Weekly AppSec Threat Digest: SSHole Exploited, a GitHub Actions Secret Stealer, Apache HTTP/2 RCE

Last week we described an OpenSSH password bypass on Alpine Linux that had no CVE and no reported exploitation. Both changed within days. CVE-2026-123158 was published on November 5, attackers were using it within hours, and on November 9 CISA added the bug — now nicknamed “SSHole” — to its Known Exploited Vulnerabilities (KEV) catalog with a three-day deadline.

Most of the week's stories have the same shape: one component checks something and another acts on a different reading of it. A crypt error value matched a “no password” marker. GPUStack treated anything that looked like localhost as the administrator. A WAF and an application server disagreed about a path, and two automakers lost remote unlock to it. Revive Adserver checked permissions on one copy of a parameter and acted on another. Meanwhile, compromised GitHub accounts pushed a CI secret stealer into thousands of repositories, Apache fixed a pre-authentication heap corruption in its HTTP/2 module, and the Barracuda chain we covered last week is now exploited.

Lead story: SSHole, an OpenSSH password bypass, joins KEV

The bug lives where OpenSSH meets the musl C library, which Alpine Linux and many container base images use. An account that has no password, such as a key-only user, carries * in its password field. When someone tries a password for that account, sshd still hashes it, borrowing the salt from another local account that does have a SHA-crypt ($5$ or $6$) hash. For inputs longer than 256 bytes, musl's crypt() fails and returns * as its error value. That output matches the * in the password field, so the login succeeds. The CVE record says any password between 256 and 1,024 characters works.

• Who is exposed. OpenSSH before 10.6p2 on musl-based Linux built without PAM (or run with UsePAM no), with PasswordAuthentication yes, the OpenSSH default (Alpine's cloud-init images set it to no). The host also needs both a * account and an account with a SHA-crypt hash. glibc-based distributions and PAM setups are not affected.
• Why it reaches root. Alpine's tiny-cloud images from 3.18.11 to 3.24.3 ship an alpine user with a * password and passwordless doas. They are safe on first boot, but once any SHA-crypt hash exists on the machine — for example, after an admin sets a console password — one login is a root shell.
• How fast it was used. Previdian saw a first attempt less than nine hours after the CVE was published, and the attacker took its Alpine honeypot to root (Help Net Security). GreyNoise logged its first successful exploitation at 00:46 UTC on November 7; by November 9 it had seen 16 attack chains from six IP addresses, and its public tracker has kept growing. Observed follow-up includes cloud-metadata queries, authorized_keys persistence and, in one case, a Python implant.

Remediation: install the fixed openssh package for your Alpine branch (for example 10.3_p1-r2 on 3.24 or 10.6_p2-r0 on edge) and restart sshd, or set PasswordAuthentication no, which closes it entirely. Include Alpine-based containers and appliances that run sshd. Then hunt: search auth logs for Accepted password for on accounts that have no password, review authorized_keys files for keys you did not add, and treat any tiny-cloud host that accepted such a login as root-compromised. OpenSSH notes that the root cause sits outside its code, but 10.6p2 adds a hash-length check anyway. The lesson for any authentication code: never let an error value share a representation with a valid state. See Alpine's advisory, the NVD entry, GreyNoise's tracker and BleepingComputer.

Actively exploited this week

CVE-2026-102895 — GPUStack trusts anything that looks like localhost (CVSS 9.8)

GPUStack, an open-source platform for running AI models across GPU clusters, treated every request from the loopback address as its built-in administrator, because the force_auth_localhost setting defaulted to false. Remote requests could look local in two ways: through a reverse proxy on the same host, or by sending a forged X-GPUStack-Real-IP: 127.0.0.1 header. The result is full admin with no credentials: persistent API keys, worker and cloud-provider secrets, and code execution on worker hosts through POST /v2/inference-backends/from-yaml. The project's advisory says the bug was exploited against a 2.1.1 deployment, where attackers registered custom backends that opened reverse shells. The fix shipped in 2.2.0 in June and the project's advisory followed on July 31; the CVE was published on November 4, and CISA added it to KEV on November 9 with a November 12 deadline.

Remediation: upgrade to 2.2.0 or later, set force_auth_localhost=true, strip X-GPUStack-Real-IP at the edge, and keep the API off untrusted networks. Rotate API keys and cloud credentials on any instance that was reachable. “Local means trusted” stops being true the moment a proxy sits on the same host. See the GPUStack advisory and The Hacker News.

CVE-2026-20320 — Cisco BroadWorks XXE, which Malbear Labs says an AI intrusion agent used

BroadWorks' Open Client Interface parser resolved external XML entities by default, so an unauthenticated OCI-P message could read files with the privileges of the BroadWorks user (CVSS 7.5). Cisco fixed it in release RI.2026.07 and published the advisory in August. CISA added it to KEV on November 10, and on November 12 Cisco updated the advisory to say it had become aware of active exploitation that month. The most detailed account comes from Malbear Labs' “Operation Snowball” report, which describes what it calls an autonomous AI intrusion agent, run by a Chinese-speaking operator, using the XXE on an Xtended Services Platform (XSP) node as its way into a European telecom and pulling the system identity private key and several sets of TLS credentials.

Remediation: move to RI.2026.07 (Cisco lists no workaround), keep OCI-P off untrusted networks, and if a node was exposed, rotate the keys and certificates it held — a file-read bug is a key-theft bug. It is a reminder that XXE is not a legacy class: parsers that resolve entities by default are still shipping in 2026. Our guide to verifying XXE injection covers how to confirm a blind XXE safely. See Cisco's advisory, Malbear Labs' report and The Hacker News.

CVE-2026-116606 + CVE-2026-111560 — the Barracuda ESG chain is now exploited (KEV)

Last week we covered this pair as unexploited. On November 9 Barracuda updated its advisory to say it had identified exploitation activity affecting a small number of organizations, and CISA added both CVEs to KEV on November 10 with a deadline of November 13. As a refresher: CVE-2026-116606 lets an attacker invoke the Email Security Gateway's configuration import and restore a crafted backup, and CVE-2026-111560 injects shell commands through the timezone setting, which run as root. The injection needs admin access on its own; chained behind the bypass, it gives root without credentials. Barracuda has published no indicators or attribution. Remediation: confirm the patches actually installed (ESG 9.4.0.030 or later, plus the fixes for Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway), apply them manually if automatic updates were off, and restrict administrative interfaces to internal networks. See Barracuda's advisory and BleepingComputer.

Xen Orchestra VSA-2026-062 — an empty-object cookie authenticates you

Vates says a threat actor is actively exploiting an authentication bypass in Xen Orchestra's REST API, the web console for XCP-ng virtualization. A cookie value of authenticationToken=j:%7B%7D was parsed into an empty JSON object instead of a string; the token lookup then ran with no effective filter and returned the first stored token, authenticating the attacker as its owner. From there an attacker can collect other reusable tokens, take admin actions and potentially reach root on the hypervisor hosts. It is the same type confusion behind most NoSQL injection: check that a token is a string before it reaches a query. Remediation: update to Xen Orchestra 6.9.2 or 6.10.1 (or the matching XOA release), keep the console off the internet, and check for the indicators in Vates' advisory, including an unexpected pivot2 VM and an unexpected /etc/ld.so.preload file. If you find them, rotate secrets and rebuild. See Vates' advisory and The Hacker News.

N-able N-central “4EverAble2Shell” — Apache Axis 1.x, exploited

After researcher Sean Bales published 33 N-central bugs (“Able2Shell”) on November 8 and 9, N-able took its hosted platform offline and shipped 2026.4 HF2 on November 10. A new chain published with a proof of concept on November 12 still works against HF2 when the Legacy API is enabled and exposed. It starts with CVE-2026-90436 in Apache Axis 1.x, the SOAP library N-central embeds: Axis instantiates the class named in an incoming SOAP fault before any service-level authentication runs, which gives code execution as the nable account, and a symlink trick then gives root. BleepingComputer, citing Previdian and Huntback, reports probing from about 08:30 UTC on November 12 and full-chain attempts from 09:16 UTC, shortly after the proof of concept appeared, and at least 21 production servers running a cryptominer, 19 of them on HF2. N-able said it had not seen compromises, and Huntress had not observed exploitation as of that morning. Remediation: disable the Legacy API until a full fix ships and treat servers showing the reported indicators as compromised. Axis 1.x itself is end of life and will not get a release; inventory any application that still bundles axis-1.4.jar and plan the move to Axis2. See BleepingComputer, Huntress and the Apache Axis advisory.

Also added to KEV this week

• Chrome CVE-2026-125350 — a use-after-free in Chrome's XML handling that runs code inside the sandbox from a crafted page. Google says an exploit exists in the wild; BleepingComputer counts it as the eighth exploited Chrome zero-day of 2026. Fixed in 157.0.8103.50/.51; update other Chromium-based browsers as their vendors ship. (Chrome release notes)
• SonicWall SonicOS CVE-2026-19868 (CVSS 7.1) — when SAML is enabled for SSL VPN logins and another authentication method is also configured, a user with valid credentials for that other method skips SAML and any MFA it enforces. Upgrade to 7.3.4-7013 or 8.2.3-8015, or remove the LDAP, RADIUS and TACACS+ servers configured on the firewall. (SNWLID-2026-0014)
• FreeSWITCH CVE-2026-116779 (CVSS 9.8) — a SIP MESSAGE addressed to api+<command> was routed to FreeSWITCH's API executor, running commands with daemon privileges. Any account on the SIP profile is enough, the stock vanilla configuration ships a passwordless default user, and chat is on in the stock profiles. Upgrade to 1.11.3 or set enable-chat=false. (GHSA-mg63-h38w-8p9p)
• IBM Aspera Faspex CVE-2026-123218 (CVSS 9.8 per IBM) — an authenticated user's crafted message bypasses authorization to full admin; IBM gives few details. Upgrade to 5.0.19 PL1. (IBM bulletin)
• Outlook CVE-2026-124194 (CVSS 6.5) — the November Patch Tuesday's only exploited zero-day: a crafted message file opened in Outlook connects to an attacker's server without the usual external-content warning, leaking the user's NTLMv2 hash. It ships in Office updates, not the Windows cumulative update. (MSRC)
• Openwave Webtop Media Transcoder CVE-2026-111793 — an authenticated file-type restriction bypass (CVSS 4.3), fixed in 1.1.22.0 in December 2021; Openwave says attacks exploiting it have been observed. (JVN)

Critical web application CVEs (no exploitation reported)

CVE-2026-119618 — Apache httpd mod_http2 heap corruption, found first by an AI scanner

Apache HTTP Server 2.4.71, released November 11, fixes a race condition in mod_http2's header handling: threads share a resource without proper synchronization, corrupting the heap in a way an unauthenticated remote client can trigger. Apache rates it Critical and Red Hat scores it 9.8. It affects httpd 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42, and only servers that actually serve HTTP/2. Apache's credits are notable: Anthropic's open-source scanner reported it on October 26, and Anthony Weems and Simon Scannell of Google Cloud Vulnerability Research reported it independently on November 3. Wiz had seen no exploit or in-the-wild activity as of November 11. Since then, a public proof of concept reproduces the memory corruption and crashes (not code execution), and Red Hat says unnamed public research has shown a reliable exploit against a default server with mod_http2 enabled.

Remediation: upgrade to 2.4.71. If you can't yet, set Protocols http/1.1 to turn off h2 and h2c. Don't forget httpd builds bundled inside appliances and vendor products, which often lag upstream by months. The same release fixes CVE-2026-106023, a mod_md NULL dereference that crashes a child process. See Apache's vulnerability list, Wiz and SecurityWeek.

Node.js November security release — 16 CVEs, seven High, in HTTPS, HTTP/2 and TLS

Node.js 22.23.5, 24.22.3 and 26.13.1 shipped on November 11. The bugs worth reading first:

• CVE-2026-123864 (CVSS 8.1) — a zero-length TLS write re-enters the HTTP parser from inside its body callback, causing a use-after-free that copies other connections' memory into a response. It needs an HTTPS handler that calls res.flushHeaders() before the body ends and a route that echoes or stores bodies; plain node:http is not affected.
• CVE-2026-123874 (CVSS 7.5) and CVE-2026-123866 — HTTP/2 use-after-free bugs, one in streams served with respondWithFile() or respondWithFD() that are reset, the other leaking freed response memory to a peer during teardown — remotely triggerable on 24.22.0+ and 26.9.0+, and reachable on every line through application-initiated teardown such as idle timeouts.
• CVE-2026-123872 — TLS 1.2 renegotiation can change the server name mid-connection and bypass per-host client-certificate policy.

No exploitation is reported. End-of-life release lines are affected and get no fix, which is one more reason to retire them. See the Node.js advisory.

Git 2.56.1 — recursive-clone code execution and a merge heap overflow

Git's November 10 releases fix six CVEs affecting every version back to 2.27.0. In CVE-2026-111760 (CVSS 8.0), a path length that wraps a 32-bit field passes validation, letting a malicious repository replace a submodule's .git file with a symlink to attacker-controlled hooks during git clone --recurse-submodules. In CVE-2026-105437, which GitLab rates Critical, a committed .gitattributes with a huge conflict-marker-size plus many conflicts overflows a 32-bit size in the merge code; GitLab says it could lead to command execution in Gitaly, its Git storage service, because forges compute mergeability server-side. Remediation: upgrade every Git you run, including copies bundled with IDEs and CI images (fixed in 2.56.1, 2.55.1, 2.54.1, 2.53.1, 2.52.1, 2.51.3 and 2.50.2); self-managed GitLab to 19.5.4, 19.4.6 or 19.3.8; GitHub Enterprise Server to its latest patch release. Avoid recursive clones of untrusted repositories. See GitHub's announcement and the oss-security post.

Plone Hotfix 20261110 — anonymous remote code execution (CVSS 9.8)

Classes in Products.CMFEditions, Plone's versioning add-on, had no security declarations, so an anonymous visitor could call edit() on a modifier and rewrite its TALES condition, an expression Plone evaluates. A separate flaw let restricted code import whole modules, escaping the sandbox to os. Chained, that is unauthenticated RCE on Plone 6.0, 6.1 and 6.2 and back to at least 4.3. Full details are public, although no exploitation is confirmed. Remediation: upgrade the affected packages or install Products.PloneHotfix20261110 and restart. A tampered condition survives patching, so afterwards run @@check-modifier-conditions as a Manager. See the oss-security announcement and GHSA-67qm-q795-jh7h.

November Patch Tuesday: the web-facing pieces

Microsoft's November 10 release covers about 1,090 CVEs by the Zero Day Initiative's count (BleepingComputer, including third-party CVEs, counts 1,235). Beyond the exploited Outlook bug above, the ones web and platform teams should schedule first: an unauthenticated IIS race condition (CVE-2026-119961, CVSS 8.1, Critical), Windows Search RCE triggered by an email attachment that Exchange indexes automatically (CVE-2026-116928, 9.8), Windows LDAP RCE (CVE-2026-119958, 9.8), an authenticated Exchange RCE rated exploitation more likely (CVE-2026-118207, 8.8), SharePoint elevation of privilege through Secure Store credentials (CVE-2026-120002, 9.9) and a SharePoint stored XSS (CVE-2026-109454, 9.0), and an ASP.NET Core elevation of privilege that needs a privileged user to follow a crafted link (CVE-2026-114146, 9.0). See the Zero Day Initiative's review.

Follow-ups

• React Server Components now has a CVE. The Flight-protocol RCE behind the Next.js out-of-band release in our October 9–16 digest was assigned CVE-2026-126187 (CVSS v4 9.5) on November 10, so scanners that key on CVE IDs will start flagging it. Fixed react-server-dom-* releases are 19.0.9, 19.1.10, 19.2.9 and 19.3.1. (GHSA-xqc2-xf4c-x3h3, StepSecurity's root-cause analysis)

Supply chain: the build system is the target

“wfx”: compromised accounts push a CI secret stealer into thousands of repos

Starting around 12:45 UTC on November 10, a campaign used compromised GitHub accounts to plant a roughly 1,500-line secret stealer in repositories those accounts could write to. Aikido counts 4,837 accounts opening probe pull requests in 61,764 repositories and at least 1,835 repositories that ran the payload; SafeDep, counting differently, found malicious commits in 8,093. The pattern is fast and quiet. A probe pull request titled “docs: dependency audit notes” tests for write access. The attacker then injects the stealer into an existing workflow, a postinstall hook or a new build-audit-*.yml, lets it run, reverts the commit and deletes the run and its logs within about a minute — often a missing run number is the only trace. The stealer takes repository secrets, GITHUB_TOKEN, OIDC tokens and runner memory, pivots into AWS, GCP and Azure, and persists by rewriting AWS role trust policies to trust any AWS account and adding Azure federated credentials named wfx-ci-*. Commits appear under real user and bot accounts, and how the attacker obtained their tokens is not established.

What to do: search your organizations for the probe pull request title and for commits such as “ci: refresh build cache”, “chore: add ci helper” and “chore: add dependency audit workflow”, and look for gaps in workflow run numbers. If a repository was hit, rotate every secret and cloud role its jobs could reach, audit IAM trust policies and Azure federated credentials, and revoke the pushing account's tokens. Since exfiltration moved to Telegram on November 12, blocking the first published IP addresses no longer helps. It follows the testmetest and Gheist campaigns we covered in the October 23–30 digest; Aikido notes account overlap with October's GhostAction wave but assesses wfx as a separate campaign. Branch protection that requires review on workflow files, and short-lived OIDC roles scoped per repository, limit what one stolen account can do; our write-up on pull_request_target pwn requests covers the workflow side. See Aikido and StepSecurity.

Railway's incident report: a shared build VM became the keys to customer secrets

Railway published its report on an October 20–21 breach on November 10. An attacker used a bug, not yet disclosed, to partly escape filesystem isolation on a shared, multi-tenant build VM and read a build credential. The company's internal Temporal workflow service trusted that credential, which exposed other builds' histories and a copy of the monorepo; a misconfigured OIDC binding then gave cloud access, and from there the attacker reached the variables database and the service that decrypts it. Railway puts the upper bound at 1.85% of workspaces and says the attacker went first for AI provider keys, with an estimated $740,000 of unauthorized spend. Builds now run on their own ephemeral VMs. If you deploy on Railway: rotate the secrets stored in its variables, starting with AI provider, cloud, database and payment keys, and report unauthorized AI spend through the form in Railway's report. Railway invalidated every session and API token on October 21, so GitHub connections and CLI and CI tokens also need recreating. See Railway's report.

Also in supply chain

• Qubole cross-account roles — Wiz found an actor holding credentials from a Qubole-associated AWS account assuming customer integration roles between October 14 and 26, supplying the correct External ID every time, then reading Lambda environment variables, Secrets Manager, SSM and S3. Most of the abused roles were otherwise unused. Remove vendor trust you no longer need and add source IP or VPC endpoint conditions to the rest. (Wiz)
• bee-js 13.3.0 and Swarm Desktop 0.56.2 — attackers who likely controlled maintainer and bot accounts turned a build script into a postinstall loader, and the project's own trusted-publishing workflow published it, so the malicious npm package carried valid provenance. npm pulled it after about 75 minutes. Provenance tells you which pipeline built a package, not whether that pipeline was compromised. (Socket)

Web application and AI security research worth your time

Blind trust: stealing credentials through CSP — PortSwigger Research, November 11

Gareth Heyes shows how HTML injection steals credentials on a page whose Content Security Policy blocks every script. The key detail: form-action does not fall back to default-src, and if it is missing, forms can submit anywhere. Even with form-action 'self', a two-stage form works: an injected form with no action submits to the same page, carrying username and password fields plus a second payload in the vulnerable parameter; that payload injects a referrer policy of unsafe-url and a meta refresh to the attacker's server, and the credentials leave in the Referer header. No script runs, so CSP never objects. The research ships with a Burp AT skill that checks a policy's allowed script sources against more than 350 known bypass gadgets from cspbypass.com. Practical takeaway: set form-action explicitly, audit every directive that does not inherit from default-src, and keep fixing HTML injection even behind a strict CSP. It pairs with our guide to deploying a strict Content Security Policy. Read the research.

From a path confusion to unlocking cars — Sam Curry and Shubham Shah, November 7

Two posts published November 7 describe chains against the ForgeRock-based identity platforms of unnamed automakers. The joint Curry–Shah write-up starts with a path confusion: encoded slashes, dot segments and semicolon parameters under a static-asset prefix made the edge treat requests as static files while the backend routed them to a hidden admin console that accepted its documented default credentials. That led to code execution in production, admin credentials in the process environment, and account takeover by changing a victim's email and resetting the password. The researchers confirmed remote unlock with the owner beside the vehicle, and both automakers fixed the issue about two hours after the report. Shah's companion post covers one automaker's Australian environment: API keys hardcoded in a test harness, admin credentials in a vendor JavaScript bundle, a WAF bypass using path-traversal encoding, and a legacy Resource Owner Password Credentials grant that skipped MFA, tested on cars the researchers owned or had permission to use. Practical takeaway: fuzz admin paths for WAF-versus-backend normalization differences, remove default credentials from every console, keep secrets out of client bundles, and disable the password grant. See the joint write-up and Shah's companion post.

Coding agents are committing your secrets — Apiiro, November 5 (updated November 8)

When a developer approves a command with “Yes, and don't ask again,” Claude Code saves the exact command as an allow rule in .claude/settings.local.json, including any password or token typed into it. The tool adds that file to the user's global gitignore but not the repository's, so clones, folders that later become repositories and files already tracked still leak. Apiiro found 104,185 public copies of the file, 1,122 holding a real secret, including database passwords, Supabase service-role keys and AWS keys; counting git history and agent transcripts, 2,539 secrets in 1,994 repositories. Common scanners missed about a fifth of them, because the secrets sit inside command lines (PGPASSWORD=, sshpass -p, bearer headers). The Claude Code team said it is prototyping fixes. Practical takeaway: add agent folders such as .claude/ to repository gitignore templates, scan history and not just the latest commit, add rules for credentials embedded in commands, and rotate before you clean up. Agent configuration files are attack surface in both directions, as our teardown of the Copilot and Cursor config-file bugs showed. Read Apiiro's research.

Bug bounty highlights

Revive Adserver: one parameter, two sources, cross-tenant access and SQL injection

Two HackerOne reports disclosed on November 11 (by kushbafti and sh4d0byss) trace back to a 6.x refactor that made Revive's input helper read GET before POST. Permission checks used the object IDs in the URL while form handling used the POST body, so a manager could put their own agency's IDs in the query string and another agency's in the body and edit campaigns they did not own (CVE-2026-107247). The same mismatch between check and query produced a blind SQL injection that extracts password hashes and session IDs (CVE-2026-107662). Revive 6.0.9 fixes these and 12 other CVEs in REVIVE-SA-2026-004. Testing takeaway: on every state-changing endpoint, send the same parameter in the query, the body and a cookie with different values — yours and a victim's — and see which one the authorization check reads. It is a fast way to find the access-control gaps described in our guide to IDOR and BOLA. See the Revive advisory, HackerOne #3831102 and #3896779.

Hidden text in an AI agent's approval prompt — HackerOne #4077800

Disclosed on November 6 through the AWS vulnerability disclosure program, this report shows how a human-in-the-loop check can be blinded. The strands-agents-tools package rendered its consent prompt as prompt_toolkit HTML without escaping, so markup inside tool arguments was interpreted rather than shown: a <hidden> tag or a foreground color that matches the background makes part of the command invisible. Through indirect prompt injection, an agent could be steered to call the use_computer tool with an application name that displays as “Calculator” but carries a payload for shell, AppleScript or PowerShell sinks; the operator types y and the hidden part runs. The program rated it medium and paid no bounty, and AWS has since deprecated use_computer, so moving off the tool is the practical fix. Takeaway for anyone building agent UIs: render approval prompts as escaped plain text, strip control and markup characters, and show the exact arguments being approved. See the disclosed report, and our guide to verifying prompt injection in LLM applications.

The pattern: the check and the action read different things

Line the week's bugs up and the same gap keeps appearing. In SSHole, an error value and the “no password” marker were both *. GPUStack's check asked whether a request came from localhost; a proxy and a header answered yes for remote attackers. Xen Orchestra expected a string and got an object. The automaker WAFs read one path and the backends served another. Revive authorized the IDs in the URL and changed the ones in the body. A strict CSP governed scripts but not forms. And the Strands approval prompt showed the operator one command while the shell received another.

None of these shows up when you read either component alone, and a scanner that matches versions or response patterns will not find them either. They show up when something sends the input the second component will see and checks what actually happens — which is the case for testing by exploitation rather than by inference.

What to do first: November 6–13 action matrix

Sources and further reading

• CISA — Known Exploited Vulnerabilities catalog (additions dated November 6, 9 and 10)
• OpenSSH SSHole (CVE-2026-123158) — Alpine advisory, NVD, GreyNoise, BleepingComputer
• GPUStack (CVE-2026-102895) — GHSA-gj9m-f8ph-pmhr
• Cisco BroadWorks (CVE-2026-20320) — Cisco advisory, Malbear Labs
• Barracuda ESG (CVE-2026-116606, CVE-2026-111560) — Barracuda advisory, MNDT-2026-0042, MNDT-2026-0041
• Xen Orchestra — VSA-2026-062; N-able N-central — Huntress, BleepingComputer
• Microsoft November 2026 updates — MSRC CVE-2026-124194, Zero Day Initiative
• Apache httpd (CVE-2026-119618) — Apache, Wiz; Node.js — November security releases; Git — GitHub blog; Plone — oss-security
• Supply chain — Aikido on wfx, StepSecurity on wfx, Railway, Wiz on Qubole, Socket on bee-js
• Research — PortSwigger, Sam Curry, Shubham Shah, Apiiro
• Bug bounty — REVIVE-SA-2026-004, HackerOne #4077800