Skip to content
Monday, November 9, 2026Nov 9, 2026
The week behind and ahead

Vol. 1, No. 51Composed Nov 9 · 06:03 UTC

SitRep

Cybersecurity, in perspective.

5 elevated5 stories on the wire

Ambition without attention turns scale into systemic risk.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.
The week behind

OpenSSH Sshole Flaw Is Quickly Exploited

Attackers accessed a third-party cloud service used by Iris Plaza, exposing data for about 7.7 million people, including passwords.

2 sources

The Hacker News, BleepingComputer

Hackers exploited CVE-2026-123158, aka SSHole, within hours of disclosure to gain root access on a honeypot running Alpine Linux with OpenSSH. The flaw affects musl-based systems with PAM disabled; an unauthenticated attacker can use oversized passwords to log in to password-disabled accounts. OpenSSH’s patch is version 10.6p2.

Context

Iris Plaza’s reported figures distinguish up to 5.8 million members or former members from 1.9 million non-members. The source says active passwords are stored in encrypted form and credit card information was not stored in the affected service.

“These reports describe distinct incidents; they do not establish a shared cause.”
From Senecowitz · Analysis

Zeno Khosla

Skeptical perspective

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

CISA Sets Federal Deadline for SonicWall Vulnerability

CISA added CVE-2026-19868 to KEV and set a 2026-11-20 deadline for federal agencies to secure systems. The report specifies that federal deadline; it does not state a deadline for other deployments.

BleepingComputer

The move

3 things to do today

Epictim Draper

  1. Patch OpenSSH to version 10.6p2.
  2. Secure federal SonicWall systems by November 20, 2026.
  3. Provide Chainalysis with trusted IPs to regain access and reset passwords.

On the wire

  • 0critical
  • 5elevated
  • 0moderate
  • 0low
P1Exploit

OpenSSH Sshole Flaw Is Quickly Exploited

SSHole · musl-based systems with PAM disabled · Patch OpenSSH 10.6p2

Hackers exploited CVE-2026-123158, aka SSHole, within hours of disclosure to gain root access on a honeypot running Alpine Linux with OpenSSH.1 The flaw affects musl-based systems with PAM disabled; an unauthenticated attacker can use oversized passwords to log in to password-disabled accounts.1 OpenSSH’s patch is version 10.6p2.1

Previously in SitRep Nov 6: OpenSSH Flaw Allows Oversized Password Logins · CVE-2026-123158, CVE-2016-6210

Single sourceThe Hacker News

Added to CISA KEV on 9 Nov 2026 (CVE-2026-123158) · CVE-2026-123158: CVSS 8.1, EPSS 0.01 (FIRST); CVE-2016-6210: EPSS 0.89 (FIRST)

  1. 1THE HACKER NEWS · OpenSSH SSHole Flaw Exploited, Root Access on Honeypot

Copy link to “OpenSSH Sshole Flaw Is Quickly Exploited”

P1Breach

Iris Plaza Confirms Third-party Cloud Breach

About 7.7 million people · Up to 5.8 million members or former members and 1.9 million non-members

Attackers accessed a third-party cloud service used by Iris Plaza, exposing data for about 7.7 million people.1 Exposed data may include names, addresses, phone numbers, emails, gender, dates of birth and account passwords; credit card information was not stored in the affected service.1 The source says active passwords are stored in encrypted form.1

Single sourceBleepingComputer

  1. 1BLEEPINGCOMPUTER · Iris Plaza Data Cloud Breach Exposes 7.7 Million Records

Copy link to “Iris Plaza Confirms Third-party Cloud Breach”

P1Supply Chain

cPGuard Autoupdate Compromise Deploys Backdoor

cPGuard versions 5.88.12–5.88.19 · About 2,946 servers affected

An unidentified attacker used compromised credentials to access OpsShield’s update CDN on 2026-11-02 02:06 UTC, affecting cPGuard versions 5.88.12–5.88.19.1 The attacker distributed a malicious script through the update channel, targeting Linux password hashes, root database configuration, root shell history, and root SSH authorization and known-hosts files.1 About 2,946 servers were affected.1

Single sourceBleepingComputer

  1. 1BLEEPINGCOMPUTER · Hackers Hijack cPGuard Autoupdate to Deploy Backdoor

Copy link to “cPGuard Autoupdate Compromise Deploys Backdoor”

P1Credentials

Chainalysis Reports Customer Credentials Exposed

Names, usernames, password hashes and live tokens · All customers

Chainalysis says an on-path/MITM attack exposed names, usernames, password hashes and live tokens for all customers.1 The login portal and related services were taken offline as credentials and API keys were rotated; customers were asked to provide trusted IPs to regain access and reset passwords.1

Single sourceBleepingComputer

  1. 1BLEEPINGCOMPUTER · Chainalysis Breach Exposes Credentials for All Customers

Copy link to “Chainalysis Reports Customer Credentials Exposed”

P1Identity

SonicWall Warns of SSL-VPN MFA Bypass Exploitation

SonicWall CVE-2026-19868 · Fixed builds 7.3.4-7013 and 8.2.3-8015 · Federal deadline: 2026-11-20

SonicWall warns that CVE-2026-19868 is exploitable by attackers with alternate authentication credentials to bypass SAML MFA.1 The flaw affects SonicOS Gen7 versions through 7.3.3-7015 and Gen8 versions through 8.2.2-8015; SonicWall lists fixed versions 7.3.4-7013 and 8.2.3-8015.1 CISA added CVE-2026-19868 to KEV, setting a November 20, 2026 deadline for federal agencies to secure systems.1 The report says attacks followed prior SMA1000 vulnerabilities and zero-days.1

Previously in SitRep Nov 7: SonicWall Patches Flaw That Weakens VPN Logins · CVE-2026-19868, CVE-2026-102255

Timeline

  1. Oct 12SonicWall SMA1000 CVE-2026-102255 Actively Exploited Days After Disclosure
  2. Nov 6CISA Lists SonicWall Vulnerability as Exploited
  3. Nov 7SonicWall Patches Flaw That Weakens VPN Logins
  4. This edition

Single sourceBleepingComputer

Added to CISA KEV on 6 Nov 2026 (CVE-2026-19868) · CVE-2026-19868: CVSS 7.5, EPSS <0.01 (FIRST); CVE-2026-102255: EPSS <0.01 (FIRST)

  1. 1BLEEPINGCOMPUTER · SonicWall SSL-VPN MFA Bypass Flaw Exploited in Attacks

Copy link to “SonicWall Warns of SSL-VPN MFA Bypass Exploitation”

Known exploited

Added 2 Nov – 8 Nov3 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-19868SonicWall SonicOS SSLVPN6 Nov20 Nov
CVE-2024-27834Apple Multiple Products4 Nov18 Nov
CVE-2026-119977WordPress WordPress Core3 Nov6 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

End of the Horizon edition.

Colophon

SitRep · Vol. 1, No. 51

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.