero-day (CVE-2023-2868). Unauthenticated root on an internet-facing appliance is a high-value target for both ransomware and espionage actors.
How it could have been prevented
Apply the vendor patches or upgrade to fixed firmware for each affected product immediately. Re-enable automatic patching if disabled.
If patching is delayed, restrict the administration interface to trusted internal networks only. watchTowr released a detection tool to check vulnerability status; use it and monitor for anomalous backup restores or timezone changes.
Relevant professional terms
- Authorization bypass
- A vulnerability that lets an attacker perform privileged actions without first proving they have the required permissions or login.
- Command injection via configuration field
- Improper neutralization of shell metacharacters in a stored setting (here timezone) so that the value is later executed as a root-level OS command.
Fileless SharePoint breach by Storm-2603 uses ToolShell
CriticalWhat happened
Kaspersky analyzed a fileless intrusion by Storm-2603 that exploited ToolShell vulnerabilities (CVE-2025-53770, CVSS 9.8 Critical and in CISA KEV; CVE-2025-53771) in on-premises Microsoft SharePoint.
Attackers fingerprinted the target, waited days, then on Christmas Eve delivered a crafted request that loaded a modular C# webshell entirely into the IIS worker process (w3wp.exe) with no file on disk. The implant used a custom VirtualPathProvider, XOR-obfuscated C2, and tunneling (suo5) for lateral movement. Later stages included privilege escalation, tool downloads, an EDR-killing driver, and a blocked Warlock ransomware attempt. Attribution to Storm-2603 is moderate confidence; Microsoft previously linked the group to ToolShell ransomware.
Who is affected
Organizations running unpatched on-premises Microsoft SharePoint Server vulnerable to the 2025 ToolShell flaws.
Any internet-facing or internally reachable SharePoint instance that had not applied the July 2025 updates (and subsequent hardening) remained exposed months later. Victims face full domain compromise risk once the memory-resident bridge is established.
Why it matters
Fileless execution inside w3wp.exe evades traditional file-based detection and survives only for the application-domain lifetime, complicating forensics.
Storm-2603 combines the critical RCE with ransomware objectives, turning a collaboration server into a beachhead for encryption. Delayed patching of KEV-listed flaws continues to enable high-impact campaigns.
How it could have been prevented
Ensure all on-premises SharePoint servers are patched against CVE-2025-53770/53771 and related ToolShell issues; recycle application pools after patching.
Monitor w3wp.exe for anomalous child processes, unusual VirtualPathProvider registrations, network tunnels, and known IoCs. Restrict SharePoint admin endpoints, enable AMSI/advanced auditing, and deploy EDR with memory-scanning capabilities. Hunt for post-exploitation artifacts even if initial access left no files.
Relevant professional terms
- Fileless attack
- An intrusion that runs malicious code only in memory without writing persistent files to disk, making it harder for traditional antivirus to spot.
- Runtime subversion via VirtualPathProvider
- Injection of a custom ASP.NET provider that intercepts virtual path resolution inside the IIS worker process, allowing a memory-resident webshell to handle attacker requests while blending with legitimate application traffic.
Chainalysis breach exposes all users credentials forces service shutdown
HighWhat happened
Blockchain analysis firm Chainalysis disclosed that an agentic cyber attack exposed names, usernames, password hashes, and live tokens for all users. The company took Reactor, Data Solutions, KYT (UI and API), address screening products, and the login page offline while investigating.
Earlier it described an on-path attack that exposed a subset of passwords; the broader credential exposure was confirmed later. No evidence was found that investigations data or attribution data was accessed or manipulated. Services are being restored in phases with allow-listing and mandatory resets. The incident resembles recent AI-driven attacks on other platforms involving tools such as ARTEX.
Who is affected
All Chainalysis users, including compliance teams, investigators, exchanges, and law-enforcement customers who rely on Reactor, KYT, Data Solutions, and related products.
Anyone who reused Chainalysis credentials elsewhere faces credential-stuffing risk. The company is notifying customers whose KYT accounts showed unauthorized access.
Why it matters
Exposure of live tokens and password hashes for an entire user base of a critical crypto-compliance platform enables account takeover and potential follow-on abuse of screening or investigation tools.
Service outages disrupt anti-money-laundering and law-enforcement workflows. The agentic nature of the attack underscores rising AI-assisted offensive operations against high-value fintech targets.
How it could have been prevented
Reset Chainalysis passwords and rotate all API keys once access is restored. Supply trusted IP addresses for allow-listing as instructed.
Immediately change any reused passwords on other systems. Enable phishing-resistant MFA everywhere possible, monitor for anomalous logins, and treat any exposed tokens as compromised. Review third-party access and secrets hygiene.
Relevant professional terms
- Credential exposure
- A breach in which usernames, password hashes, or session tokens are obtained by an attacker, allowing potential account takeover.
- On-path attack
- An attack in which the adversary positions themselves between client and server (or intercepts traffic) to capture or alter data in transit, sometimes called a man-in-the-middle.
DigiCert data breach follows server migration error
MediumWhat happened
Certificate authority DigiCert suffered a data breach after a February 2025 server migration mistakenly exposed an internal business system to the internet without VPN protection.
The system had a self-registration feature that allowed external account creation. An authorization flaw then let those accounts read archived customer data between June 27 and July 2, 2026. Exposed data included names, business emails, phone numbers, business addresses, and in some cases identity documents (passports, driver’s licenses, utility bills). DigiCert initially misclassified the unauthorized accounts, confirmed compromise on October 19, and is notifying affected customers. Core services (CertCentral, DigiCert ONE) and issued certificates were unaffected.
Who is affected
DigiCert customers whose archived business-contact and identity documents resided in the exposed internal system. The company has not published a total count but describes it as a subset of archived records.
Organizations that submitted identity documents for validation are at higher risk of identity theft or targeted social engineering.
Why it matters
Even a read-only archive of CA customer PII and government IDs is valuable for phishing, account takeover elsewhere, or fraud.
A 16-month exposure window caused by a migration error highlights the danger of unintended internet reachability and delayed detection. Trust in certificate authorities depends on protecting the identity data they collect.
How it could have been prevented
DigiCert has disabled self-registration and tightened access controls. Affected customers should monitor for identity theft, place fraud alerts if documents were involved, and be wary of social-engineering attempts that reference DigiCert data.
Operators of similar internal systems should enforce network segmentation, require VPN or zero-trust access, disable unnecessary self-registration, apply least-privilege authorization, and continuously monitor for unexpected external exposure after migrations.
Relevant professional terms
- Data breach
- An incident in which sensitive or confidential information is accessed or exfiltrated by an unauthorized party.
- Authorization flaw after self-registration
- A misconfiguration that allows newly created external accounts to reach data or functions they should never see, often because role checks or network controls were incomplete.