The first full week of November brought an aggressive series of security flaws striking network infrastructure, storage systems, and self-hosted environments. The most surprising disclosure is sshhole in OpenSSH. When running musl libc alongside an OpenSSH daemon built without PAM, distributions such as Alpine allowed any candidate password exceeding 256 characters to authenticate successfully against accounts without passwords. The flaw remained unnoticed in upstream code for a decade, directly exposing official cloud base images.
Perimeter hardware faces severe pressure as well. Operators of Zyxel GS1900 managed switches are dealing with a bypass of earlier summer patches that enables pre-authentication root OS command execution, with nearly 1,000 devices compromised in the wild. Self-hosted Plex Media Server instances continue to be targeted by the Plex2Shell exploit chain deploying XMRig cryptominers. Concurrently, Synology NAS devices face active C3RB3R ransomware waves (.L0CK3D), SonicWall SonicOS SSL-VPN SAML/MFA bypasses have entered CISA KEV, Ivanti Connect Secure zero-days remain under active exploitation, and WordPress Core 7.1.4 addresses a high-volume upgrade race condition. Technical details and actionable mitigations are outlined below.
1. OpenSSH on musl libc: Password Authentication Bypass „sshhole” (CVE-2026-123158 / OpenSSH 10.6p2)
The OpenSSH team published emergency release 10.6p2 on November 5, fixing a critical authentication bypass designated sshhole (CVE-2026-123158). The vulnerability allows a remote network attacker to log in via SSH using any password between 257 and 1024 characters against accounts that have no password configured (marked with an asterisk * in /etc/shadow).
The issue stems from a subtle interaction between musl libc and OpenSSH timing mitigation code. Since 2012, musl’s crypt() returns a literal string * on hashing failures (such as buffer overruns beyond 256 bytes for SHA-512). Since 2016, OpenSSH borrows salts from legitimate system accounts when testing fields too short to hold salts. Entering an over-length candidate password causes crypt() to yield *, matching the shadow record and granting immediate login. Affected targets include Alpine Linux cloud instances where the default alpine account has passwordless doas permissions.
- Identifier: CVE-2026-123158 (OpenSSH 10.6p2 / sshhole)
- Impact: Authentication bypass on passwordless accounts, potential root takeover
- Affected Systems: musl libc Linux platforms (Alpine Linux, OpenWrt, postmarketOS) running OpenSSH compiled without PAM and with
PasswordAuthentication yesenabled - Mitigation: Upgrade
opensshpackages to 10.6p2 or setPasswordAuthentication noinsshd_config - Source: Wakefield Research
2. Zyxel GS1900 Switches: Unauthenticated Root OS Command Execution (CVE-2026-107441)
Zyxel published a security advisory covering GS1900 series managed switches widely deployed in SMB networks and homelabs. Vulnerability CVE-2026-107441 carries a CVSS score of 8.8 (rated 9.8 Critical by Binarly researchers due to root execution impact).
The flaw is an out-of-bounds write defect in the CGI web management binary. An unauthenticated attacker with access to the management interface can transmit crafted HTTP requests to execute operating-system commands with root privileges. This vulnerability bypasses the earlier CVE-2026-7273 patch released in June. GreyNoise and Binarly telemetry linked the bug to an active campaign by threat group Kapibala that compromised nearly 1,000 GS1900 devices across 48 countries.
- Identifier: CVE-2026-107441
- Base Score: CVSS 8.8 / 9.8 (High / Critical)
- Exploitation Status: Active exploitation by Kapibala threat group, public Binarly write-ups
- Affected Systems: Zyxel GS1900 models (GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, -48HPv2) running firmware prior to 2.90 Patch 3
- Mitigation: Install firmware 2.90 Patch 3 (e.g. 2.90(AAHK.3)C0) immediately; isolate management interfaces behind dedicated VLANs
- Source: Ostorlab Analysis / Zyxel Advisory
3. Plex Media Server: Ongoing Plex2Shell Infections Deploying XMRig Cryptominers
Active honeypot telemetry continues to capture widespread exploitation targeting exposed Plex Media Server deployments. Threat actors exploit the Plex2Shell chain combining four vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656), culminating in unauthenticated remote code execution rated CVSS 9.8.
The attack chain leverages an SSRF flaw in /player/timeline/subscribe to bypass access controls and invoke internal APIs with owner privileges. Attackers write a malicious payload into the codecs directory, which the media transcoder loads during playback. Compromised servers are infected with XMRig cryptocurrency miners and residential proxy daemons (such as myawesomeproxy). Builds prior to 1.43.3.10828 are vulnerable (fixed in 1.43.3.10861), with Docker containers and NAS packages particularly at risk.
- Identifiers: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656 (Plex2Shell)
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Active in-the-wild exploitation deploying miners and proxy binaries
- Affected Systems: Plex Media Server versions prior to 1.43.3.10828
- Mitigation: Upgrade to version 1.43.3.10861 or newer; audit active process trees (
ps axjf) - Source: Cyber Security News
4. Synology DSM: NAS Appliances Targeted by C3RB3R Ransomware (Synology-SA-26:13 / SA-24:20)
Synology issued an urgent advisory regarding an active ransomware campaign targeting unpatched DiskStation Manager (DSM) appliances. Affected administrators report volume-wide file encryption with .L0CK3D extensions and read-me3.txt extortion notes.
Threat intelligence from Qihoo 360 and victim reports attribute the activity to the C3RB3R ransomware group. Attackers exploit known DSM weaknesses, notably SCGI output encoding flaws (CVE-2026-13684, CVSS 9.8) and login logic entropy deficiencies (CVE-2026-13639, CVSS 9.8), as well as earlier plugin daemon RCE vulnerabilities (CVE-2024-10441, CVSS 9.8). Isolating DSM management portals behind VPNs and updating to current builds is essential to prevent storage compromise.
- Identifiers: CVE-2026-13684, CVE-2026-13639, CVE-2024-10441 (C3RB3R ransomware)
- Base Score: CVSS 9.8 (Critical)
- Exploitation Status: Active ransomware campaign encrypting NAS storage (.L0CK3D)
- Affected Systems: Outdated Synology DiskStation Manager (DSM) versions
- Mitigation: Upgrade DSM to 7.2.2-72806-9, 7.2.1-69057-12, 7.3.2-86009-4 or newer; restrict DSM internet exposure
- Source: The Hacker News / Synology Advisory
5. SonicWall SonicOS SSL-VPN: SAML & MFA Authentication Bypass (CVE-2026-19868)
CISA added vulnerability CVE-2026-19868 impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog on November 6 following reports of in-the-wild exploitation. The defect carries a CVSS base score of 7.5.
The flaw resides in the SSL-VPN service when SAML authentication with enforced multi-factor authentication (MFA) is configured while secondary or alternate authentication mechanisms remain enabled. A user possessing valid credentials for the alternate method can establish a VPN session while bypassing SAML access controls and enforced MFA. Upgrading firmware to 7.3.4-7013+ (Gen7) or 8.2.3-8015+ (Gen8) is required.
- Identifier: CVE-2026-19868
- Base Score: CVSS 7.5 (High)
- Exploitation Status: Confirmed in-the-wild exploitation attempts, CISA KEV listed
- Affected Systems: SonicOS Gen7 (7.3.3-7015 and earlier) and Gen8 (8.2.2-8015 and earlier)
- Mitigation: Upgrade firmware to 7.3.4-7013+ (Gen7) or 8.2.3-8015+ (Gen8); disable alternate authentication methods on SSL-VPN services
- Source: SonicWall Security Advisory SNWLID-2026-0014
6. Ivanti Connect Secure: Two Additional Zero-Days Exploited by UTA0576 (CVE-2026-111357, CVE-2026-118527)
Ivanti updated security disclosures for Connect Secure VPN gateways to incorporate two additional vulnerabilities exploited by threat group UTA0576, added to CISA KEV on October 30. Chained with CVE-2026-104935, these flaws allow unauthenticated root appliance control, log manipulation, and Active Directory credential extraction.
- Identifiers: CVE-2026-111357, CVE-2026-118527 (UTA0576 chain)
- Base Scores: CVSS 8.8 & CVSS 4.3
- Exploitation Status: Actively exploited in targeted attacks, CISA KEV listed
- Affected Systems: Ivanti Connect Secure 25.1.1.2 and earlier, 22.8R2.5 and earlier
- Mitigation: Deploy versions 25.1.1.3 or 22.8R2.6
- Source: Rapid7 Analysis
7. WordPress Core: Upgrade-Window Race Condition in CISA KEV (CVE-2026-119977)
WordPress 7.1.4 patches an upgrade race condition (CVE-2026-119977, CVSS 8.1), added to CISA KEV on November 3. Predictable paths in /wp-content/upgrade/ allowed attackers to inject rogue wp-config.php files during core updates. Over 240,000 exploitation attempts were blocked in the wild.
- Identifier: CVE-2026-119977
- Base Score: CVSS 8.1 (High)
- Exploitation Status: Mass automated internet scanning, CISA KEV listed
- Affected Systems: WordPress Core branches 4.7 through 7.1.3
- Mitigation: Upgrade immediately to WordPress 7.1.4 and restrict web execution in upgrade directories
- Source: Wordfence Analysis
Action Items for Today
- Audit musl Linux and Alpine Instances: Upgrade to OpenSSH 10.6p2 or enforce
PasswordAuthentication noto remediate sshhole (CVE-2026-123158). - Patch Zyxel GS1900 Switches: Apply firmware 2.90 Patch 3 to eliminate CVE-2026-107441 exploited by Kapibala.
- Upgrade Plex Media Server: Upgrade to 1.43.3.10861+ (especially Docker and NAS builds) and inspect process trees for XMRig miners.
- Upgrade Synology NAS Devices: Apply DSM updates (7.2.2-72806-9+) and ensure DSM management ports are firewalled from the internet against C3RB3R ransomware.
- Patch SonicWall Firewalls: Upgrade firmware to 7.3.4-7013+ or 8.2.3-8015+ and disable alternate auth paths in SSL-VPN.
- Remediate Ivanti Connect Secure: Deploy versions 25.1.1.3 or 22.8R2.6.
- Verify WordPress 7.1.4 Updates: Ensure core updates finished and block PHP execution under
/wp-content/upgrade/.
