~/radar / 2026-45
Patch radar, week 45/2026
The week from 2 November 2026 to 8 November 2026: what needs patching and what else mattered.
Check this week
- Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
- OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
- SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
- Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
- Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
- Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
- DreamHost confirms data breach exposed FTP logins and webmail sessions
- Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Security & patches
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
Applying the WordPress fix may still expose a site, as the installer unpacks files with the old, unpatched code. Site owners should block web access during the update and verify integrity afterward.
Source ↗OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits
OpenAI unveiled GPT‑6 Cyber, an AI model that discovers and patches vulnerabilities more effectively. Security and DevOps teams should evaluate its use for internal audits, while ensuring any findings are manually validated.
Source ↗SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall released patches for seven issues, including an SSL‑VPN MFA bypass currently exploited. Firewall operators must apply the updates immediately and verify MFA configurations.
Source ↗Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
The SSHole flaw lets attackers log in without a password on Linux systems running OpenSSH with musl and PAM disabled. Admins should verify PAM is enabled and apply the latest OpenSSH patches.
Source ↗Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers impersonate AI‑related events to phish Microsoft and Google credentials. Support staff should alert users, enforce MFA and filter suspicious invitations.
Source ↗Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
A now‑patched vulnerability allowed bypass of ChatGPT’s Lockdown Mode. Teams using AI automation should confirm the patch is applied and that the mode once again blocks silent data exfiltration.
Source ↗DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost disclosed a breach where attackers accessed its File Manager for two months, stealing FTP/SFTP usernames and passwords. Affected users must rotate credentials, enable MFA where possible and audit for unauthorized access.
Source ↗Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel released a patch for a zero‑day in GS1900 switches that was used to compromise ~1,000 devices and steal configs and credentials. Admins must apply the firmware update, rotate passwords and audit switch logs for suspicious access.
Source ↗WorkOS says attacker used ARTEX AI to breach internal sales app
WorkOS breach via ARTEX AI accessed sales contacts; teams using SAML/OIDC or internal apps must audit token issuance, enforce least‑privilege, and monitor AI‑driven abuse patterns.
Source ↗Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
cPGuard’s update mechanism was compromised, delivering a backdoor. Administrators must validate update signatures, revert to trusted versions, and scan systems for the implanted script.
Source ↗Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes
Chainstack’s breach exposed customer data and password hashes; teams managing S3‑compatible storage or blockchain nodes should audit access controls, rotate credentials, and review AI‑driven attack detection.
Source ↗Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google dismantled the XCPE botnet spanning >1.3 M Android TV boxes and blocked the manufacturer. TV‑box fleet managers should verify firmware integrity, apply updates, and quarantine compromised units.
Source ↗⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More
This week’s incidents underline that trivial mistakes—no passwords, fake support calls—can cause major breaches. Ensure basic hardening (strong passwords, MFA, up‑to‑date patches) for cloud and Linux services.
Source ↗Chinese hackers use ARTEX AI in automated attacks against 200 orgs
The open‑source ARTEX multi‑agent AI framework was leveraged by Chinese groups in attacks on 200+ organizations across 14 countries. Teams should monitor for AI‑driven scanning behavior and harden endpoints.
Source ↗Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
Missing authentication allows unauthenticated remote code execution on SIMATIC IoT2050 Advanced devices. Operators should verify patch status, apply updates, and isolate any vulnerable gateways.
Source ↗New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
The new Windows infostealer VOLTA harvests passwords, browser cookies, Outlook and Slack data, and uses an LLM to rank stolen info by monetization value. Security teams should tighten endpoint protection, enforce MFA and monitor for credential‑theft anomalies.
Source ↗Alpine Linux rebuilds GitLab after attempted RCE attack
Alpine Linux rebuilt its GitLab server and reset all passwords after an attempted exploit of a critical GitLab vulnerability. Teams using Alpine packages or GitLab should verify repository integrity, rotate credentials and enable log monitoring for suspicious activity.
Source ↗CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in LXD and MicroCloud lets an attacker log in as a trusted client using only the client’s public certificate and network access to the HTTPS API. Ops should restrict API exposure, rotate certificates and enforce strong client authentication.
Source ↗Other news
Claude Code's “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Claude Code’s “Don’t Ask Again” option saved commands with passwords and API keys into a project settings file that ended up public on GitHub. Developers need to scan repos for such files, rotate exposed secrets and disable the auto‑save feature.
Source ↗Nearly 1.5 million exposed secrets targeted in new revocation program
Truffle Security’s Secrets Revocation Program lets API‑key issuers revoke publicly exposed credentials. Cloud‑storage and identity admins should audit for leaked keys and revoke them promptly.
Source ↗OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
A critical flaw allowing key‑only accounts on Alpine Linux to be logged into with long passwords was fixed in OpenSSH 10.6p2. Operators must verify that the updated package is installed on all Alpine servers.
Source ↗mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity
mSecure users must rotate all stored passwords, disable existing 2FA tokens and remove passkeys. Support teams should inform customers, verify app integrity and monitor for further suspicious activity.
Source ↗OpenAI says it's doubling Pro usage limits and bringing Work features to Chat
OpenAI is doubling Pro usage limits and adding Work features directly into ChatGPT, merging allowances across ChatGPT and Codex. Users of AI automation should review their quotas, adjust budgeting and explore the new collaboration capabilities.
Source ↗New articles by e-mail
One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).
Selected automatically and commented with AI. Please report mistakes — I withdraw entries when needed.