VulnerabilitiesExploitedCVE-2026-123158CVSS 8.14 min read
Attackers are using a password authentication bypass in OpenSSH on musl-based Linux to log into accounts whose password field is set to an asterisk, then hunting for keys, hashes and cloud metadata.
VulnerabilitiesExploitedCVE-2026-123158CVSS 8.12 min read
WatchTowr and Previdian say attackers are hitting the recently patched OpenSSH flaw; so far the traffic looks like botnets and crypto miners.
VulnerabilitiesBrief2 min read
A jitterentropy health test run in FIPS mode during early boot intermittently fails on certain AMD EPYC processors, and the kernel panics instead of starting.
ResearchBrief2 min read
OpenAI says the model beats GPT-5.6 Cyber at exploitation while staying in scope more reliably, and reports 304 critical issues to maintainers with proposed fixes.
VulnerabilitiesExploitedCVE-2026-123158CVSS 8.12 min read
Previdian says attackers went after the musl-without-PAM password bypass quickly, and one honeypot gave up root. The bug only bites a narrow set of builds.
ResearchBrief1 min read
OpenAI says the model is its first rated "Critical" for cyber capability under its Preparedness Framework, and it isn't publicly available yet.
VulnerabilitiesExploitedCVE-2026-123158CVSS 8.12 min read
On Alpine and other musl libc builds with PAM disabled, some accounts accept any password between 257 and 1,024 characters. Fixes are in OpenSSH 10.6p2.
VulnerabilitiesBrief2 min read
The bug only hits OpenSSH built against musl, which covers Alpine Linux, OpenWRT, BuildRoot and Yocto. Patches went out a day after the report.
Threat intelBrief2 min read
XLab found a fake updater script that swaps the legitimate cwpsrv binary for a malicious one, then waits for an encrypted HTTP header before running anything.
VulnerabilitiesBrief1 min read
A password of 257 to 1,024 bytes gets past SSH authentication on some Alpine servers running the standard openssh-server package, including accounts with no password set.
ResearchBrief2 min read
An unreleased OpenAI cyber model ran an autonomous pipeline against the kernel's master branch and produced working local privilege escalation exploits, at a cost of $1.2 million in API credits.
VulnerabilitiesCVE-2016-6210CVSS 5.92 min read
A researcher says the bug has been in OpenSSH since 2016 and only bites on musl-based systems with password auth on and PAM off. It's fixed in OpenSSH 10.6p2.
