A roundup of 137 items curated from across the security community. News sshhole: Long Passwords Bypass OpenSSH Auth on musl Linux by Bad Sector Labs. musl’s crypt() returns * when it rejects a password over 256 bytes, which matches the placeholder hash on key-only and locked accounts. Alpine, OpenWrt and other musl boxes running sshd with password auth have been exposed since 2016, and GreyNoise is already tracking exploitation. +4 more on this storyOpenSSH flaw lets attackers log into password-disabled Linux accounts (BleepingComputer) sshhole-lab: Reproduce sshhole Locally (Clément Notin) CVE-2026-123158 - SSHole - OpenSSH/musl Password Auth Bypass Nuclei Template (ProjectDiscovery) GreyNoise Live Tracking of SSHole Exploitation (Steve YARA Synapse Miller) OpenAI Pipeline Builds 948 Working Linux Root Exploits by chompie. One mid-October run reproduced 1,724 kernel bugs and produced working LPE exploits and patches for 948 of them, at about $1,279 per exploit. The model behind it, GPT-6 Cyber, launched the next day and also found 81 novel Firefox renderer RCEs. ...

A roundup of 130 items curated from across the security community. News Backdoored Claude Code Extension Found on Open VSX by Patrick Wardle. Phorion found version 2.1.313 of the official Claude Code for VS Code bundle on Open VSX dropping a persistent SSH backdoor on macOS, Linux and Windows. The writeup covers the implant, a bug in its macOS setup logic, and what to hunt for. +1 more on this storyCursor: Security Notice on the Claude Code Extension Incident (Florian Roth) Silent Train: Volt Typhoon’s Zero-Day Exploitation Framework by SwitHak (). Lumen’s Black Lotus Labs exposes the framework Volt Typhoon uses to stage zero-day exploitation and keep long-term access to strategic targets. ...

A roundup of 255 items curated from across the security community. PHP2Shell: Critical Pre-Auth RCE in PHP (CVE-2026-109618) Calif.io discovered two critical PHP vulnerabilities enabling unauthenticated remote code execution on stock configurations. Trail of Bits confirmed a production-grade exploit hitting WordPress, MediaWiki, phpBB, and Laravel across both ARM64 and x86-64. Unit 42 confirmed active exploitation in the wild. NSA, FBI, and CISA all recommended taking affected systems offline. Kuba Gretzky · Read more ...

A roundup of 224 items curated from across the security community. CVE-2026-79957: IDOR Exposes Cleartext Passwords in ServiceNext Black Lantern Security discovered that any authenticated ServiceNext user could enumerate sequential user IDs and pull every account’s cleartext password. Fully disclosed and remediated. Read more IIS Shortname Enumeration Still Opens Doors After 16 Years Black Lantern Security breaks down why this medium-CVSS, 16-year-old default-on IIS finding keeps chaining into critical results on real engagements. Also: Trezor wallets hit with the same implant technique. ...

A roundup of 372 items curated from across the security community. News APT29 CaptiveCrunch Re-Emerges at Larger Scale with Rust Malware by Nick Carr. Midnight Blizzard’s CaptiveCrunch campaign re-emerged in September 2026 at even larger scale, with AI-refactored Rust-flavor malware and continued MSP compromise. Pwn2Own Ireland 2026: Full Schedule Released by thaddeus e. grugq. Pwn2Own Ireland 2026 full schedule published. Targets include mobile devices, IoT, smart home, automotive, and NAS platforms with prize pools up to $300K per category. ...

A roundup of 759 items curated from across the security community. News WordPress RCE (CVSS 9.2) Affects All Versions Since 2016 by Mike Felch (Stay Ready). Critical WordPress RCE vulnerability (CVSS 9.2) affects all versions back to 2016. Update immediately. Warlock Ransomware Hits Water and Telecom Infrastructure by Dave Aitel. Warlock ransomware group targets water utilities and telecom operators, deploying custom payloads against critical infrastructure. Oxygen Forensics CEO Arrested for Concealing Russian Ties by scriptjunkie (Matt). DOJ arrested the CEO of Oxygen Forensics for concealing the digital forensics company’s ties to Russia while selling tools to US law enforcement. ...

A roundup of 483 items curated from across the security community. News Thailand Finance Ministry Targeted by AI Agent Attack by /r/netsec. Hunt.io documents an AI agent attack targeting Thailand’s Ministry of Finance with Hermes running approval prompts disabled. OmniRoute RCE PoC Disclosed (CVE-2026-88062, CVSS 9.5) by kmkz. Public PoC released for OmniRoute CVSS 9.5 RCE vulnerability. Cyclops Blink Returns on Compromised Cisco FMC Devices by hasherezade. Sophos discovers a new Cyclops Blink variant on compromised Cisco FMC devices. Extended capabilities beyond the original malware analyzed by UK NCSC. ...

A roundup of 388 items curated from across the security community. News Trezor Data Breach Reaches 81,000 Customers by BleepingComputer. Trezor hardware wallet breach via email provider Brevo now confirmed to affect 81,000 customers, up from initial estimates. MariaDB Auth Bypass: Any User Can Reset Root Password by Rémi GASCOU (Podalirius). Logical bug in MariaDB allows any user, regardless of privileges, to update the password of any other user including root. LG TVs Record Audio in Standby, Scan Local Networks by Sean Metcalf. Gamers Nexus testing reveals LG Smart TVs scan local networks, identify content, and record audio even in standby mode with no internet connection. WebOS flaws could enable RCE. ...

A roundup of 300 items curated from across the security community. News French Hospital Fined 500K After 727,000 Patient Breach by BleepingComputer. French hospital fined 500,000 euros after a breach exposed personal and medical data of 727,000 patients. Coder Registry Infrastructure Compromised for Supply Chain Attack by Nicolas Krassas. Coder’s module registry infrastructure was compromised to push malicious modules to developers via the supply chain. Four Arrested in Nairobi Over SIM-Swapping Scheme by Nicolas Krassas. Four Chinese nationals arrested in Nairobi for running a SIM-swapping and money-laundering operation. ...

A roundup of 445 items curated from across the security community. News DEF CON: AI-Automated Bluetooth Firmware Reverse Engineering by thaddeus e. grugq. DEF CON talk and tools from Xeno and Veronica Kovah on using AI to automatically reverse engineer Bluetooth firmware. LLM skills repo published. Aikido Outperforms Claude Security Mythos with Smaller Models by Dave Aitel. Aikido demonstrates that many small-model agents find more vulnerabilities than a few large-model agents, outperforming Claude Security Mythos at a fraction of the token cost. ...