OpenSSH SSHole exploited as GPT-6 Cyber flags 2,308 Linux kernel flaws

SSHole OpenSSH flaw exploited in the wild within 40 hours of fix

Hackers are actively exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH to run commands, steal credentials and establish persistence. Attempts began on November 5, the day a proof-of-concept appeared, with successful exploitation the next day. The flaw, disclosed by researcher Ozgun Kultekin, bypasses authentication on certain musl-based Linux systems such as Alpine by making an oversized password hash to an asterisk, which OpenSSH treats as a match for accounts whose stored hash is *. OpenSSH fixed it in version 10.6p2 on November 5. GreyNoise recorded first successful in-the-wild exploitation on November 7 at 00:46 UTC, about 40 hours after the fix, logging 16 successful chains from six IPs. Attackers ran reconnaissance, queried cloud metadata, read password hashes and SSH keys, and modified authorized_keys; one gained root and installed the TAC Agent implant.

Hackers exploit SSHole OpenSSH flaw to breach Linux systems →

Topics: Zero-day vulnerabilities

QNAP urges Plex Media Server updates as Plex2Shell attacks widen

QNAP issued a security advisory urging NAS users to install the latest Plex Media Server, warning that older versions are being actively and widely exploited via the Plex2Shell vulnerability chain. Plex disclosed in November 2026 that it fixed four flaws affecting Media Server versions 1.43.2 and older: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Chained together, they let unauthenticated attackers execute arbitrary code remotely with the highest privileges, enabling NAS takeover and theft of sensitive content. Plex released a fix in September 2026, and a proof-of-concept followed weeks later. Multiple security firms report abuse, mostly to install proxy software and cryptocurrency miners. CISA added all four bugs to its Known Exploited Vulnerabilities catalog on October 20. Plex addressed them in version 1.43.3; QTS and QuTS were not affected.

QNAP says more NAS devices hit in worrying Plex2Shell malware attacks →

Topics: Zero-day vulnerabilities

OpenAI’s GPT-6 Cyber finds 2,308 potential Linux kernel vulnerabilities

OpenAI unveiled GPT-6 Cyber on 5 November, a security-focused model it says marks a major leap in security research and outperforms GPT-5.6 Cyber, with a 51% relative improvement on ExploitGym. In Linux kernel testing, GPT-6 Cyber flagged 2,308 potential flaws and reproduced 1,726 vulnerabilities. It helped develop local privilege escalation exploits for 948 vulnerabilities, which could let an unprivileged user gain root access. The model also uncovered 81 high-severity vulnerabilities in Firefox and helped create patches that Mozilla has since applied. OpenAI said the model is already helping secure real-world software and has been used to uncover thousands of exploits spanning Linux and Firefox, arguing automated patch generation is essential to limit the exploitation window. Linus Torvalds voiced cautious optimism, noting fixes are now arriving faster than new reports.

OpenAI says its new cyber-focused AI model found thousands of Linux kernel vulnerabilities →

Topics: OpenAIAI-discovered vulnerabilities and AI bug-report slop

APT29 uses n-day iOS and Android exploits in zero-click watering hole attacks

A large-scale watering hole campaign attributed with moderate-to-high confidence to APT29 (Midnight Blizzard) targeted iOS and Android users visiting compromised or lookalike websites, including sites of a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Lookalikes impersonated the America250 site and Raffles London at The OWO hotel. The actor also compromised Ukrainian web analytics service Plerdy, modifying its SEO tracker loaded by thousands of sites between August 27 and September 3. Initial JavaScript profiled visitors, then a command-and-control server pushed matching n-day exploit chains requiring no user interaction. Sekoia found exploits targeting Safari cookies, WhatsApp and Telegram databases, Keychain credentials, photos and Chrome for Android data via AndroSnitch. No payloads established persistence; Apple and Google patched all targeted flaws.

Hackers use n-day exploits in zero-click attacks on iOS, Android devices →

Topics: State-sponsored hackingZero-day vulnerabilities

PHP2Shell use-after-free yields remote code execution on PHP 8.4.26

A use-after-free in PHP’s session handling leaves stale pointers in a long-lived worker process after an out-of-memory bailout. The flaw involves the session.upload_progress feature, which parses multipart form data before the application script runs. When an allocation hits PHP’s memory_limit, zend_bailout() skips cleanup in session.c, leaving pointers dangling; PS(id) is read whenever PHP builds the Set-Cookie header, creating a read primitive. Triggering requires a crafted multipart request that exhausts memory during session processing, followed by a second request on the same worker. The exploit targets PHP 8.4.26 Alpine CLI in four stages, using heap grooming and forged structures to call zif_system. The Steal My Bitcoin CTF, launched by James Pavur on October 24, 2026, tested it against an unpatched server; KillaBoi achieved RCE on October 25, winning a prize that grew to about $2,021.

PHP2Shell →

Topics: Zero-day vulnerabilities