Daily Threat Brief: 7 November 2026

TL;DR: Patch OpenSSH on Alpine/musl and WordPress Core today, as both are under active attack. If you run SonicWall SSL-VPN with SAML MFA, or Zyxel GS1900 switches, those come next.

🔥 Actively exploited

OpenSSH “SSHole”: CVE-2026-123158 (CVSS 8.1)

Attackers began trying to exploit a newly disclosed OpenSSH flaw within hours of disclosure, and one honeypot was reportedly taken over with root access. The bug lets attackers sign in to accounts that have no password set. It only affects Linux systems running OpenSSH on the musl C library with PAM disabled, which is Alpine Linux’s default sshd configuration. That makes Alpine-based containers and appliances the main exposure.

• Fix: OpenSSH 10.6p2, or the Alpine package update
• Hunt: sshd logins to accounts with no password, plus any Alpine images that expose SSH

Sources: The Hacker News · CVE record · OpenSSH release notes

WordPress Core: CVE-2026-119977 (CVSS 8.1), added to CISA KEV on 3 Nov

This is a time-of-check/time-of-use (TOCTOU) race condition in the core updater. WordPress uses predictable, web-accessible staging paths during a full core upgrade, and an unauthenticated attacker can use that brief window to run code on the server. Patches came out in late October. CISA confirmed exploitation, and researchers have counted more than 240,000 exploit attempts.

• Fix: update to the latest patched WordPress release. Do core upgrades during quiet periods, and consider blocking public access to the upgrade staging directories.

Sources: The Hacker News · Hackread · CISA KEV

SonicWall SonicOS SSL-VPN: CVE-2026-19868, added to CISA KEV on 6 Nov

An attacker who has valid credentials for an alternate authentication method can bypass SAML controls, including SAML-enforced MFA. SonicWall investigated reports of exploitation and is urging customers to update. US federal agencies have until 20 November to patch.

• Fix: SonicOS 7.3.4-7013 or 8.2.2-8015 or later
• Context: SonicWall remote-access products have been hit repeatedly this year, including the SMA1000 zero-day chains in July and September.

Sources: Canadian Centre for Cyber Security, AV26-1133 · mezha.net

Zyxel GS1900 switches: CVE-2026-107441 (CVSS 8.8), zero-day

This is an out-of-bounds write in the switches’ web management interface. It lets an unauthenticated attacker run OS commands. It was exploited before a patch existed, compromising nearly 1,000 switches worldwide and stealing configuration files and credentials.

• Fix: apply Zyxel’s GS1900 firmware update. Take management interfaces off untrusted networks, and rotate any credentials stored in switch configs.

Sources: BleepingComputer · CISO Series

Ivanti Connect Secure: two more zero-days in the chain

Ivanti patched CVE-2026-111357 (missing authentication, privilege escalation) and CVE-2026-118527 (predictable identifiers). Attackers had chained both with CVE-2026-104935 to get unauthenticated root code execution on appliances that were fully patched at the time. The KEV deadline for CVE-2026-118527 is 13 November.

Source: SecurityWeek

🩹 Patch now (no known exploitation yet)

• Android November bulletin: 216 fixes, 23 of them Critical. The headline bug is CVE-2026-58868, a zero-click remote code execution flaw in the Framework that affects Android 14 to 17. Get devices to patch level 2026-11-05 to cover everything in the bulletin. (The Hacker News)
• Debian/Ubuntu APT: CVE-2026-109518 lets a man-in-the-middle attacker swap verified packages for malicious ones that run as root. Update apt. (or1k.net digest)
• .NET emergency fixes: library updates for .NET 8, 9 and 10. Proof-of-concept code is public, but there’s no known exploitation yet. (Help Net Security)

🏭 OT / ICS corner

• Mitsubishi Electric CC-Link IE TSN (CVE-2026-13584): the advisory now covers two more products, and no fix is planned. Rely on network segmentation and compensating controls.
• WAGO cloud (CVE-2026-18963): an account-recovery flaw let attackers reset passwords without email verification. It’s already fixed on the server side.
• Johnson Controls C•CURE 9000 / victor (CVE-2026-106019): installer builds released between 1 July and 18 September 2026 could write admin credentials to installer logs. Check those logs and rotate the credentials.
• Festo FactoryViews / MES4: updated guidance on the “PHP2Shell” PHP flaws, which are in KEV. The fix is FactoryViews 1.12.2.
• CISA, FBI and HHS jointly urged organisations to harden industrial refrigeration and cold-chain monitoring systems.

Source: Daily OT Security News, 6 Nov · CISA advisories

📌 One thing to do today

Search your estate for internet-facing SSH on Alpine/musl images (containers, appliances, jump boxes) and confirm OpenSSH is on 10.6p2 or later. Exploitation began within hours of disclosure, so this patch can’t wait for the normal cycle.

---

The Daily Threat Brief is compiled every morning (AEST) from public advisories and reporting. Always check the vendor advisory before acting. Spotted an error? Let me know.