cybr.cx Daily Digest — November 10, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-123158 | OpenSSH (Linux) | CVSS: N/A
An authentication bypass vulnerability in OpenSSH on Linux is being actively exploited in the wild and is on CISA's KEV list with a remediation deadline of November 12. An unexpected status code or return value condition allows attackers to bypass SSH authentication entirely — the blast radius on this one is enormous given how ubiquitous OpenSSH is across Linux infrastructure. Patch or restrict access immediately; this is your top priority today.

⚠️ Actively exploited — CVE-2026-102895 | GPUStack | CVSS: N/A
GPUStack contains an improper authentication flaw allowing unauthenticated administrative access — attackers can create persistent admin API keys, modify users and models, exfiltrate cloud-provider secrets, and execute arbitrary code via POST /v2/inference-backends/. With AI inference infrastructure proliferating rapidly, this is a high-value target for supply chain and data theft operations. CISA's remediation deadline is November 12 — isolate or take GPUStack instances offline if patching isn't immediately possible.

⚠️ Actively exploited — CVE-2026-116779 | SignalWire FreeSwitch | CVSS: N/A
A code injection vulnerability in FreeSwitch enables configuration and credential disclosure, arbitrary call control, and remote command execution. Telco and VoIP infrastructure running FreeSwitch is at active risk; credential exfiltration from compromised nodes could pivot into broader network access. Remediate before November 12 per CISA guidance.

⚠️ Actively exploited — CVE-2026-123218 | IBM Aspera Faspex | CVSS: N/A
An incorrect authorisation flaw in IBM Aspera Faspex allows an authenticated user to craft a specially formed message that bypasses authorisation and escalates privileges. Aspera Faspex is widely deployed for large-file transfer in media, finance, and healthcare — a compromised instance is a direct route to sensitive data in transit. CISA deadline is November 12.

⚠️ Actively exploited — CVE-2026-19868 | SonicWall SonicOS SSLVPN | CVSS: N/A
SonicWall's SSLVPN implementation allows users with valid credentials for an alternate authentication method to bypass SAML controls, including SAML-enforced MFA. Network perimeter integrity is directly at stake — VPN bypass is a proven initial-access vector for ransomware groups. CISA deadline is November 20; don't wait.

⚠️ Actively exploited — CVE-2026-119977 | WordPress Core | CVSS: N/A
A TOCTOU race condition during WordPress core upgrades allows unauthenticated attackers to execute code on the server via predictable, web-accessible staging paths. The upgrade window is the attack window — any organisation running auto-updates on public-facing WordPress sites is exposed during that brief interval. Already past CISA's remediation deadline; treat as urgent.

⚠️ Actively exploited — CVE-2024-27834 | Apple iOS, iPadOS, macOS, Safari, tvOS, watchOS | CVSS: N/A
An improper authentication flaw across the Apple ecosystem allows attackers with arbitrary read/write capability to bypass pointer authentication (PAC), a core memory exploit mitigation. While gaining initial arbitrary read/write is a prerequisite, PAC bypass significantly elevates the impact of other vulnerabilities chained together. Apply Apple security updates if you haven't already.

CVE-2026-16283 | Osbil Technology OPanel | CVSS: 8.8 (HIGH)
An OS command injection vulnerability in OPanel (versions before 1.20.66) allows attackers to execute arbitrary system commands through the web interface. If your hosting environment uses OPanel as a control panel, assume exposure until patched — OS command injection at this severity is frequently a one-shot root compromise.

CVE-2026-12977 | WildFly Core | CVSS: 8.8 (HIGH)
Deployment-operation handlers in WildFly Core lack proper sensitivity classification, allowing a restricted "Maintainer"-role admin to read sensitive configuration files and extract credentials sufficient for full SuperUser takeover. This is a privilege escalation path that sidesteps the principle of least privilege in a popular Java application server framework — review role assignments now.

CVE-2026-19706 | OpenShift Bootstrap (OKD/RHCOS) | CVSS: 8.3 (HIGH)
During OpenShift ABI bootstrap, the approve-csr.service blindly signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file, extract a kubeconfig, submit a CSR for CN=system:admin, and obtain a signed certificate granting full cluster-admin access. The window is narrow but the outcome is total cluster compromise — ensure bootstrap networks are isolated.

CVE-2026-119610 | GStreamer gst-plugins-good (H.264 RTP) | CVSS: 8.2 (HIGH)
A signed/unsigned integer conversion error in the H.264 RTP depayloader causes a length counter to underflow when processing truncated MTAP16/MTAP24 packets, leading to a heap out-of-bounds write. A remote, unauthenticated attacker can trigger this by sending malicious RTP streams — relevant to any application using GStreamer for media streaming or conferencing.

CVE-2026-125203 | FFmpeg < 8.1.3 / 9.x < 9.0.2 | CVSS: 7.8 (HIGH)
FFmpeg's Cook multichannel decoder fails to verify that subpacket channel masks are disjoint, allowing a crafted RealMedia Cook stream to cause heap buffer overflows. Any application decoding untrusted media via FFmpeg is exposed; update to 8.1.3 or 9.0.2 immediately.

Headline News

Claude Code's "Don't Ask Again" Feature Leaking Developer Secrets at Scale

A permission-suppression feature in Anthropic's Claude Code AI coding assistant has been found to silently expose developer credentials to the tool's context in ways that weren't transparent to users. Researchers identified 2,539 exposed credentials stemming from the behaviour, which appears to occur when users instruct the tool not to prompt for certain confirmations — inadvertently allowing sensitive values from configuration files, environment variables, and dotfiles to flow into AI context without explicit user awareness. The scale of exposure (nearly 2,500 credentials from what was presumably a limited research sample) suggests the real-world impact across the broader Claude Code user base could be significantly larger. Anthropic is investigating fixes, but practitioners integrating AI coding assistants into their workflows should audit what filesystem access these tools have, what secrets exist in working directories, and whether credential scanning is in place on any repositories or logs that capture AI session outputs.

Researchers Weaponise PwnEscape Linux Flaw into Firecracker VM Breakout

Security researchers have demonstrated a full container-to-host escape by chaining a Linux kernel vulnerability dubbed PwnEscape into a working breakout from AWS Firecracker microVMs — the isolation technology underpinning Lambda and Fargate. The significance here isn't just another container escape; it's a direct demonstration that defence-in-depth sandboxing in serverless and microVM environments can be undermined by host kernel bugs, collapsing the assumed security boundary between tenant workloads and the underlying host. For cloud providers and enterprises running Firecracker-based workloads, this is a reminder that the hypervisor-alternative model inherits the attack surface of the host kernel. Blue teams should track Linux kernel patch cycles as a first-class security dependency, not just an operational hygiene item.

LNbits Orders Lightning Network Wallet Servers Taken Offline After Attack Wave

LNbits, an open-source Lightning Network wallet server used by Bitcoin developers and merchants, instructed all operators on November 8 to immediately shut down their self-hosted instances following a wave of active attacks against the platform. The hosted service at my.lnbits.com was also suspended, with the project team indicating security patches are in development. While the specific vulnerability being exploited has not been publicly detailed, the incident highlights the operational risk of self-hosted financial infrastructure where patch cadence is entirely owner-dependent and attack consequences are direct monetary loss. Any organisation or individual running LNbits nodes — particularly those handling real funds — should treat the shutdown advisory as mandatory until patches are released and validated.

Schrödinger's Feed

IonQ and Classiq have published a detailed architectural analysis of fault-tolerant quantum computing that challenges a long-held assumption: minimising non-Clifford (T) gates is no longer the dominant performance factor in fault-tolerant systems. As magic state distillation and preparation techniques have matured, routing overhead, Clifford gate counts, and qubit memory retention have emerged as the new bottlenecks in physical spacetime volume calculations. This reframes how post-quantum cryptography timelines should be assessed — hardware improvements are compounding in unexpected ways, and the "fault-tolerant quantum computer capable of breaking RSA-2048" milestone may be approaching along different engineering paths than the community anticipated. Cryptography practitioners building PQC migration roadmaps should factor in that the threat model is evolving faster than the consensus view.

/dev/random

Canada quietly launched its Real-Time Rail (RTR) payment system, bringing 24/7 instant payment infrastructure to the national economy — and the security community immediately started asking the obvious question: what's the attack surface on a brand-new, always-on payment rail with no legacy hardening and a very large target painted on it? Real-time gross settlement systems are historically attractive targets precisely because transactions are irrevocable and instant, meaning the fraud-recovery window collapses to approximately zero. The good news is that Canada has had years of watching other nations' RTR launches to learn from; the less good news is that "we learned from others' mistakes" has never once stopped financial infrastructure from having its own novel ones. Expect a flurry of security assessments, red team engagements, and at least one very interesting incident report in the next 18 months.