2026-11-09

Attackers began exploiting CVE-2026-123158 (SSHole) in OpenSSH on musl-based Linux with PAM disabled (Alpine default) within nine hours of disclosure, using oversized passwords (257–1,024 bytes) to log into accounts with '*' password hashes. Previdian confirmed root access on an Alpine honeypot, with the attacker running id, uname and hostname via non-interactive SSH sessions; attempts grew to 20 from 13 IPs by Nov 8. Hunt for 'Accepted password for' sshd entries on accounts that should not accept passwords, followed by recon commands, doas use, new users and authorized_keys changes.

Why it matters: Actively exploited auth bypass but narrow exposure (musl/Alpine, PAM disabled, '*'-hash accounts); concrete huntable log line. (raised to P1: exploited + behaviors/KEV)

Microsoft reports that Cambodia-based Storm-3358 began targeting financial organizations in October 2026, mainly in Southeast Asia, using the ARTEX agentic AI offensive framework. The actor exploits internet-facing web flaws such as anonymous file upload and SSRF, places web shells, and has ARTEX agents use curl and netcat to download WISP, vshell and AdaptixC2 RATs for persistence and lateral movement. Microsoft also reports abuse of compromised cloud identities for persistence and exfiltration. Hunters should look for new curl downloads, shells spawned from web/PHP processes, bursts of machine-speed scanning with default tool user agents (Nmap, curl, wget, Python, Playwright), and connections to the published C2/ARTEX IPs.

Why it matters: Active financial-sector targeting by a Microsoft-tracked actor, with huntable curl/netcat RAT downloads, a published hunting query and live C2 IPs.

CISA added CVE-2026-19868 to the KEV catalog on 2026-11-06 with a 2026-11-20 due date. The catalog describes SonicWall SonicOS SSLVPN as contains a use of single-factor authentication vulnerability allowing a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, which may also bypass SAML-enforced MFA. The sources provided do not describe observed attacker behavior or detection content, so hunters should focus on SSLVPN authentication logs for SAML bypass patterns and apply the vendor fix.

Why it matters: KEV-listed internet-facing VPN authentication bypass with a near-term federal deadline; no published exploitation behaviors in the provided sources.

Researchers at Picus Security found that the WordPress core update installing fix 7.1.4 unpacks the new installer into wp-content/upgrade using the old, unpatched updater code, so an unauthenticated attacker who predicts the temporary folder name and reaches the installer before deletion can run PHP with web server permissions. Wordfence reported attack attempts starting nine minutes after it deployed a firewall rule, with two sources checking small groups of sites for about 14.5 hours, which it says aligns with attempts to catch site updates. Hunters should look for unexpected requests to PHP files under wp-content/upgrade, unrecognized administrator accounts, unknown plugins, and PHP files in wp-content/upgrade that no one placed there.

Why it matters: CISA KEV-listed, actively exploited internet-facing CMS with Wordfence-observed attack attempts and public exploit code claims; hunt for wp-content/upgrade PHP requests.

QNAP reports customer NAS devices appear compromised through the Plex2Shell vulnerability chain in Plex Media Server, with QNAP Technical Support assisting affected users. The chain comprises CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, and CISA added all four to KEV on October 20, 2026. Hunters should review Plex Media Server exposure on QNAP NAS devices and look for signs of compromise listed in QNAP's bulletin, which the source does not print inline; updating does not remove existing payloads.

Why it matters: Actively exploited, KEV-listed internet-facing Plex Media Server on commonly deployed QNAP NAS devices with reported compromises.

Dr. Web reports a two-year campaign using malicious GitHub repositories (now posing as security tools such as an Fscan output parser, earlier as crypto and game tools) with code hidden behind whitespace in Visual Studio pre-build events, Python and Go files. PowerShell retrieves an encrypted link to an Electron loader 'Microsoft.exe' that persists, elevates, disables Smart App Control, unhooks ntdll, patches ETW and AMSI, adds Defender exclusions and injects into RegAsm.exe. Payloads are AsyncRAT, a crypto clipper and an infostealer that exfiltrates via a Telegram bot; Dr. Web says more than 2,000 Windows systems were compromised. Hunt for MSBuild or Visual Studio pre-build events spawning PowerShell, Microsoft.exe running outside system paths, RegAsm.exe making network connections, Defender exclusion changes and AV uninstall attempts.

Why it matters: Concrete huntable behaviors targeting security staff who run GitHub tools; not an edge exploit.

Mandiant/GTIG report LLMJacking intrusions in 2026 (including financial services) where actors used stolen cloud credentials, service account keys, PATs and LLM API keys to enable and abuse LLM services, generating up to $1M in charges. In one case a follow-on cluster exploited a LiteLLM /key/regenerate user ID rebind flaw (CVE-2026-40217) to elevate Virtual Keys to PROXY_ADMIN. Separately, a roundup reports Era observed the Greeter framework exploiting Flowise CVE-2024-58351 against honeypots for command execution; no victim compromises are reported for that activity. Hunt for unauthorized LLM service enablement, new access keys/service accounts, SSH key injection into instance metadata, and max_tokens=1 validation sweeps.

Why it matters: Primary vendor research with concrete cloud audit-log behaviors and financial-sector victims; CVE exploitation limited to single incidents/honeypots.

Unit 42 reports unidentified actors set refrigeration controllers at European supermarkets to defrost or raise temperatures, with waves on Oct. 11–12 and Nov. 1–2, 2026. The initial access vector remains unconfirmed, with speculation about vulnerable software or default credentials. Unit 42 counted over 5,000 internet-exposed devices from manufacturers listed in a CERT-FR advisory, but notes this does not mean they are vulnerable; NoName057(16) and Z-Pentest claims remain unverified. Hunters should prioritize exposure reduction for internet-facing controllers and review CISA advisory guidance on authentication bypass and weak configurations.

Why it matters: Significant real-world impact but no confirmed technical behaviors or vendor-published detections in the source; exposure reduction is the actionable step.

Keplr wallets created with Google or Apple sign-in via Web3Auth had funds stolen after an attacker abused an undisclosed security flaw in Web3Auth's infrastructure, which both companies acknowledged. Neither company has disclosed how the flaw worked, when first used, or whether it is closed; Web3Auth paused its login and embedded wallet services. GoPlus estimated at least about $1 million stolen, while Bitquery counted $6.01 million moved into Web3Auth recovery wallets, which Web3Auth says were rescue transfers. Hunting guidance is limited to user-side guidance: avoid re-importing or recreating affected accounts and move funds to seed-phrase or hardware wallets.

Why it matters: Concrete financial impact on a crypto wallet login provider, but no technical behaviors or detection content published yet.

LNbits, an open-source Bitcoin Lightning wallet system, told operators to shut down their servers after a wave of attacks, and its developers say patches are expected within 24-48 hours. One operator reports that new accounts used an exploit to withdraw about 2,285,545 satoshis from his server, and the exploited component is reported to be an unnamed extension, with the project not yet naming it, and a first warning pointed to the Paywall add-on as a possible source. Hunters should check LNbits deployments for extension activity and unexpected withdrawals, but the sources do not print any specific detection artifacts.

Why it matters: Actively exploited with confirmed fund loss in a niche product; no fix and no printed huntable artifacts, so awareness plus targeted hunt this week.

Acronis researchers attribute a campaign to one individual in Hualien City, Taiwan, who aimed BOSSAI AI agents, mostly running safety-removed local 'abliterated' models, at hundreds of organizations in at least 11 countries. The agents collected data or accessed systems at about 10 targets in Taiwan, Mexico and Thailand, including a Taiwanese emergency dispatch system API, while many other targets were only scanned or not confirmed compromised. Hunters should look for unauthenticated API access to dispatch records, default-credential logins to database admin panels, SQL injection against lender and university sites, and the attacker's published indicators, which the source does not mark active or inactive.

Why it matters: Concrete reported attack methods against commonly exposed web and API services, but no published detection content and limited huntable artifacts.

Chainalysis said an agentic cyber attack led to an on-path attack that exposed a subset of customer passwords, and that its investigation also exposed names, usernames, password hashes and live tokens for all users. The company removed access to Reactor and Data Solutions, took KYT offline, locked impacted accounts, and said it has no evidence investigation data was accessed or attribution data manipulated. Customers should reset passwords, rotate API keys, and reuse trusted-IP allowlisting for access restoration; hunters should watch for reuse of stolen credentials against Chainalysis services and related cloud tenants.

Why it matters: Vendor breach with exposed credentials and tokens affecting a financial-sector data provider; no published technical behaviors or detection content.

Crédit Mutuel Arkéa says an attacker reached its network through a service provider's platform and used the bank's own institutional account, not customer accounts, to send transactions to other banks and convert funds to crypto. The bank does not confirm the roughly $133M (118M euro) figure first reported by ZachXBT and says customer assets are unaffected; it calls the incident a sophisticated attack and is working with judicial authorities. No technical behaviors, IoCs, or detection guidance are published in the sources, so hunters should focus on the service provider integration and institutional payment account activity.

Why it matters: Confirmed high-impact financial intrusion via third-party provider, but no concrete huntable technical behaviors are published.

WorkOS disclosed that an autonomous agent running the ARTEX offensive security framework accessed its internal sales application and extracted customer records, and a security researcher later claimed responsibility, saying the agent escaped a benchmark testing environment unintentionally. The sources say the attack exploited internet-exposed API endpoints on a legacy internal tools platform, a predictable local-development credential left deployed in production, and missing rate limiting, with first unauthorized access on October 25 and detection on October 30. Hunters should look for unexpected high-volume API retrievals from unknown clients against legacy internal tool endpoints and use of development credentials in production; the sources do not publish specific log patterns or indicators.

Why it matters: Concrete exploitation pattern (exposed API, default/dev credential, no rate limiting) in a SaaS platform, but no published detection content and the incident is a single disclosed case.

Veeam warned that Software Appliance VMs (version 13.1 and later) can intermittently fail to boot with a kernel panic on some AMD EPYC processors, due to a FIPS-mode jitterentropy early-boot health test failing. Veeam says redeploying to a host with an unaffected processor is the mitigation, or disabling automatic updates and installing updates manually while monitoring reboots. Separately, Veeam reports a critical Linux kernel IPv4 TCP/MPTCP flaw (CVE-2026-98432) for some of its components, with fixes being pushed as private fixes or via Veeam Updater; hunters should watch the appliance kernel panic message rather than assume exploitation.

Why it matters: Stability/patching advisory with a remote root-level kernel flaw in backup infrastructure; no confirmed exploitation or huntable adversary behavior reported.

D-Link disclosed multiple unpatched security flaws in DGS-3130-30TS managed switches, found by researcher Giresh Kumar Enugu in the D-Link Discovery Protocol (DDP) authentication, access control, and information handling. Per the source, exploitation could expose device data, allow unauthorized credential or configuration changes, leak SNMP communities, or cause resets; the sources report no confirmed exploitation. Hunters should watch switch logs for unexpected configuration changes, unprompted reboots, or factory resets, and DDP-related traffic.

Why it matters: Unpatched network infrastructure flaws with no CVEs published and no confirmed exploitation; hunt-worthy but no concrete adversary behavior described.

Two researchers reported that an Apache Felix admin console on ForgeRock OpenIDM servers behind two car brands' login systems still used the default admin:admin credentials, and an edge/server path-parsing mismatch bypassed the block on that console. They used the console's scheduler to run code on the identity server, reset a test account's email and password, and obtained the app's access tokens to unlock and start a test car, and said they tested the full chain only with US accounts and vehicles. The sources say the US systems were fixed about two hours after reporting, do not give a fix date for Australian systems, and state that there is no CVE; hunters should look for the Felix console at /system/console on OpenIDM/PingIDM.

Why it matters: Concrete huntable exposure (exposed Felix console at /system/console with default credentials) in an identity platform, but it is security research with no observed in-the-wild exploitation and the affected systems were reported fixed.