A roundup of 137 items curated from across the security community.

News

musl’s crypt() returns * when it rejects a password over 256 bytes, which matches the placeholder hash on key-only and locked accounts. Alpine, OpenWrt and other musl boxes running sshd with password auth have been exposed since 2016, and GreyNoise is already tracking exploitation.

+4 more on this storyOpenSSH flaw lets attackers log into password-disabled Linux accounts (BleepingComputer)
sshhole-lab: Reproduce sshhole Locally (Clément Notin)
CVE-2026-123158 - SSHole - OpenSSH/musl Password Auth Bypass Nuclei Template (ProjectDiscovery)
GreyNoise Live Tracking of SSHole Exploitation (Steve YARA Synapse Miller)

One mid-October run reproduced 1,724 kernel bugs and produced working LPE exploits and patches for 948 of them, at about $1,279 per exploit. The model behind it, GPT-6 Cyber, launched the next day and also found 81 novel Firefox renderer RCEs.

+1 more on this storyOpenAI Introduces GPT-6 Cyber (Dave Kennedy)

GTIG says Android OEM Videostrong built the backdoor on purpose and sold access to criminal affiliates, whose modules ran ad fraud, residential proxies and follow-on malware.

+2 more on this storyGoogle disrupts million-device XCPE Android malware botnet, bans TV box maker (Nicolas Krassas)
Krebs: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies

Upgrading GitLab did not fix the bug, because the fix ships as a Ruby patch that only official GitLab packages apply. Alpine found no tampering with aports, packages or the October 21 releases, but treated the instance as compromised.

SentinelLABS lays out the timeline and mechanics of the attacks on supermarket and blood bank cold storage. Russian-aligned groups have relevant history, but the evidence does not yet support attribution, and the FBI has issued its own advisory.

+3 more on this storyCyberattack disrupts blood storage refrigeration systems in France (BleepingComputer)
FBI Advisory on Attacks Against Refrigeration Systems (SwitHak ())
Infrawatch: Is Your Fridge a Residential Proxy? (Lloyd Davies)

TraderTraitor approached a Binance engineer through a real job platform in September and got malware installed during a fake interview, which opened the path to wallet infrastructure. Security Alliance profiles the group’s playbook.

+1 more on this storySecurity Alliance: TraderTraitor vs Contagious Interview (AndrewMohawk⁽ⁿᵘˡˡ⁾)

CVE-2026-109518 sits in APT’s resumed HTTP downloads, which can merge two different downloads after verification. Retries are on by default from Debian 12 and Ubuntu 22.04, and Max Justicz found it in two hours of AI-assisted review.

+1 more on this storyI used an AI for two hours and found a zero-day that would let a nation-state hack any server running stock Ubuntu (rpw)

Sekoia tracks a campaign that hijacked a web analytics script on legitimate sites to push n-day exploits to iOS and Android visitors.

+2 more on this storyHackers use n-day exploits in zero-click attacks on iOS, Android devices (BleepingComputer)
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits (Nicolas Krassas)

WorkOS first blamed an attacker running the ARTEX framework. A researcher then came forward and said the agent escaped its test environment and hit WorkOS by accident.

+1 more on this storyWorkOS says attacker used ARTEX AI to breach internal sales app (BleepingComputer)

A crafted RSC Flight payload carrying typed arrays reaches code execution in react-server-dom-webpack, turbopack and parcel. Upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1, or Next.js 16.4.1.

More this week (24)

Techniques and Write-ups

watchTowr chains CVE-2026-116606 and CVE-2026-111560 into unauthenticated root on the email gateway that UNC4841 hit as a zero-day in 2023.

+1 more on this storyBarracuda warns of critical flaws allowing root access to devices (BleepingComputer)

Without CHAP, guessing the right initiator IQN lets you mount a shared virtual disk and read it past NTFS permissions. Garrett Foster points to SPNs shared with Hyper-V, failover clusters and DFS as places to look.

+1 more on this storyludus.domain in the screenshot means you know it's going to be a good post (Bad Sector Labs)

Alexander Popov found, fixed and exploited a race condition born from a logic bug in network device management, using struct device as the attack surface.

Placing an encoded SAMLResponse ahead of the signed one hijacks another user’s broker login with no Keycloak account, given a redirect-signing SAML broker. A second bug lets a help-desk admin grant itself manage-realm through a pre-built composite role.

A heap overflow in the HTTP header parser plus a stdin FILE structure hijack gives unauthenticated code execution on the box that manages everything else out of band.

Coinspect breaks isolation when snapshots restore with the File memory backend and balloon or virtio-mem devices (CVE-2026-122192, fixed in 1.16.2). pwn.ai separately reached root on the host by hijacking a vCPU thread from inside the guest.

+1 more on this storyFirecracker VM Escape: PwnEscape Part 2. (Nicolas Krassas)

Image upload and document conversion features hand attacker files to Ghostscript, and Liondawn Labs turns this bug into RCE across several applications. The post closes with defensive guidance.

+1 more on this storyAuthor Thread on the Liondawn Labs Ghostscript Exploit (SinSinology)

A race between update steps exposes setup-config.php long enough to reach code execution. Xint warns that the first update to the fixed 7.1.4 release is itself an attack window, and CISA has added CVE-2026-119977 to KEV.

+1 more on this storyCISA flags WordPress RCE flaw as actively exploited in attacks (BleepingComputer)

NetSPI’s Thomas Elling turns Microsoft Graph change notification subscriptions into a persistence and data exfiltration channel for cloud engagements.

Shubham Shah and Sam Curry chained a ForgeRock path confusion into RCE on the login servers, then minted sessions to locate, unlock and start customers’ cars. Shubs also published a companion post on unlocking one brand’s cars in most of the world.

+1 more on this storyunlocking any car from X brand in most of the world (Nicolas Krassas)
More this week (34)

Tools and Exploits

The PR adds MS-RPRN opnum 88 and an example script to coerce HTTP authentication from Windows hosts for relay. It was inspired by sudonoodle’s IPP coercion BOF, which forces machine-account HTTP auth through the WSD port monitor.

+1 more on this storyBOF-coerce-ipp: Coerce Machine HTTP Auth Through IPP (Panos Gkatziroulis)

The October update killed Switcheroo’s stacked-bind trick, and keyeroo still relays a coerced victim to LDAP on a fully patched DC that requires signing. RelayInformer gained a check that tells you whether a DC is exposed without relaying anything.

+1 more on this storyRelayInformer Adds an LDAP Signing Bypass Check (stuk0v)

Adds redesigned CET and CFG compatible stack spoofing, a new C-VM interpreter, bind TCP badgers and EDR compatibility updates.

tprtdll.dll exports equivalents of some ntdll functions at separate addresses, so calls through it skip hooks placed only on ntdll.

dobin’s .NET tool captures, records, replays and analyzes Defender AV and EDR ETW events in real time. A companion post walks through the Antimalware Engine event set.

+1 more on this storyMicrosoft-Antimalware-Engine ETW events (Panos Gkatziroulis)

runZero’s Lights Out research covers OpenBMC, iDRAC, iLO, XCC2, Supermicro and others, and many of the issues still have no patch. OOBscan now detects all of them.

Raphaël Huon of Advens builds on DavRelayUp for a local privilege escalation that works on default Windows 10 and 11 domain-joined workstations.

Quentin Texier’s Rust shell runs RBCD, shadow credentials, DCSync, password resets and object reads over LDAP(S) or the ADWS SOAP port every DC exposes on 9389. RustHound-CE 2.5.40 now collects over ADWS too.

+1 more on this storyRustHound-CE 2.5.40 Adds ADWS Collection (n00py)

Winding down in the Apple Security Bounty program, dawgyg published PoCs for real CVEs alongside the fuzzers that found them.

Any user can open the G HUB virtual HID driver and inject keystrokes as SYSTEM, which the author turns into a UAC bypass. Logitech rated it informative, so there is no fix.

More this week (9)