CISA Adds SonicWall SonicOS CVE-2026-19868 to Known Exploited Vulnerabilities Catalog

SSHole OpenSSH Flaw Actively Exploited in Wild Attacks on musl-Based Linux Systems

Hackers began exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH just hours after a proof-of-concept exploit was published on November 5, 2026. The flaw affects certain musl-based Linux distributions, including Alpine Linux, allowing attackers to bypass authentication on accounts whose password hash is set to an asterisk in /etc/shadow. Multiple security firms including GreyNoise, Defused, Previdian, and watchTower have confirmed successful exploitation attempts involving reconnaissance, credential theft, and persistence mechanisms. GreyNoise recorded the first confirmed in-the-wild success on November 7 at 00:46 UTC, with 16 exploitation chains from six IP addresses that included queries to cloud metadata services and installation of the TAC Agent implant. OpenSSH maintainers released version 10.6p2 on November 5 to address the issue, while researchers recommend disabling password authentication and checking for unauthorized SSH keys or TAC Agent services on affected systems.

Plex2Shell Vulnerability Chain Exploited Against QNAP NAS Users Running Plex Media Server

Threat actors have begun actively exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server, to compromise installations on QNAP NAS devices. The flaws, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, were patched earlier this summer, yet widespread exploitation started in mid-October following the publication of technical details and proof-of-concept code. Successful attacks require no valid credentials and grant attackers arbitrary code execution with the privileges of the Plex service. QNAP has confirmed that only the Plex Media Server application is affected, while its QTS and QuTS hero operating systems remain untouched. The company urges users to update to version 1.43.3 or later immediately, rotate passwords, and consider devices exposed to the internet as potentially compromised. QNAP has also published a detailed remediation guide recommending VPN usage instead of direct port forwarding for remote access.

Default 'admin:admin' Credentials in ForgeRock Servers Allow Researchers to Remotely Unlock and Start Vehicles from Two Automakers

Security researchers Shubham Shah and Sam Curry discovered that two unnamed automakers relied on ForgeRock identity platform instances with an exposed Apache Felix administrator console protected only by the default 'admin:admin' credentials. By bypassing edge protections through specially crafted URLs containing encoded slashes, the researchers gained full access to customer records stored in OpenIDM and could impersonate any user account. Once authenticated through the mobile apps, they obtained valid access tokens that enabled them to unlock doors and start engines on connected vehicles in the United States, Canada, and Australia. The researchers limited full vehicle testing to their own cars and vehicles belonging to consenting owners, reporting the issues in February 2026; both affected systems were patched within approximately two hours. A separate attack path in Australia involved hardcoded administrator credentials left in the application code from a test environment. The incidents highlight persistent misconfigurations in identity management deployments rather than novel product vulnerabilities, with no CVE assigned. The researchers have previously disclosed similar remote vehicle access issues affecting Honda, Kia, and Subaru.