As of November 9, 2026, a total of 20 exploitation attempts have been recorded from 13 unique IP addresses from Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.
CVE-2026-123158 (SSHole): OpenSSH on musl, PAM disabled
A recently disclosed OpenSSH vulnerability tracked as CVE-2026-123158 and codenamed SSHole (or sshole) is being probed in the wild. The flaw "can enable sign-ins to accounts that have no password set" on Linux systems running OpenSSH against the musl C library when Pluggable Authentication Modules (PAM) are disabled. The bulletin notes Alpine Linux’s default OpenSSH server configuration is affected. The 20 recorded attempts come from 13 IP addresses spanning nine countries, indicating distributed opportunistic scanning and exploitation attempts tied to this specific configuration.
CWPdoor: a trojanized cwpsrv that hides its traffic
Researchers at XLab reported a trojanized cwpsrv binary being used to deliver a backdoor dubbed CWPdoor. A shell script named "cwpsrv_update.sh" downloads a malicious "cwpsrv" from 136.0.141[.]71 and replaces the legitimate daemon. XLab said the downloaded cwpsrv "is a passive backdoor that can be triggered by specific headers in HTTP/HTTPS traffic to remotely execute commands specified by the attacker." The backdoor is designed to suppress logging for the triggering request, leaving no trace in access logs — a combination XLab described as making CWPdoor "exceptionally stealthy."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDebian/Ubuntu APT flaw (CVE-2026-109518): network adversary can force unverified package install
Amazon published advisory details for CVE-2026-109518 (CVSS 7.7), a vulnerability in the APT package manager affecting Debian and Ubuntu. Under "specific conditions," when APT is configured to use HTTP package sources with retry settings enabled, a third party "with a network position between the host and the package mirror can cause APT to install a package that did not pass verification." Because maintainer scripts in a package run with elevated privileges, Amazon warned this can lead to code execution as root.
Zyxel GS1900 zero-day (CVE-2026-107441): nearly 1,000 switches compromised
Zyxel fixed a zero-day in its GS1900 series network switches (CVE-2026-107441, CVSS 8.8) after threat actors exploited the out-of-bounds write to compromise roughly 1,000 devices worldwide and steal configuration files and credentials. The vendor said the flaw could be triggered via a crafted HTTP request and has been weaponized by a Chinese-speaking actor tracked as Kapibala (aka Red Heron). The actor reportedly deployed the JITTERLY backdoor and SIXZUT, described as a ring 3 rootkit.
What this means for technologists, regulators, and end users
- Technologists and security teams: prioritize checks for OpenSSH instances compiled against musl with PAM disabled, inspect web-server binaries like cwpsrv for unexpected replacements or update scripts, and review APT configurations that use HTTP mirrors with retry logic enabled — the advisory explicitly ties those settings to the risk of installing unverified packages.
- Regulators and CERTs: the Indian CERT-In disclosure of an AI-assisted actor called Crafty Falcon targeting BFSI organizations underscores a regulatory role in public advisories and coordinated notification when attacker behavior escalates; supply-chain and update-channel compromises (OPSSHIELD/cPGuard, trojanized cwpsrv) illustrate incident types regulators will continue to encounter.
- End users and customers: incidents touching consumer-facing services — mSecure urging password resets and Gnosis Pay detecting unauthorized access to a cards system scheduled for retirement — show that account remediation and mandatory extra verification (Gnosis Pay’s use of 3D Secure) are likely immediate steps following detection.
Wider pattern: exposed services, AI-augmented operators, and update-channel abuse
The week’s incidents fit into several repeating themes. Researchers found 15,579 websites infected with malicious JavaScript delivering skimmers, exploitation kits, and redirects. A Chinese-language exploitation framework called Greeter targeted exposed Flowise AI instances — Era Security counted 4,372 Flowise instances online and found 703 with no authentication — and used a per-request execution model to supply malicious functions. Separately, a mesh of 12 AI agents called BOSSAI was reported to support persistent campaigns, and Bitdefender described a hybrid human-AI 3AM ransomware operation that blended operator actions with an "agentic loop."
Supply-chain and update-channel abuse recurred across multiple incidents: OPSSHIELD’s update infrastructure was abused to push a malicious cPGuard update after attackers used compromised billing-app credentials, and security-themed GitHub projects have been weaponized to deliver backdoors and infostealers to developers. These cases underline how both legacy mistakes (misconfigured services, unsigned package flows) and active manipulation of update paths can yield broad compromise.
Small misconfigurations and supply-chain shortcuts are a common thread: blank or absent passwords, an HTTP APT mirror with retries enabled, an exposed Flowise instance, or an update channel left vulnerable — any of those simple failures can let an attacker turn a minor oversight into system-level control. The incidents this week reinforce that defenders must regard the mundane as dangerous and that incident telemetry — from exploit attempts to parsed backdoor behavior — is the clearest early warning available.
