Lenovo ThinkPlus FU100 USB Drive Stores Data on Unencrypted SD Card Despite AES-256 and Fingerprint Claims

Attackers Exploit OpenSSH 'SSHole' Flaw on musl Systems to Deploy Botnets and Cryptominers

Cybersecurity firms have reported active exploitation of a vulnerability in OpenSSH affecting systems that use the musl library, including Alpine Linux, OpenWRT, Buildroot, and Yocto. The flaw, nicknamed 'SSHole', allows attackers to bypass authentication on accounts configured with no password by supplying a password longer than 256 characters. The issue occurs when OpenSSH runs on musl without PAM, with password authentication enabled and specific account configurations present. OpenSSH 10.6p2 was released on November 5, 2026, with a mitigation after the vulnerability was disclosed on November 4. Initial attacks began within nine hours of the patch release, with observed activity limited to botnet recruitment and cryptominer installation. The Dutch NCSC recommends restricting SSH exposure and disabling password authentication where possible.

Broadcom Wi-Fi Chip Flaw Allows RCE via WPS, Unpatched for 16 Years and Affecting Millions of Devices

Security researcher Quentin Kaiser disclosed a critical buffer overflow vulnerability in Broadcom's proprietary Wi-Fi Protected Setup (WPS) implementation during Hexacon 2026 in Paris. The flaw, present in Broadcom firmware since around 2010, enables attackers within Wi-Fi range to read the PSK directly from memory or achieve root-level remote code execution without authentication or completing the WPS pairing process. Kaiser demonstrated working proof-of-concept exploits on routers from Orange Belgium and Proximus, including the ASKEY TCG3000 and Sagemcom F@st BBOX3V+. Although a partial fix appeared in 2018, it did not cover all code paths, and no patches were issued for older eCos-based chips, leaving the issue as a permanent "forever day" vulnerability. Broadcom, acting as its own CNA, refused to assign a CVE identifier, and a CERT report was closed the same day it was filed.

WordPress Vulnerability Exploited in Over 240,000 Attacks During Core Updates

Attackers are actively exploiting a flaw in WordPress that appears during full-package core updates, allowing them to gain administrator access by completing an installation from a publicly accessible directory. Cybersecurity firm Wordfence has recorded more than 240,000 attack attempts within days of the issue becoming public. The vulnerability, tracked as CVE-2026-119977, was patched on 28 October 2026, yet exploitation began almost immediately and has continued to rise. During the update process, new files including the WordPress installer are extracted to a predictable, internet-accessible location, enabling attackers to finish the installation and create admin accounts. Sites running the latest version, WordPress 7.1.4, are protected, while additional server-level restrictions on PHP execution in the upgrade directory provide further mitigation. The Dutch NCSC has issued a separate advisory confirming active exploitation and warning of potential data theft and website takeover.