The Hot Drop for 11-06-2026

A decade-old authentication bypass in OpenSSH, dubbed SSHole and tracked as CVE-2026-123158, allows remote attackers to log into accounts that should never accept a password. The flaw affects OpenSSH servers on Linux systems built with the musl C library where PAM is disabled and password authentication is enabled, specifically impacting Alpine Linux, OpenWrt, Buildroot, and Yocto. Alpine Linux is particularly relevant given its default non-PAM OpenSSH configuration. Accounts configured to reject password logins, such as root or key-only users, store an asterisk in their password field, a state the system misinterprets when processing an unusually long password as a valid hash.

This misinterpretation allows remote attackers to log into accounts that should have password authentication disabled, potentially leading to root-level access. The OpenSSH team shipped version 10.6p2 on November 5, 2026, to block the vulnerability. Threat intelligence firm Previdian has warned that the flaw is being exploited, with its sensors observing 8 exploitation attempts targeting CVE-2026-123158. Previdian confirmed successful root access on a honeypot running real Alpine Linux and OpenSSH, where the observed source IP used oversized passwords to bypass authentication and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions.

As of November 6, 2026, confirmed exploitation of SSHole has not been established.

CVE-2026-123158 is an unauthenticated vulnerability affecting OpenSSH versions before 10.6p2. Dubbed SSHole, the flaw specifically impacts the OpenSSH server on Linux distributions that use the musl libc implementation with the Pluggable Authentication Module (PAM) disabled. Alpine Linux, OpenWrt, Buildroot, and Yocto are identified as affected platforms, with Alpine Linux particularly relevant due to its default non-PAM OpenSSH configuration. Official Alpine cloud images from version 3.18.11 through 3.24.3 include an alpine account with a disabled password and passwordless doas privileges.

The vulnerability allows remote attackers to bypass authentication and log into accounts that should have password authentication disabled.

Now

• IT and patching: IT and patching teams should immediately apply the OpenSSH patches and restart the sshd daemon to replace the running instance. If immediate patching is not possible, IT and patching teams should disable password-based authentication and restart the sshd daemon.

Next

• Security operations: Security operations teams should verify that OpenSSH is updated to version 10.6p2 on systems built with musl libc without PAM. Security operations teams should configure key-based authentication for systems where password authentication must remain disabled.

Seven outlets, including Help Net Security, Previdian, SecurityWeek, GBHackers, CSO Online, OX Security, and Safe Security, are reporting on the OpenSSH authentication bypass. Threat intelligence firm Previdian attributes the claim that the flaw is being exploited in the wild to its observation of eight exploitation attempts. The firm reportedly confirmed successful root access on a honeypot running real Alpine Linux and OpenSSH. Safe Security states that confirmed in-the-wild exploitation of the vulnerability has not been established as of November 6, 2026.

GBHackers reports that no exploitation of the flaw has been reported in the wild so far. SOCRadar is attributed with listing the affected tiny-cloud images as versions 3.18.11 through 3.24.3. Alpine Linux warns that an attacker needs the name of an account with a disabled password and a machine with at least one other account using a specific password hash format. Alpine Linux notes that an attacker who can reach the SSH port can log in without knowing any password, and that the attack works every time with no retries.

OX Security reports that on affected Alpine cloud images, successful authentication to a default user with passwordless doas privileges can possibly allow an attacker to escalate to root. No confirmed disagreements between outlets were identified. No timeline updates were identified.

Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to its systems on October 30, 2026. The company described the intrusion as an on-path attack, a type of interception method also known as a Man-in-the-Middle attack. Chainalysis confirmed that attackers accessed usernames, password hashes, and live tokens for all customers during the incident. Microsoft attributed the use of an agentic AI offensive framework to threat actors searching public GitHub repositories for exposed secrets.

Sign-in events associated with the campaign originated from two specific IP addresses. An IP address linked to a domain hosted an Artex landing page in mid-October 2026.

Usernames and password hashes for all customers were exposed in an on-path attack, also known as a Man-in-the-Middle or MITM attack. Binance reported that North Korean hackers stole roughly $6.34 billion worth of cryptocurrency after compromising its wallet infrastructure.

Now

• Security operations: Security operations should block the IP address 23.106.46[.]239 at the network perimeter, which has been flagged by Zeabur as an indicator of compromise.

Next

• Security operations: Security operations should investigate public GitHub repositories for exposed secrets, as threat actors reportedly use agentic AI frameworks to target such data.

Three distinct outlets are reporting on the Chainalysis intrusion, with The Register providing the initial disclosure and The Hacker News and BleepingComputer corroborating the findings. BleepingComputer reported on 2026-11-06 that Chainalysis initially stated the impact was limited to non-sensitive identity metadata, but later updates revealed that usernames and password hashes for all customers were exposed. The Register reported on 2026-11-05 that Chainalysis referred to the intrusion as an on-path attack, a term it used without elaborating further on the specific technical details. The Hacker News reported on 2026-11-06 that Microsoft attributed the use of an agentic AI offensive framework to threat actors, a detail that connects the incident to broader trends in automated threat activity.

No confirmed disagreements between outlets were identified. No timeline updates were identified. No fix or workaround has been published yet in current sources.

Barracuda Email Security Gateway versions earlier than 9.4.0.030 contain an authentication bypass flaw identified as CVE-2026-116606. The vulnerability allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted backup archive, resulting in unauthorized modification of the appliance's global configuration. The flaw is classified as an authentication bypass using an alternate path or channel, a weakness that permits attackers to circumvent standard login requirements. The vulnerability is assigned a CVSS score of 9.3, indicating a critical severity rating.

According to WatchTowr Labs, the backup file checksum mechanism relies on the MD5 algorithm combined with a hardcoded secret string. WatchTowr Labs reported on 2026-11-05 that the secret used in the checksum calculation is the static text 'Barracuda Networks is your new best friend'. The same report notes that a separate OS Command Injection vulnerability, CVE-2026-111560, affects multiple Barracuda products including the Email Security Gateway.

Barracuda Email Security Gateway versions earlier than 9.4.0.030 are affected by the vulnerability, which allows an unauthenticated remote attacker to bypass authentication, as stated in the evidence. The flaw carries a CVSS score of 9.3. A separate OS Command Injection vulnerability, CVE-2026-111560, also affects multiple Barracuda products including the Email Security Gateway. That second vulnerability has a CVSS score of 8.6.

Now

• IT and patching: IT and patching teams should immediately update Barracuda Email Security Gateway appliances to version 9.4.0.030 to resolve the authentication bypass vulnerability.

Next

• Security operations: Security operations teams should deploy the available detection artifact generator to identify systems vulnerable to CVE-2026-116606 and CVE-2026-111560.

Two distinct outlets are reporting on the vulnerability: Mandiant's disclosure on GitHub and WatchTowr Labs' analysis. The classification of the flaw as an authentication bypass using an alternate path or channel is stated in the Mandiant disclosure. The specific affected version range, earlier than 9.4.0.030, is detailed in the Mandiant disclosure. The assignment of CVE-2026-116606 to the vulnerability is confirmed in the Mandiant disclosure.

The Mandiant disclosure also classifies the attack pattern as CAPEC-115: Authentication Bypass. The mechanism allowing an unauthenticated attacker to invoke a configuration-import function is described in the Mandiant disclosure. WatchTowr Labs reported on 2026-11-05 that the backup file checksum uses MD5 with a hardcoded secret string. WatchTowr Labs reported on 2026-11-05 that the vulnerability is a Pre-Authentication Authorization Bypass with a CVSS score of 9.3.

The Mandiant disclosure describes a tool as a Detection Artifact Generator for the authentication bypass to command injection. The Mandiant disclosure states that the tool attempts to check if the target is vulnerable to CVE-2026-116606 and CVE-2026-11156. The CVE record lists Barracuda Email Security Gateway versions before 9.4.0.030 as affected, with version 9.4.0.030 carrying the fix. No confirmed disagreements between outlets were identified.

No timeline updates were identified. Nothing in current sources says whether it is being exploited or who is behind it.

AI agents compromised targets by exploiting hardcoded admin passwords, missing API authentication, command-injection, SSTI remote code execution, IDOR flaws, and weak credentials.

An operator targeted 10 certificate signing shops between October 14 and October 29. The AI agents stole more than 190,000 gaming credentials and over 300 Apple code-signing certificates. Only three of the stolen Apple code-signing certificates still worked. Researchers at Check Point found 2,557 systems that host or once hosted ARTEX panels.

Of those systems, 1,608 were live and open to the internet.

No fix, workaround or detection guidance has been published yet in current sources.

Two outlets are reporting this story, with gbhackers.com providing the initial account and cybersecuritynews.com corroborating the details. The specific count of 2,557 systems hosting ARTEX panels is reported only by cybersecuritynews.com, citing Check Point researchers. The attribution of the research to Check Point is presented as an attributed claim rather than an independent verification. No confirmed disagreements between outlets were identified.

No timeline updates were identified. No fix or workaround has been published yet in current sources.

Microsoft Threat Intelligence identified NeedyMantis as a modular post-compromise malware framework used in targeted intrusions.

No details yet about who is affected from current sources.

No fix, workaround or detection guidance has been published yet in current sources.

Microsoft reported this finding in its Q3 2026 email threat landscape report. No confirmed disagreements between outlets were identified. No timeline updates were identified. Who is affected is not yet known from current sources.

No fix or workaround has been published yet in current sources. Nothing in current sources says whether it is being exploited or who is behind it.

Microsoft disclosed a remote code execution vulnerability in Windows Paint on 2026-10-13. The flaw, identified as CVE-2026-83844, allows an unauthorized attacker to execute code on a target system over a network. Microsoft rates the vulnerability as Important with a CVSS 3.1 base score of 8.1. The attack complexity is high because a successful exploit depends on conditions beyond the attacker's control.

No privileges are required for an attacker to exploit the vulnerability. An unauthenticated attacker could exploit the flaw by sending a specially crafted packet to an affected service over the network. The packet triggers an out-of-bounds read in Windows Paint, which allows the attacker to execute code on the target system. Microsoft's advisory lists Paint version 11.2609.401.0 as the fixed release, suggesting an earlier reference to version 11.2605.91.0 may have been incorrect.

Microsoft marks the exploit maturity as Unproven and the report confidence as Confirmed.

Windows Paint is affected by a remote code execution vulnerability identified as CVE-2026-83844. The flaw is an out-of-bounds read that allows an unauthorized attacker to execute code over a network.

No fix, workaround or detection guidance has been published yet in current sources.

• Based on MITRE ATT&CK guidance for Exploitation for Client Execution (T1203): Security operations teams should monitor for unexpected child processes spawned by client applications, such as PowerShell or command-line tools, following application crashes or abnormal exits.

Three distinct outlets are reporting on the vulnerability, with Microsoft's official security guide providing the primary technical details. All three sources consistently report the disclosure date as 2026-10-13. Microsoft's advisory describes the exploitation method as a crafted network packet, while cybersecuritynews.com noted a potential discrepancy regarding whether a crafted image or packet triggers the flaw. cybersecuritynews.com reported that Microsoft initially listed Paint version 11.2605.91.0 as the fixed release, a detail not present in the other sources.

gbhackers.com reported that Microsoft's current advisory lists Paint build 11.2609.401.0 as the security update, which cybersecuritynews.com suggested may have corrected the earlier version reference. The sources use hedging language such as "could" when describing the potential for an unauthenticated attacker to execute code, reflecting the possibility rather than a confirmed active exploit. No confirmed disagreements between outlets were identified. No timeline updates were identified.

No fix or workaround has been published yet in current sources.