# Today's Top Stories

The 'SSHole' vulnerability (CVE-2026-123158) in OpenSSH is under active exploitation, with attackers executing commands, stealing credentials, and establishing persistent access on Linux systems. Initial exploitation is attributed to botnets and crypto miners, but broader threat actor adoption is expected. Security teams should prioritize patching OpenSSH immediately and audit exposed SSH endpoints.

N-able took its hosted N-central environments offline and urged on-premises customers to shut down servers after a researcher publicly disclosed 30+ alleged zero-day vulnerabilities, including exploits enabling full system takeover. N-central is widely used by MSPs for endpoint management, making this a high-impact supply-chain-adjacent event. The mass disclosure without coordinated patching puts thousands of managed environments at risk.

French authorities attributed October cyberattacks on refrigeration systems at 700+ supermarkets to Shahid Kaveh, an IRGC cyber unit previously linked to attacks on U.S. water utility industrial controllers. The attacks caused food losses and sparked at least 15 fires, marking a significant escalation in ICS/OT-targeting attacks with kinetic physical consequences. This is the first formal attribution of the incident.

CISA added CVE-2026-19868, a high-severity SonicWall SonicOS MFA bypass flaw (CVSS 7.1–7.5), to its Known Exploited Vulnerabilities catalog following reports of possible real-world exploitation. SonicWall devices are widely deployed as network perimeter appliances, making MFA bypass vulnerabilities particularly dangerous for enterprise environments. Administrators should apply patches immediately per CISA's binding operational directive timelines.

Threat actors are actively exploiting the 'Plex2Shell' four-vulnerability chain targeting Plex Media Server installations on QNAP NAS devices, enabling remote code execution. QNAP NAS devices are frequently targeted due to internet exposure and their role in storing sensitive data; the chained exploit lowers the barrier for full compromise. Users running Plex on QNAP should patch both platforms and restrict external access immediately.

An attacker leveraged credentials for Qubole's platform AWS account to breach multiple Qubole customer AWS environments between October 14–26, exfiltrating stored secrets and data, according to Wiz. Qubole, a data lake platform owned by Idera, has not disclosed how the platform credentials were initially compromised. This illustrates the third-party trusted-access risk in cloud environments where SaaS vendors hold cross-account IAM permissions.

Attackers compromised Ethersphere's release automation pipeline to publish malicious versions of bee-js (13.3.0) and Swarm Desktop (0.56.2), injecting wallet-stealing malware that exfiltrates Swarm node wallet keys and stored unlock passwords, plus installs a backdoor. This is a supply chain attack via hijacked CI/CD release infrastructure targeting the decentralized storage ecosystem. Users of either package should consider their node credentials compromised and rotate keys immediately.

Security researchers found that two automakers' mobile app backends, both using ForgeRock (now Ping Identity) as the identity platform, were configured with the default 'admin:admin' password, allowing full account takeover and enabling remote door unlock and engine start for connected vehicles. The flaw demonstrates that default credential hygiene failures persist even in safety-critical automotive systems. Both manufacturers have been notified, though the article does not name them.

A former FBI agent pleaded guilty to stealing approximately $2.5 million in cryptocurrency from wallets belonging to fraud victims and nation-state hackers whose cases were under active federal investigation. The insider theft occurred while the agent had privileged access to seized digital assets, raising serious questions about custodial controls for cryptocurrency evidence in law enforcement. The plea signals a rare prosecution of an insider at a federal law enforcement agency for crypto theft.

Vanderbilt University is responding to a ransomware attack claimed by the BYOD ransomware gang, which asserts it encrypted university databases and exfiltrated sensitive student, employee, and research data. The incident is actively impacting campus devices and systems, with the scope of data theft still being assessed. BYOD is an emerging ransomware actor, and this attack on a major research university signals continued targeting of higher education institutions holding valuable research data.