From English sources

SSHole OpenSSH Flaw Actively Exploited in Wild Attacks on musl-Based Linux Systems

Hackers began exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH just hours after a proof-of-concept exploit was published on November 5, 2026. The flaw affects certain musl-based Linux distributions, including Alpine Linux, allowing attackers to bypass authentication on accounts whose password hash is set to an asterisk in /etc/shadow. Multiple security firms including GreyNoise, Defused, Previdian, and watchTower have confirmed successful exploitation attempts involving reconnaissance, credential theft, and persistence mechanisms. GreyNoise recorded the first confirmed in-the-wild success on November 7 at 00:46 UTC, with 16 exploitation chains from six IP addresses that included queries to cloud metadata services and installation of the TAC Agent implant. OpenSSH maintainers released version 10.6p2 on November 5 to address the issue, while researchers recommend disabling password authentication and checking for unauthorized SSH keys or TAC Agent services on affected systems.

Binance Denies Alleged Data Breach Claims Involving 335 Million User Records by ShinyHunters Impersonator

Binance has rejected claims of a fresh security breach made by a threat actor using the ShinyHunters handle on an underground cybercrime forum. The actor offered for sale what they described as records belonging to 335 million Binance users, including KYC documents, account passwords, crypto wallet private keys, transaction history, emails, and phone numbers, demanding $900,000. A Binance spokesperson stated that the company found no evidence of compromised systems, customer KYC data, credentials, or private keys, suggesting the listing likely stems from infostealer malware collected from users' devices rather than a direct breach. Binance highlighted inconsistencies in the claims, noting it does not store user passwords in plaintext, does not hold private keys for external wallets, and no longer operates in some referenced jurisdictions. Forum users also expressed skepticism about the legitimacy of the data. The denial follows a confirmed incident last week in which North Korean hackers from the TraderTraitor group, also known as Lazarus Group, compromised an employee and stole approximately $6.34 billion in cryptocurrency.

Bitter APT Group Deploys PapRAT Backdoor in South Asia Cyberespionage Campaign

The South Asian cyber espionage group known as Bitter has been observed deploying a previously unreported remote access trojan called PapRAT against organizations in the region. PapRAT exists in both C++ and Rust variants, offering capabilities such as command execution, file operations, directory enumeration, screenshot capture, and PowerShell execution in the Rust version. The campaign employs three distinct infection chains involving LNK files, VHDX disk images, and URL shortcuts that abuse native Windows utilities like ftp.exe and WebDAV to maintain persistence via scheduled tasks. Reconnaissance data is collected and exfiltrated using living-off-the-land techniques before the staged files are deleted. The MSI-delivered PapRAT supports multiple commands for remote control and drops the previously known WmRAT malware in one chain. Fortinet FortiGuard Labs researcher Cara Lin noted that the server-side command updates provide operational flexibility while avoiding detectable process injection. Organizations are advised to treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution.

GRC Professionals Must Master Data Literacy Agent Governance and Communication to Survive AI Automation

The article argues that AI agents are already performing core GRC tasks such as control testing evidence collection and framework mapping at increasing speed and scale. Rather than replacing GRC managers outright the shift moves human roles toward directing and governing these agents through three critical skills. Data literacy is presented as foundational because agents produce unreliable outputs when fed poor quality inputs like screenshots or stale exports. Agent governance requires treating each AI system like a direct report with defined KPIs accuracy thresholds and escalation rules. Communication skills become essential to maintain auditability as agents hand off work to one another without human intervention. The piece is sponsored by Anecdotes and urges immediate reskilling while emphasizing that the GRC manager who learns to use AI will replace the one who does not.

Plex2Shell Vulnerability Chain Exploited Against QNAP NAS Users Running Plex Media Server

Threat actors have begun actively exploiting Plex2Shell, a chain of four vulnerabilities in Plex Media Server, to compromise installations on QNAP NAS devices. The flaws, identified as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, were patched earlier this summer, yet widespread exploitation started in mid-October following the publication of technical details and proof-of-concept code. Successful attacks require no valid credentials and grant attackers arbitrary code execution with the privileges of the Plex service. QNAP has confirmed that only the Plex Media Server application is affected, while its QTS and QuTS hero operating systems remain untouched. The company urges users to update to version 1.43.3 or later immediately, rotate passwords, and consider devices exposed to the internet as potentially compromised. QNAP has also published a detailed remediation guide recommending VPN usage instead of direct port forwarding for remote access.

Revolve Confirms Data Breach Impacting 1.5 Million Customers After September Intrusion

Online fashion retailer Revolve has updated the Indiana Attorney General’s Office with a final victim count of 1,515,073 individuals affected by the data breach first disclosed in October. The company initially reported the incident to the US Securities and Exchange Commission on October 29 and began notifying customers around the same period. Earlier regulatory filings in five states had only accounted for roughly 197,000 impacted people combined. Attackers gained access to Revolve systems, including its e-commerce platform, on September 11 and were detected on September 29. The exposed data includes names, contact details, mailing addresses, and stored payment card numbers with expiration dates for customers who saved payment methods in their accounts. Revolve notified federal law enforcement and engaged external cybersecurity experts, though the initial access method remains undisclosed and no group has claimed responsibility.

US Government Agencies Warn of Cyber Attacks Targeting Industrial Refrigeration and Cold Chain Systems

The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, HHS, USDA, and DoT, has issued a joint fact sheet highlighting malicious cyber activity aimed at industrial refrigeration and cold chain monitoring systems worldwide. These systems are widely deployed across the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors for temperature monitoring, logging, defrost management, and energy optimization. Attackers are exploiting vulnerabilities such as authentication bypass, arbitrary code injection, and weak configurations in unpatched or internet-exposed controllers. Successful exploitation allows threat actors to alter temperature settings, force continuous heating and defrost cycles, cause inventory loss, create fire hazards, and induce denial-of-view conditions. The advisory strongly recommends immediate implementation of mitigations aligned with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and NIST, including eliminating public internet exposure, isolating OT devices, enforcing strong authentication, applying patches, and maintaining offline backups.

CISA Adds SonicWall SonicOS CVE-2026-19868 to Known Exploited Vulnerabilities Catalog

CISA has added one new entry to its Known Exploited Vulnerabilities Catalog after confirming active exploitation in the wild. The vulnerability, tracked as CVE-2026-19868, affects SonicWall SonicOS SSLVPN and stems from the use of single-factor authentication. This flaw allows attackers to bypass stronger authentication controls and gain unauthorized access to VPN services. The addition triggers mandatory remediation timelines for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. CISA emphasizes that the vulnerability poses significant risks because successful exploitation can grant attackers full control over affected assets. Organizations outside the federal sector are strongly encouraged to adopt the same risk-based prioritization approach.

US Treasury Bans MEXC Global Crypto Exchange Over Sanctions Evasion and Cybercrime Links

The US Department of the Treasury has issued a ban prohibiting MEXC Global from accessing the US financial system due to its role in facilitating at least $16 billion in illicit transactions. The Seychelles-based exchange, founded in 2018 and serving over 40 million users across 170 countries, was found to have processed transactions linked to ransomware, scams, and sanctions evasion involving Iran, North Korea, and Russia between May 2021 and May 2026. FinCEN highlighted ongoing dealings with sanctioned entities such as Garantex and Grinex as recently as June 2026, along with $226 million tied to the A7 sanctions evasion network. Deficiencies in MEXC's AML and customer verification controls allowed direct transactions worth approximately $1 billion with over 40 Iranian CVC exchangers. The order exposes US institutions and individuals to secondary sanctions for any dealings with MEXC. In response, MEXC stated it is conducting an independent review of its sanctions and AML controls while maintaining normal operations and secure user assets.

Former FBI Agent Patrick Steven Yaroch Pleads Guilty to Stealing $2.5 Million in Crypto from Investigation Targets

A former FBI supervisory special agent has admitted to wire fraud and money laundering after stealing nearly $2.5 million in cryptocurrency from wallets belonging to fraud victims and nation-state hackers under active FBI probes. Patrick Steven Yaroch, who served in the FBI Boston Division and later at FBI Headquarters Counterintelligence and Espionage Division, accessed passphrases stored in internal case management systems to drain the funds. He conducted around 100 fraudulent transfers tied to 35 separate investigations and attempted to launder the proceeds by moving them between multiple wallets and using them to pay personal debts. Yaroch self-reported the theft to the Department of Justice National Security Division before his arrest and had been planning to relocate his family to Portugal using funds obtained through the scheme. His actions compromised multiple ongoing national security investigations and exposed sensitive FBI sources and methods. He faces up to 40 years in prison at sentencing scheduled for March 4.

Google Dismantles XCPE Botnet Infecting 1.3 Million Android TV Boxes for Residential Proxy Fraud

Google Threat Intelligence Group collaborated with industry partners to dismantle the XCPE botnet, which had enrolled more than 1.3 million Android TV set-top boxes manufactured by Videostrong Technology Co. The malware secretly turned user devices into residential proxies sold to criminal actors for advertising fraud, account takeovers, and content scraping. The operation is expected to disrupt access to at least 10 million additional compromised IoT devices, including healthcare equipment and karaoke machines. Multiple residential proxy providers such as Honeygain, NetNut, and Grass were linked to the campaign through their SDKs. The takedown also highlighted supply-chain risks in Android-based IoT manufacturing and the role of influencer marketing in distributing pre-infected devices.

Residential Proxies Found Exiting from White House Network AS2650

Security researchers at Layer3 Intel detected multiple residential proxy nodes operating from the Executive Office of the President network AS2650 between October 5 and November 3. The activity involved at least six IP addresses and 236 proxy exits, primarily during evening hours, with 28 different residential proxy services routing traffic through the network. Synthient linked much of the traffic to Infatica proxy software installed on Windows 11 devices, a service founded by Russian national Vladimir Fomenko whose earlier company King Servers hosted infrastructure used in 2016 election system intrusions in Arizona and Illinois. Experts warn that such proxies enable low-cost anonymous access to sensitive government networks, with documented cases of criminals exploiting proxy service vulnerabilities to scan internal systems for malware deployment. Similar proxy activity has been observed across hundreds of government, utility, healthcare, and financial networks according to recent industry reports from Spur and Infoblox.

Default 'admin:admin' Credentials in ForgeRock Servers Allow Researchers to Remotely Unlock and Start Vehicles from Two Automakers

Security researchers Shubham Shah and Sam Curry discovered that two unnamed automakers relied on ForgeRock identity platform instances with an exposed Apache Felix administrator console protected only by the default 'admin:admin' credentials. By bypassing edge protections through specially crafted URLs containing encoded slashes, the researchers gained full access to customer records stored in OpenIDM and could impersonate any user account. Once authenticated through the mobile apps, they obtained valid access tokens that enabled them to unlock doors and start engines on connected vehicles in the United States, Canada, and Australia. The researchers limited full vehicle testing to their own cars and vehicles belonging to consenting owners, reporting the issues in February 2026; both affected systems were patched within approximately two hours. A separate attack path in Australia involved hardcoded administrator credentials left in the application code from a test environment. The incidents highlight persistent misconfigurations in identity management deployments rather than novel product vulnerabilities, with no CVE assigned. The researchers have previously disclosed similar remote vehicle access issues affecting Honda, Kia, and Subaru.

Weekly Cybersecurity Recap: OpenSSH SSHole Exploitation, Debian APT Root RCE, Zyxel Zero-Day, and AI-Driven Attacks

This week's cybersecurity news highlights active exploitation attempts against an OpenSSH flaw allowing passwordless logins on specific Linux configurations. A trojanized Control Web Panel update mechanism is distributing the stealthy CWPdoor backdoor, while a Debian and Ubuntu APT vulnerability enables root-level code execution under retry conditions. Zyxel patched a zero-day in its GS1900 switches exploited by Kapibala to compromise nearly 1,000 devices. CERT-In reported AI-assisted Crafty Falcon targeting financial organizations with re-attacks timed for low-monitoring periods. Additional incidents include hijacked cPGuard updates, mSecure password manager issues, Qilin ransomware claims, and a CPython zero-day affecting AI sandboxes.