Weekly Cybersecurity Recap: OpenSSH SSHole Exploitation, Debian APT Root RCE, Zyxel Zero-Day, and AI-Driven Attacks

SSHole OpenSSH Flaw Actively Exploited in Wild Attacks on musl-Based Linux Systems

Hackers began exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH just hours after a proof-of-concept exploit was published on November 5, 2026. The flaw affects certain musl-based Linux distributions, including Alpine Linux, allowing attackers to bypass authentication on accounts whose password hash is set to an asterisk in /etc/shadow. Multiple security firms including GreyNoise, Defused, Previdian, and watchTower have confirmed successful exploitation attempts involving reconnaissance, credential theft, and persistence mechanisms. GreyNoise recorded the first confirmed in-the-wild success on November 7 at 00:46 UTC, with 16 exploitation chains from six IP addresses that included queries to cloud metadata services and installation of the TAC Agent implant. OpenSSH maintainers released version 10.6p2 on November 5 to address the issue, while researchers recommend disabling password authentication and checking for unauthorized SSH keys or TAC Agent services on affected systems.

Plex2Shell Vulnerability Chain Exploited Against QNAP NAS Users Running Plex Media Server

Threat actors have begun actively exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server, to compromise installations on QNAP NAS devices. The flaws, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, were patched earlier this summer, yet widespread exploitation started in mid-October following the publication of technical details and proof-of-concept code. Successful attacks require no valid credentials and grant attackers arbitrary code execution with the privileges of the Plex service. QNAP has confirmed that only the Plex Media Server application is affected, while its QTS and QuTS hero operating systems remain untouched. The company urges users to update to version 1.43.3 or later immediately, rotate passwords, and consider devices exposed to the internet as potentially compromised. QNAP has also published a detailed remediation guide recommending VPN usage instead of direct port forwarding for remote access.

CISA Adds SonicWall SonicOS CVE-2026-19868 to Known Exploited Vulnerabilities Catalog

CISA has added one new entry to its Known Exploited Vulnerabilities Catalog after confirming active exploitation in the wild. The vulnerability, tracked as CVE-2026-19868, affects SonicWall SonicOS SSLVPN and stems from the use of single-factor authentication. This flaw allows attackers to bypass stronger authentication controls and gain unauthorized access to VPN services. The addition triggers mandatory remediation timelines for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. CISA emphasizes that the vulnerability poses significant risks because successful exploitation can grant attackers full control over affected assets. Organizations outside the federal sector are strongly encouraged to adopt the same risk-based prioritization approach.