Search: CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

This report summarizes multiple cyber threats and vulnerabilities discovered in early November 2026, including ransomware attacks, supply-chain compromises, AI-powered exploitation frameworks, and several high-severity software vulnerabilities. Notable incidents include a ransomware attack on Queens Public Library, a destructive attack on Russian web hosting provider Beget, and a supply-chain attack on the Linux security tool cPGuard. AI-assisted threat actors targeted financial and cryptocurrency sectors, while multiple critical vulnerabilities were patched in SonicWall, Android, Barracuda Email Security Gateway, and OpenSSH. Some vulnerabilities have been linked to active exploitation.