A high-severity authentication bypass vulnerability (CVE-2026-123158) affects OpenSSH servers on Linux distributions using musl libc without PAM enabled. The flaw allows attackers to log in to certain accounts by supplying any password between 257 and 1024 characters. This impacts accounts with a password field set to "*" (no password) and requires the presence of at least one local account with a SHA-256 or SHA-512 hashed password. The vulnerability is present in Alpine Linux releases 3.16 through 3.24 and edge, among others. OpenSSH 10.6p2 includes patches to fix this issue. Immediate patching or disabling password authentication is recommended to mitigate risk.
OpenAI research using an unreleased AI model discovered and exploited 948 distinct Linux kernel privilege escalation vulnerabilities in the kernel's master branch, generating working exploits and patches. The research demonstrated that unpatched Linux systems with low-privileged user access can be escalated to root by well-resourced attackers. OpenAI has submitted hundreds of patches and is working with the community to remediate these flaws. The company warns that outdated Linux systems should be considered effectively compromised if accessed by low-privileged users. Mitigations include applying patches promptly and using sandboxing and isolation technologies.
A vulnerability (CVE-2026-98432) in the Linux kernel IPv4 TCP stack can cause a kernel panic or container escape, allowing root code execution on the node. It can be triggered locally by an unprivileged process in a container without special capabilities or remotely by a network attacker sending crafted TCP packets with IPv4 options to a TCP listener on nodes, Pods, or the cluster control plane. Clusters that restrict TCP listener access to trusted sources are not exposed to network attacks. The vulnerability affects GKE Standard and Autopilot clusters running Container-Optimized OS versions prior to specified patched releases. Patch versions are available for multiple GKE minor versions, with patches for GKE 1.37 and Ubuntu node images in progress.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, allow unauthenticated remote code execution on affected servers. Emergency patches were released on October 21, 2026, for PHP versions 7.4, 8.0, 8.1, and supported 8.2–8.5 branches. Despite patches, millions of servers remain vulnerable. Exploitation attempts began shortly before patches were public, with confirmed real-world attacks including compromises of Palo Alto Networks devices. A third related vulnerability in Brotli (CVE-2026-111497) was patched later. Another unpatched PHP vulnerability (CVE-2026-115560) requires unusual configurations and is scheduled for a regular fix. Mitigation requires patching and auditing systems for compromise signs. Detection tools and updated security solutions can help identify exploitation attempts.
A critical vulnerability in Node-RED, tracked as CVE-2026-58115, allows unauthenticated remote attackers to execute arbitrary code with maximum privileges via the HTTP interface. Exploits have been observed in the wild, deploying Linux bots and persistent webshells from a single IP address. Siemens patched this flaw in SIMATIC IoT2050 Advanced devices starting with version 4.3.4.1. Attackers scan for Node-RED instances without authentication and exploit them automatically with a single HTTP request.
This analysis from Microsoft Security Research examines the characteristics of software vulnerabilities that have been exploited in real-world attacks. Out of approximately 383,000 disclosed vulnerabilities through September 2026, only about 2,000 (0.5%) have been linked to actual exploitation. Exploited vulnerabilities disproportionately enable system takeover, such as remote code execution (RCE), privilege escalation, and authentication bypass. The study classifies vulnerabilities by impact and platform, highlighting that exploitation is concentrated in vulnerabilities that provide attackers with significant control. Patching remains critical but is often slow, necessitating focused defensive efforts on high-impact vulnerabilities.
Critical9.2KEVEPSS 82%Check Point ResearchCVE-2026-111497
This report summarizes multiple significant cyber threats and incidents disclosed in early November 2026. Major breaches include a $6.3 billion cryptocurrency theft from Binance via compromised internal infrastructure, a malicious JavaScript attack on Polymarket's platform, and data breaches affecting Japan Airlines and the Florida Department of Education. The report also highlights the use of AI by threat actors such as the GOLD OGRE ransomware group and North Korean cyber operators to enhance attack capabilities. Several critical vulnerabilities are noted, including CVE-2026-111497 (HTTP2Shell) affecting Brotli decompression, a critical Linux kernel TCP networking flaw (CVE-2026-98432), and a Drupal Commerce Core access control vulnerability (CVE-2026-118539). Cisco patched a high-severity SSL VPN crash vulnerability (CVE-2026-76418) that was exploited in the wild. Additional threat intelligence includes malware campaigns and advanced persistent threat activity targeting various sectors globally.
CVE-2026-97229 is a critical code execution vulnerability in GitLab caused by insufficient validation in Ruby's Onigmo regular expression engine. It allows unauthenticated attackers to execute arbitrary code on the GitLab server via crafted CI/CD configurations. The vulnerability was exploited in an attempted attack against Alpine Linux's GitLab instance, which failed but prompted a full rebuild and password resets. The flaw is rooted in Ruby, not GitLab itself, requiring updates to Ruby versions 3.3.13, 3.4.12, 4.0.9 or later for full remediation. The US CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging rapid patching.
php2shell comprises two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. Exploitation requires tailoring the attack to the specific PHP environment, making widespread mass exploitation difficult. However, network appliances running identical builds are vulnerable to a single calibrated exploit. Exploitation has been confirmed in the wild, including attacks on PAN-OS firewall management servers. Patching is available and strongly recommended, especially for internet-facing management interfaces and end-of-life PHP versions.
The Aurora ransomware group has been active since April 2026, targeting multiple organizations globally with a Linux ransomware variant tailored for ESXi environments. This ransomware uses ChaCha20 encryption combined with RSA-4096 key wrapping. A notable feature of their operations is the abuse of Cursor Agent alongside Claude Sonnet AI to assist in exploitation activities such as privilege enumeration, network scanning, NTLM relay attacks, and certificate attacks. The group imposes operational restrictions to avoid detection and disruption, including prohibiting DCSync, account lockouts, and adding new computer objects to domains. A separate cluster of Aurora activity involves SQL Server lateral movement, GodPotato escalation, and S3-based data exfiltration. The threat affects organizations in multiple countries including the United States, Argentina, Austria, Germany, Israel, and Spain.
NIK C2 is a newly observed AI-enabled command-and-control (C2) framework targeting Windows systems. It features a Go-based implant that provides persistent remote access with capabilities including credential dumping, keystroke streaming, RDP session hijacking, process hollowing, and deployment of screen-locking ransomware demanding cryptocurrency payments. The implant uniquely integrates the OpenAI Chat Completions API, allowing threat actors to analyze harvested data using AI in real time within the compromised session. This integration collapses traditional offline data processing delays, complicating detection and response efforts. The implant communicates over encrypted channels with resilient fallback mechanisms and has been observed in multiple evolving versions compiled no earlier than late 2024. Active infrastructure associated with NIK C2 has been identified in the wild, confirming its operational status.
A local privilege escalation vulnerability exists in the Linux Kernel related to the IPv6 AH Routing Header. Exploitation requires the attacker to have the ability to execute low-privileged code on the target system. The vulnerability is assigned CVE-2026-80844 and has a high severity rating.
A local privilege escalation vulnerability exists in the Linux Kernel's handling of the Logitech HIDPP protocol. Exploitation requires the attacker to already have the ability to execute low-privileged code on the system. The vulnerability is identified as CVE-2026-93826 and has a high severity rating assigned by ZDI.
A use-after-free vulnerability in the Linux Kernel CIFS file system allows local attackers with high-privileged code execution capabilities to escalate privileges. The vulnerability is assigned CVE-2026-72315 and has a high severity rating of 7.2 by ZDI.
A use-after-free vulnerability in the Linux Kernel XFRM subsystem allows local attackers with low-privileged code execution to escalate privileges. The vulnerability is assigned CVE-2026-98231 and has a high severity rating of 7.8 by ZDI. Exploitation requires prior local code execution capability.
A critical vulnerability (CVE-2024-6387) in OpenSSH allows remote unauthenticated attackers to execute arbitrary code as root on affected machines. This affects Compute Engine VMs running glibc-based Linux distributions with OpenSSH exposed, as well as Google TPU and Container-Optimized OS versions. The vulnerability can be mitigated by applying patches from Linux distributions or Google-provided updated OS images. Runtime mitigation is also available by setting LoginGraceTime to 0 in sshd_config and restarting the sshd service. Additionally, restricting SSH access via firewall rules to trusted networks or disabling SSH until patched reduces exposure.
A vulnerability has been identified in the RDSEED instruction on AMD Zen 5 (Turin) processors. The 16- and 32-bit versions of the RDSEED instruction can silently fail under certain system load conditions, potentially compromising applications that rely on these instructions for cryptographic random number generation. The 64-bit version of RDSEED is not affected and remains safe. AMD is currently investigating this issue. The 64-bit Linux kernel uses the safe 64-bit RDSEED instruction for /dev/[u]random, so those random numbers are not impacted. Applications that synthesize random numbers using the 16- or 32-bit RDSEED instructions should be aware of this insecurity.
A vulnerability identified as CVE-2026-23268, known as CrackArmor, exists in the Linux kernel's AppArmor component on Container-Optimized OS (COS) nodes. This flaw allows unprivileged users to bypass kernel protections, escalate privileges to root, and break local container isolation. The vulnerability is rated high severity. Google recommends upgrading COS nodes to version cos-125-19216-220-57, which contains the fix. For managed services using COS, users should follow the respective upgrade instructions. Fixes for earlier COS milestones 117 and 121 are in progress.
