Cyber Threat Brief — November 6 2026
⚠️ This report is AI-generated. Always validate findings.
1. OpenSSH on musl without PAM — CVE-2026-123158
TL;DR: Install OpenSSH 10.6p2, or the Alpine openssh package for that branch, and restart sshd, because CVE-2026-123158 can accept a long password on musl when PAM is off and the other conditions below are true. Previdian alone reports root on one Alpine honeypot; that claim is unconfirmed by a second origin, and the CVE is not in CISA KEV.
What’s New:
- OpenSSH’s 10.6p2 notes describe a password-authentication bypass on Linux when sshd is built and run with PAM disabled, and they say the root cause is outside sshd. The notes do not name a CVE. Alpine says the login succeeds when PasswordAuthentication is yes, the account’s shadow field is
*, and another local account has a$5$or$6$hash. Alpine says the password is 257 to 1024 bytes. The CVE record says any password between 256 and 1024 characters. - The portable fix is OpenSSH 10.6p2. Alpine’s fixed packages are in the table, and upgrading the package does not restart sshd. Damien Miller’s 5 November note on openssh-unix-dev, timestamped 9:10:48 with no timezone in the archive header, says to set PasswordAuthentication no or disable SSH immediately on musl without PAM. Kültekin names OpenWrt, Buildroot, and Yocto. No fixed build for those platforms was verified.
- The Hacker News quotes Ryan Dewhurst of Previdian as the sole source for a claim that the first attempt came less than nine hours after publication, that one Alpine honeypot returned root, and that eight attempts came from 89.116.89[.]18 in Japan. Those sessions ran id, uname, and hostname. Media restatements of that quote are not a second origin. Previdian’s feed lists the CVE as Confirmed and not in KEV, and it does not list that address. CISA’s enrichment, updated 6 November at 04:56 UTC, still marks exploitation as proof of concept.
- Alpine says glibc, PAM with UsePAM yes, a locked shadow field of
!, a container that does not run sshd, and a cloud-init image that sets PasswordAuthentication no are outside this bug. PermitRootLogin prohibit-password blocks root by default. The alpine user on official tiny-cloud images can use doas, and Alpine says that account is enough once any$6$hash exists on the host.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| OpenSSH 10.6p2 | Fixed build | T1190 | Host software inventory | If you build portable OpenSSH yourself on musl without PAM, install 10.6p2 and restart sshd. On Alpine, use the branch package in the rows below. OpenSSH 10.6p2 notes. |
| openssh 10.6_p2-r0 | Fixed build | T1190 | Host package inventory | On Alpine edge, install openssh 10.6_p2-r0 and restart sshd. Alpine advisory. |
| openssh 10.3_p1-r2 | Fixed build | T1190 | Host package inventory | On Alpine 3.24, install openssh 10.3_p1-r2 and restart sshd. Alpine says release 3.24.4 contains this package. Alpine advisory. |
| openssh 10.2_p1-r1 | Fixed build | T1190 | Host package inventory | On Alpine 3.23, install openssh 10.2_p1-r1 and restart sshd. Alpine says release 3.23.8 contains this package. Alpine advisory. |
| openssh 10.0_p1-r11 | Fixed build | T1190 | Host package inventory | On Alpine 3.22, install openssh 10.0_p1-r11 and restart sshd. Alpine says release 3.22.8 contains this package. Alpine advisory. |
| openssh 9.9_p2-r1 | Fixed build | T1190 | Host package inventory | On Alpine 3.21, install openssh 9.9_p2-r1 and restart sshd. Alpine says release 3.21.10 contains this package. Alpine advisory. |
| openssh 9.7_p1-r6 | Fixed build | T1190 | Host package inventory | On Alpine 3.20, install openssh 9.7_p1-r6 and restart sshd. Alpine advisory. |
| openssh 9.6_p1-r3 | Fixed build | T1190 | Host package inventory | On Alpine 3.19, install openssh 9.6_p1-r3 and restart sshd. Alpine advisory. |
| openssh 9.3_p2-r4 | Fixed build | T1190 | Host package inventory | On Alpine 3.18, install openssh 9.3_p2-r4 and restart sshd. Alpine advisory. |
| openssh 9.1_p1-r7 | Fixed build | T1190 | Host package inventory | On Alpine 3.17, install openssh 9.1_p1-r7 and restart sshd. Alpine advisory. |
| openssh 9.0_p1-r6 | Fixed build | T1190 | Host package inventory | On Alpine 3.16, install openssh 9.0_p1-r6 and restart sshd. Alpine advisory. |
| PasswordAuthentication no | Configuration | T1190 | sshd configuration | Set PasswordAuthentication no in /etc/ssh/sshd_config and restart sshd. Alpine reads /etc/ssh/sshd_config.d only from 3.19 onward. Keep the current session open until a new key login works. Alpine advisory. |
| Accepted password for | Log line | T1078 | /var/log/messages | Alert when sshd logs Accepted password for an account whose shadow password field is *. Alpine says that field marks a key-only account. Alpine advisory. |
| 89.116.89[.]18 | IP address | T1078 | SSH auth log or firewall | Alert on SSH from 89.116.89[.]18. The Hacker News, quoting Previdian, names this address as the source of eight honeypot attempts. The Hacker News. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | SSH client URL only; misses an sshd password acceptance. |
| Elastic | None — verified | Successful-login rules miss a locked-account acceptance. |
| Sigma | None — verified | sshd error strings only; misses Accepted password. |
Detection index: ESCU 4c1652e (2026-11-03) · elastic detection-rules 0aacc5e (2026-11-06) · SigmaHQ 53423da (2026-11-06).
Hunt hint: Check the openssh package against the row for that Alpine branch, install it, and restart sshd. If you cannot update yet, set PasswordAuthentication no in sshd_config, because Alpine reads sshd_config.d only from 3.19 onward, and test a key login before you close the current session. Search /var/log/messages for an sshd line that says Accepted password for an account whose shadow password field is *. If alpine or another key-only account shows that line, isolate the host and review doas, new users, and authorized_keys. Alert on the Previdian source address in the table.
Sources: OpenSSH 10.6p2 release notes · Alpine advisory, 5 November · Damien Miller, openssh-unix-dev · Özgün Kültekin · NVD CVE-2026-123158 · The Hacker News, quoting Previdian · Previdian feed · CISA KEV
Status Updates
- WordPress Core (WordPress-Core-CVE-2026-119977): KEV is due today. Bayram says put the deny in server config or as RedirectMatch in the root
.htaccessbefore you update — an.htaccessinside/wp-content/upgrade/is deleted by the unpatched updater, andwp core updatein WP-CLI uses that same updater. Picus. 4 November brief. - Plex Media Server (Plex2Shell-CVE-2026-96652): QNAP says a NAS running Plex 1.43.2 or earlier that was reachable from the internet should be treated as potentially compromised. Install 1.43.3.10861 or later from App Center, then clean-reinstall and reset credentials. QTS and QuTS hero are not themselves affected. QNAP FAQ. 21 October brief.
- European refrigeration (Refrigeration-Controllers-EU-2026-11): CISA, FBI, HHS, USDA, and the Department of Transportation issued a 5 November sheet. It names authentication bypass, code injection, and weak configuration, and it names no CVE, vendor, or actor. Remove controller panels from the public internet. CISA fact sheet. 2 November brief.
- Retired from watch: ConnectWise Cloud Backup (ConnectWise-CloudBackup-SkyKick-2026-10) (last update 2026-10-23). The 4 November Trust Center update is restoration status and adds no new IOC. 22 October brief.
- Watching (no change): KEV overdue: Ivanti Connect Secure CVE-2026-111357 (1 November); SharePoint ToolShell CVE-2025-53770 (Storm2603-ToolShell-Fileless-2026-11, 5 November); Siemens Software Center (Siemens-Software-Center-CVE-2026-110936, 21 October).
- Watching (no change): KEV overdue: BeyondTrust Remote Support CVE-2026-102764 (1 November, retire-eligible 2026-11-08); GitLab CVE-2026-97229 (2 November); Cisco ASA/FTD CVE-2026-76418 (2 November, retire-eligible 2026-11-08).
- Watching (no change): KEV overdue: Ruby Onigmo regex engine for GitLab CVE-2026-97229 (Ruby-Onigmo-2026-10-23, 2 November, retire-eligible 2026-11-08).
- Watching (no change): KEV overdue: PHP core CVE-2026-109618 and CVE-2026-109619 (PHP2Shell-CVE-2026-109618, 2 November); Linux kernel Fragnesia CVE-2026-46300 (CVE-2026-46300, 29 October, retire-eligible 2026-11-07).
- Watching (no change): KEV due: Apple CVE-2024-27834 (Apple-CVE-2024-27834-2026-11, 5 November, due 2026-11-18); Ivanti CVE-2026-118527 (1 November, due 2026-11-13).
- Watching (no change): KEV due: VMware ESX CVE-2026-41709 (29 October, due 2026-11-11); Brotli CVE-2026-111497 (28 October, due 2026-11-10); Adobe Commerce CVE-2026-48356 (28 October, due 2026-11-10).
- Watching (no change): Zyxel GS1900 CVE-2026-107441 (Zyxel-GS1900-CVE-2026-107441, 5 November); GitLab CVE-2026-110264 (2 November); ARTEX (ARTEX-Software-Vendors-2026-11, 3 November).
- Watching (no change): Synology DSM CVE-2024-10441, CVE-2024-50629, and CVE-2024-10445 (Cerber-Synology-DSM-2026-10, 2 November); Canonical LXD (CVE-2026-112816, 1 November); Binance (Binance-TraderTraitor-2026-11, 4 November).
- Watching (no change): LiteLLM (LiteLLM-1.107.0-2026-10, 22 October, stale-eligible 2026-11-07); eMudhra CVE-2026-111943 and CVE-2026-91403 (eMudhra-CVE-2026-111943, 27 October); Tailscale SSH (Tailworm-Tailscale-SSH-2026-10, 28 October).
- Watching (no change): Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10, 31 October); XCPE Android TV boxes (XCPE-Botnet-2026-11, 3 November); WinRAR Gorbag (Gorbag-WinRAR-CVE-2025-8088-2026-11, 3 November).