# Archive
Browse past daily curated stories
Friday, November 06, 2026
-
1The Hacker News generalOpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
OpenSSH released emergency patch version 10.6p2 for a critical vulnerability dubbed '*sshole' affecting Alpine Linux's openssh-server package. Attackers with network access can authenticate to accounts configured with no password (such as SSH key-only accounts) using any password between 257 and 1,024 bytes long, bypassing authentication entirely. Alpine has also published fixed packages for all affected versions, and other musl libc-based distros may be vulnerable as well.
-
2The Hacker News generalOpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
OpenAI detailed a 30-hour pipeline run using an unreleased cyber-focused AI model that analyzed 2,308 Linux kernel candidates, dynamically reproduced 1,724 vulnerabilities, and generated 948 working local privilege escalation exploits at a total API cost of approximately $1.2 million. The research demonstrates that AI pipelines can now automate end-to-end vulnerability discovery and exploit generation at scale, fundamentally changing the economics of offensive security research. Security teams should expect accelerated exploit availability timelines for unpatched kernel flaws.
-
3The Hacker News generalZyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel's earlier firmware patch (version 2.90) for actively exploited GS1900 switches failed to fully remediate the underlying flaw, tracked as CVE-2026-107441 — an out-of-bounds write allowing unauthenticated OS command execution via crafted HTTP requests to the web management interface. Binarly researchers confirmed attackers could still exploit patched devices, prompting Zyxel to release new firmware covering 10 GS1900 switch models. Administrators who applied the initial patch must update again immediately.
-
4The Hacker News generalDebian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A MitM flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can intercept package downloads to substitute a verified package with malicious code that executes as root. The attack is triggered when APT retries failed downloads — a behavior enabled by default starting in Debian 12 — and was disclosed jointly by Debian, Ubuntu, and APT developers on November 4, 2026. All Debian 12+ and affected Ubuntu users should apply the available patches immediately.
-
5The Hacker News generalSonicWall Won't Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
SonicWall has disclosed two critical vulnerabilities in end-of-life Global Management System (GMS) 9.5.2 and earlier that will not receive patches: CVE-2026-109593 (CVSS 9.1), an unauthenticated file read flaw, and a second flaw allowing database record modification. Organizations still running GMS 9.5.2 or earlier have no vendor remediation path and should migrate immediately or implement network-level controls to restrict access to the management interface.
-
6SecurityWeek generalRussia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
Russia-linked threat actor APT29 conducted a large-scale watering hole campaign targeting iOS and Android users primarily in Ukraine, the US, and Europe, using multi-stage exploit chains to fingerprint and selectively compromise high-value victims. The campaign involved compromising legitimate websites to serve device-specific exploits, then harvesting sensitive information from confirmed targets. The selective fingerprinting approach makes detection particularly difficult as most visitors see no malicious activity.
-
7The Hacker News generalHackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
CISA added CVE-2024-27834 (CVSS 5.5), an improper authentication flaw affecting multiple Apple operating systems, to its Known Exploited Vulnerabilities catalog following confirmed active exploitation delivering info-stealing malware. The medium-severity rating belies real-world impact, as attackers are actively chaining it to drop credential-harvesting payloads. Federal agencies face BOD 22-01 remediation deadlines, and enterprise security teams should prioritize patching across all affected Apple platforms.
-
8The Record threat-intelFrench bank confirms cyber heist, hackers suspected to have stolen an estimated $133 million
Crédit Mutuel Arkéa confirmed a cyber heist in which attackers compromised an unnamed third-party supplier, then used the bank's own account infrastructure to execute unauthorized transfers estimated at $133 million. The attack vector — a supply chain compromise enabling fraudulent internal transfers — mirrors techniques seen in SWIFT-related bank heists. The incident underscores persistent risk in third-party supplier access to financial transaction systems.
-
9BleepingComputer generalCyberattack disrupts blood storage refrigeration systems in France
France's national blood service confirmed a cyberattack on a refrigeration equipment provider altered temperature and defrost settings at three storage facilities, directly threatening stored blood products. This attack follows similar incidents hitting European supermarket cold-chain systems, prompting a joint FBI/CISA advisory warning critical infrastructure operators worldwide to harden industrial refrigeration systems. The targeting of cold-chain OT systems represents an escalating threat vector with direct public health consequences.
-
10The Hacker News generalCritical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
A critical unauthenticated arbitrary file write vulnerability was disclosed in Ruby on Rails' Active Storage component, exploitable by uploading a crafted file to applications using ImageMagick for image processing. Fixed in Rails versions 8.1.4.1 and 8.0.5.2, the flaw could allow attackers to write attacker-controlled files to the server, potentially enabling remote code execution through web shell placement or configuration tampering. Any Rails app using Active Storage with ImageMagick should upgrade immediately.