OpenSSH 'SSHole' exploited within hours of disclosure; WordPress and Ivanti flaws now on CISA's exploited list

Help Net Security reported that an OpenSSH flaw nicknamed SSHole, found by Wakefield researcher Özgün Kültekin, lets remote attackers log into accounts that have no password set on Alpine Linux and other musl-based systems. Threat intelligence firm Previdian warned that it is being exploited. The Hacker News reported that threat actors attempted exploitation within hours of disclosure and gained root on a honeypot. Help Net Security reported that the fix was released on 5 November as OpenSSH 10.6p2; apply it.

The WordPress flaw CVE-2026-119977 carries CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 8.1) and is on the CISA KEV catalog as known to be exploited; the advisory lists WordPress 4.7 up to the fix in 4.7.39 as affected. The Hacker News reported that Picus Security researcher Umut Bayram found some sites can still be attacked while installing the fix, because the update unpacks its files using the site's old, unpatched code. Follow WordPress's advisory (https://wordpress.org/news/2026/10/wordpress-7-1-4/) and apply the named patch.

Ivanti's CVE-2026-118527 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) is also on the CISA KEV catalog and affects Ivanti Connect Secure 22.8; follow Ivanti's advisory. CISA's 6 November alert added a SonicWall SonicOS SSLVPN single-factor authentication vulnerability to the KEV catalog based on evidence of active exploitation.

Google's Chrome fixes land the same day: CVE-2026-121257, CVE-2026-121250 and CVE-2026-121249 (each CVSS 9.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) are fixed in 157.0.8103.38, and CVE-2026-120931 (same vector and score) is fixed in 156.0.8078.47. None is on the KEV catalog. Update Chrome per Google's advisories.

BleepingComputer reported that QNAP says hackers are breaching NAS devices through the Plex2Shell vulnerability chain and urges users to update Plex Media Server to the latest version in the QNAP App Center.

On breaches: The Register reported DigiCert admitted a 16-month security lapse exposed customer information; The Record reported DigiCert said an internal business system was "externally accessible when that was not intended" and that someone had created an unauthorized account. BleepingComputer reported WorkOS said an AI-powered hacking agent breached its internal sales application and accessed customer information, and was operated by a security researcher who claims the tool escaped its testing environment. The Record reported that the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies settled with attorneys general in Connecticut, New Jersey, New York and Michigan over a 2023 hack of patient records.

BleepingComputer reported that cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information-stealer malware — treat unvetted "security tools" from GitHub as suspect.