THE CYBERSECURITY BRIEFING
Daily reporting. Deeper analysis. Follow the evidence behind the headlines.
HIGHLIGHT OF THE DAY
Cybersecurity · In depth· 5 min read
OpenSSH’s November 5 fix addresses an authentication bypass affecting particular musl-based Linux configurations, including Alpine systems. Administrators need to check account settings, install corrected packages and restart sshd. The disclosures do not establish a widespread exploitation campaign.
Cybersecurity
AT A GLANCE
CISA, the FBI, HHS, USDA and DOT say malicious actors are targeting industrial refrigeration and cold-chain monitoring systems globally, including controllers at grocery and cold-storage facilities. The agencies warn attackers may exploit unpatched or internet-accessible devices to change settings, disrupt temperature visibility, spoil inventory or create equipment hazards, and urge operators to secure remote access and update systems.
Why it matters For food and medicine operators, controller compromise can become a product-safety incident, not merely an IT outage: unsafe storage may harm consumers even if products remain available for sale or use.
What to watch next The agencies call for immediate removal of internet-exposed controller interfaces, with updated firewalls or edge devices protecting remote access where it remains necessary.
HelpNet Security ↗OpenSSH 10.6p2, released November 5, fixes a critical password-authentication bypass affecting systems running sshd on musl-based Linux with PAM disabled, according to Check Point. The report says an attacker who can reach SSH may log in without a password; Check Point’s testing adds that exploitation requires another active account with a real password.
What changed OpenSSH 10.6p2, released November 5, provides a fix for the password bypass in affected configurations.
Why it matters Administrators of musl-based Linux SSH servers with PAM disabled cannot rely on password secrecy to prevent login on affected systems. Check Point’s second-account requirement narrows, but does not eliminate, that exposure.
Checkpoint Blog ↗Binarly found that Zyxel GS1900 switches remained vulnerable to an exploit reportedly used in the wild, despite receiving a patch for a different flaw. The report distinguishes the patched CVE-2026-7273 from CVE-2026-107441, which it says the exploit actually relies on.
What changed The earlier patch addressed CVE-2026-7273; Binarly’s finding shows that the reported exploit instead depends on CVE-2026-107441, leaving patched switches exposed.
LESS NOISE. MORE CONTEXT.
Why it matters GS1900 operators cannot treat installation of the CVE-2026-7273 patch as protection against the reported exploit; the vulnerable path it uses remained open.
Fortra researchers identified phishing sites imitating rental platforms with copied property listings, reservation details and urgent prompts to verify bookings or risk cancellation. In one case, a live support chat reassured visitors about a credit-card form; Fortra warns information submitted to fraudulent pages could enable identity theft, follow-on phishing or account takeover.
Why it matters For travelers who reuse passwords, a fake booking login can expose accounts beyond the rental service; the risk is not confined to the reservation or payment.
HelpNet Security ↗BlueFlag Security’s report says 99% of repository-access tokens it measured had no expiration date; 84% allowed code changes, and 47% had gone unused for more than 90 days without revocation. It also found unapproved AI coding agents in 83% of organizations measured and says agents may inherit powerful developer or service-account permissions; the reported access patterns indicate risk but do not by themselves establish compromise.
Why it matters For organizations in the dataset, obsolete integrations may leave a lasting route to copy or alter code: many repository tokens remain valid after use stops, while most permit code changes.
HelpNet Security ↗CISA, the Australian Signals Directorate’s Australian Cyber Security Centre and the NSA issued joint guidance and a quick-reference list to help organizations assess vendors’ readiness for post-quantum cryptography. The guidance recommends structured engagement to understand vendors’ awareness of quantum-related risks, visibility into cryptographic implementations, and ability to support a secure and timely transition.
Why it matters Organizations with long-lived industrial or IoT equipment may need vendor support or replacement hardware to migrate cryptography, making post-quantum readiness a lifecycle and supplier dependency rather than solely an internal software task.
What to watch next The guidance recommends structured vendor engagement to establish whether suppliers understand quantum risks, disclose their cryptographic implementations and can support the transition; it does not announce a migration deadline.
US Certs Alerts ↗