AltTabDaily posts tagged Vulnerabilities, newest first.
Alpine Linux warned Nov 5 that openssh-server built without PAM can accept a very long password for key-only accounts (CVE-2026-123158). Update openssh, restart sshd, or set PasswordAuthentication no.
OpenAI introduced GPT-6 Cyber on Nov 5 for authorized vulnerability research. It scores 48.5% on ExploitGym (up from 32.1%), is rated Critical under OpenAI's Preparedness Framework, and starts on Daybreak Red for approved customers.
OpenAI says an autonomous cyber pipeline reproduced 1,724 Linux kernel bugs and built working local privilege-escalation exploits for 948 of them in one mid-October run, at about $1.2 million in API cost.
Google says device maker Videostrong built the XCPE backdoor into more than 1.3 million Android TV boxes. Who's affected, how to check your box in a few minutes, and what to do if it matches.
Synology says C3RB3R ransomware is hitting NAS boxes running outdated DSM. Who's affected, how to check your DSM version in a minute, and why the fix is the latest DSM build for your version line.
An upgrade-window race bug in WordPress core (CVE-2026-119977) affects versions 4.7 through 7.1.3 and is drawing attack attempts. It's fixed in WordPress 7.1.4 and backport releases. How to check your version and what to do now.
A remote use-after-free in Linux's IPv4 TCP code (CVE-2026-98432) dates back to kernel 4.4. Debian, SUSE, Oracle and some Amazon Linux kernels are fixed; Ubuntu and RHEL fixes were still in progress on Oct 31, 2026. How to check your kernel and what to do now.
CISA added the Brotli decoder bug CVE-2026-111497 (Node2Shell / Broccoli2Shell / HTTP2Shell) to its Known Exploited Vulnerabilities catalog on 27 Oct 2026, with a 10 Nov federal due date. Run node --version and upgrade to 22.23.4, 24.22.1 or 26.12.1 or later.
Anthropic's Frontier Red Team says an internal Claude model found and chained critical bugs into five attacks, including one-click Chrome code execution and zero-click Linux root. Google's Chrome 156 (27 Oct 2026) ships 52 security fixes, several credited to Anthropic and Claude.
On 26 Oct 2026 CISA added CVE-2026-109618 and CVE-2026-109619 (php2shell) to the Known Exploited Vulnerabilities Catalog with a 29 Oct due date for FCEB agencies. Honeypot evidence from 24 Oct showed working shells on unpatched PHP 8.4.26 under Apache mod_php.
An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 4.0 9.2 from the CNA) can be triggered by crafted compressed data. Fixed Brotli, Node.js, Bun, Envoy, Istio and Python releases shipped 21–23 Oct 2026.
Unauthenticated RCE fixed in PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. CISA urges immediate patching; Cloudflare WAF is mitigation only. Monday checklist for IT/ops.
