U51

Episodes

Episode 23

All episodes
Episode 2314:59

Episode 23: OpenSSH sshole on Alpine, US industrial refrigeration warning and GhostMap Android, 7 November 2026

SpotifyApple PodcastsPocket Casts

OpenSSH has a password bypass dubbed *sshole on musl-based Linux without PAM, including Alpine cloud images, fixed in OpenSSH 10.6p2. US agencies issued a joint warning on ongoing cyber attacks against industrial refrigeration and cold-chain controllers. Bitdefender detailed GhostMap, an Android install-time flaw that can force a persistent boot loop, while Amadeus booking-display data exposure hit several Asian airlines and Zyxel patched a GS1900 zero-day used against nearly 1,000 switches.

Australian focus

  • US industrial refrigeration and cold-chain warning (joint fact sheet, 5 November 2026; iTnews 6 November). CISA, FBI, HHS, USDA and DOT urge operators to harden industrial refrigeration and cold-chain monitoring after ongoing targeting of unpatched or internet-accessible electronic temperature and commercial refrigeration controllers in retail grocery and cold storage. Possible impacts include changed temperature, fire hazards, inventory loss, shortened equipment life and reduced temperature visibility. Mitigations: remove from the public internet, change defaults, patch, retire unsupported legacy. Brief context only: prior European supermarket waves and France EFS blood-storage incident covered in Episodes 19 and 21; US military-base grocery fridge malfunctions under investigation. iTnews; CISA news; CISA fact sheet; BleepingComputer
  • *Alpine / sshole relevance for Australian container and cloud operators. Same CVE as Global threats lead; Alpine cloud images with passwordless default alpine user are the priority. Many Alpine containers don't run sshd. iTnews

Global threats

  • *OpenSSH sshole password bypass (CVE-2026-123158, CVSS 8.1). On musl-based distributions without PAM (Alpine OpenSSH default), passwordless accounts (hash field *) accept any password of 257 to 1024 characters because musl's hash of long passwords returns *. Requires the name of a passwordless account plus at least one account with a real password on the machine. Alpine cloud images: official images 3.18.11 to 3.24.3 safe on first boot per Detectify/Alpine; become exploitable once any account gets a real password; cloud-init configured images not affected. Default alpine user is passwordless and can become root. Root passwordless since about Alpine 3.16, but OpenSSH defaults refuse root password login. Immediate mitigation: PasswordAuthentication=no or disable SSH (Damien Miller). Fixed: OpenSSH 10.6p2 (restart sshd). Alpine has patched packages for every branch back to 3.16. Also Buildroot/Yocto; OpenWrt if OpenSSH replaced Dropbear. Discovered with AI agent swarms building sshd across glibc/musl and PAM/no-PAM combinations (~17,600 unusual logins). iTnews; OpenSSH release notes 10.6p2
  • GhostMap Android (Bitdefender Labs, 5 November 2026). Specially crafted APK with no permissions and no need to launch maps a file into unallocated memory, causing SIGBUS and a system_server crash loop. Safe Mode also fails. Recovery: factory reset, or ADB delete if USB debugging was already enabled. Google: first report (20 Aug) closed Won't Fix / Not Reproducible; second report (25 Aug, with working PoC) outside the scope of a security update, forwarded to a product/feature team for possible future version. Reproduced on Pixel 10, Android 17, 5 August 2026 patch; crash about 1 second after install. Affects Android 10 and above per Bitdefender. Persistent boot-loop technique not observed in the wild. BleepingComputer; Bitdefender Labs
  • Amadeus IT Group booking-display vulnerability affecting Asian airlines (reported 4 November 2026). Vulnerability in a travel booking display environment; Amadeus says no evidence payment or financial data was accessed, not ransomware, fixed with enhanced monitoring. Airlines' own systems not breached. Japan Airlines ~92,000; Singapore Airlines ~46,000; Cathay Pacific ~53,000 (names, booking references, flight details; some passports/travel documents, frequent-flyer numbers, email). Also Korean Air, Asiana, Malaysia Airlines. Singapore Airlines says it will contact passengers with upcoming flights to change exposed booking references. The Record
  • Norad (Norwegian Agency for Development Cooperation) Grants Portal cyberattack. Discovered 30 October 2026; attackers abused 27 user accounts. May have accessed names and emails of all 20,614 registered users across 12,511 organisations. Information related to grant applications from at least 3 organisations compromised; more possible. Portal closed. Notified Datatilsynet, NSM and police. NSM: shares characteristics with other recent attacks; perpetrators unknown. Concern for applicants in conflict zones or authoritarian states. Norad
  • Zyxel GS1900 CVE-2026-107441 (advisory ~3 November 2026). Unauthenticated out-of-bounds write in web CGI allows OS command execution via crafted HTTP. GreyNoise / Kapibala (linked Red Heron): ~996 devices across 48 countries; configs, hashed root credentials and network info stolen. Initially misattributed to CVE-2026-7273 (patched June 2026); Binarly found a separate zero-day that worked on firmware patched for the older CVE. Zyxel confirmed 11 October; firmware 22 October. Affected models and fixed firmware (2.90 Patch 3 line): GS1900-8 → 2.90(AAHH.3)C0; GS1900-8HP → 2.90(AAHI.3)C0; GS1900-10HP → 2.90(AAZI.3)C0; GS1900-16 → 2.90(AAHJ.3)C0; GS1900-24 → 2.90(AAHL.3)C0; GS1900-24E → 2.90(AAHK.3)C0; GS1900-24EP → 2.90(ABTO.3)C0; GS1900-24HPv2 → 2.90(ABTP.3)C0; GS1900-48 → 2.90(AAHN.3)C0; GS1900-48HPv2 → 2.90(ABTQ.3)C0. Affected: listed 2.90(.2)C0 and earlier builds per model. BleepingComputer; Zyxel advisory

AI security

  • *sshole discovery framing. Researcher-directed AI agent swarms as defensive discovery tooling (combinatorial sshd builds and unusual login tests), not a model acting independently. Damien Miller: OpenSSH rushed 10.6p2 because of rapid bug rediscovery by AI agents, sometimes within hours; long embargoes considered dangerous. OpenSSH 10.6p2 notes: AI-found bugs independently rediscovered, so more frequent releases. Light continuity with Episode 22 OpenAI defensive pipeline; bridge to Sunday Special.

Industry developments

  • Amadeus supply-chain / shared booking-display exposure. See Global threats; airlines emphasise their own systems were not breached.
  • US regulators checking bank systems after Binance theft (iTnews, 6 November). Supervisory follow-on; technical theft details already covered Episode 18.
  • Queens Public Library (New York) ransomware. Website, PCs, checkout, Wi-Fi, app and digital media disrupted; 66 locations remain open (The Register via CISO Series, 6 November).

Late item

  • *sshole exploited in the wild (Help Net Security / Previdian, 6 November 2026). First attempt less than nine hours after CVE publication; confirmed successful root access on a Previdian honeypot running real Alpine Linux and OpenSSH. Source IP 89.116.89[.]18 (Japan-based per Previdian) used oversized passwords, then id/uname/hostname via non-interactive SSH. Eight attempts from that single address on one sensor so far. Previdian put it on its own known-exploited list; CISA has not added it to KEV. Proof-of-concept code on GitHub noted as unverified. Help Net Security

Outlook and patch priorities

  • Critical: OpenSSH 10.6p2 (or Alpine patched packages back to 3.16) plus sshd restart, or PasswordAuthentication=no, on musl without PAM (active exploitation confirmed in honeypots); Zyxel GS1900 2.90 Patch 3 builds above; industrial refrigeration and cold-chain controllers off the public internet.
  • High: WordPress core 7.1.4 (CVE-2026-119977 TOCTOU RCE during upgrade window; CISA KEV; already covered Episode 21); refuse untrusted APKs while GhostMap has no Google security fix; Amadeus-affected airline customers watch for phishing quoting real bookings.
  • KEV reminder: CVE-2026-119977 (WordPress), added ~3 to 4 November 2026. BleepingComputer