Hacker News recap reports OpenSSH SSHole exploitation attempts

What happened

According to The Hacker News weekly recap dated November 9, 2026, threat actors are attempting to exploit a recently disclosed OpenSSH flaw, tracked as CVE-2026-123158 (CVSS 8.1) and codenamed SSHole. The Hacker News says it can enable sign-ins to accounts that have no password set. It reports that, as of November 9, 2026, 20 exploitation attempts were recorded from 13 unique IP addresses in Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland and the U.S. (The Hacker News). The recap does not say who recorded these attempts, and it does not name a fixed OpenSSH version. Both are not confirmed.

The same recap, according to The Hacker News, also covers these items. Each is the outlet’s account, not independently verified here:

• APT on Debian and Ubuntu: CVE-2026-109518 (CVSS 7.7). The Hacker News quotes an Amazon advisory saying that when APT uses HTTP package sources with retry settings enabled, a third party positioned between the host and the mirror can cause an unverified package to be installed, and its maintainer scripts then run with elevated privileges. A fixed version is not confirmed.
• Zyxel GS1900 switches: CVE-2026-107441 (CVSS 8.8), an out-of-bounds write flaw. The Hacker News reports Zyxel has fixed it and that the zero-day was exploited to compromise nearly 1,000 devices. It attributes the activity to a Chinese-speaking actor tracked as Kapibala (aka Red Heron). The fixed firmware version is not confirmed.
• CWPdoor: The Hacker News cites XLab as saying a trojanized cwpsrv, the Control Web Panel web server daemon, delivers a Linux backdoor called CWPdoor.
• cPGuard: The Hacker News cites OPSSHIELD as saying an attacker used compromised credentials on 2 November 2026 to reach its update distribution infrastructure and push a malicious script through the cPGuard update channel.
• mSecure: The Hacker News reports that mSecure told customers to change passwords and reset two-factor authentication. It says the company has not explained what the suspicious activity involved or whether customer data was accessed.

The recap’s trending CVE list also names Synology DSM and Rails. The official advisories for those two are summarised below. The recap headline also mentions robot takeovers and 15K hacked sites, but the text provided does not include those details, so they are not confirmed.

Official Synology advisory (Synology-SA-26:13, published 2026-09-18, severity Critical, status Resolved): CVE-2026-13684 and CVE-2026-13639 are each rated CVSS 9.8. Synology says they allow remote attackers to read or write arbitrary files and conduct denial-of-service attacks in DSM before the fixed releases (Synology). Synology lists no mitigation other than upgrading, and the advisory does not mention exploitation.

Official Rails advisory (published Nov 4, 2026, Critical, CVSS 9.8, CVE-2026-126082): GitHub’s rails/rails advisory says an application that processes attachments with ImageMagick may let an unauthenticated attacker write arbitrary files. When attachments use the Disk service, the attacker may also read arbitrary files readable by the application process (GitHub: rails/rails advisory). The advisory does not state that exploitation has occurred.

Am I affected?

• SSHole: The Hacker News says it affects Linux systems running OpenSSH on the musl C library with PAM disabled, including Alpine Linux’s default OpenSSH server configuration. Other configurations are not confirmed as affected (The Hacker News).
• APT: Debian and Ubuntu hosts using HTTP package sources with retry settings enabled, per The Hacker News quoting Amazon.
• Zyxel: GS1900 series switches, per The Hacker News.
• Synology DSM: Synology lists DSM 7.4, 7.3, 7.2.2 and 7.2.1 as affected, with fixes in 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12 (Synology).
• Rails: The GitHub advisory lists activestorage >= 8.1 and < 8.1.4.1, and < 8.0.5.2. An app must use ImageMagick for Active Storage image processing (config.active_storage.variant_processor = :mini_magick), run it under a policy that does not already deny the coders involved (the Debian and Ubuntu packaged policies do not), and accept uploads from untrusted users (GitHub: rails/rails advisory).

What to do now

1. Identify Linux hosts running OpenSSH on musl with PAM disabled, including Alpine defaults, and check for accounts with no password set. A fixed OpenSSH version is not confirmed in the sources, so consult your distribution or the OpenSSH project for the patch.
2. On Debian and Ubuntu, check whether APT is configured with HTTP sources and retry settings, per the condition quoted from Amazon. A fixed APT version is not confirmed in the sources, so consult your distribution’s security tracker.
3. Upgrade Synology DSM to 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12 or above, as listed by Synology.
4. For Rails, upgrade activestorage to 8.1.4.1 or 8.0.5.2. Apps using :mini_magick need mini_magick 5.1 or later. If you cannot upgrade at once, the advisory says to copy the shipped policy rules into ImageMagick’s system policy, denying at minimum the MSL coder, the Ghostscript coders and the gs delegate.
5. If Rails attachments use the Disk service, the advisory says to change secret_key_base and every secret readable by the application process, and not to keep an exposed secret as a fallback.
6. If you run Zyxel GS1900 switches, Control Web Panel or cPGuard, review the vendor notices cited in the recap. Fixed firmware versions and cleanup steps are not confirmed in the sources.

Sources

• The Hacker News: Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More
• Synology: Synology-SA-26:13 DSM security advisory
• GitHub: Possible arbitrary file write and read in Active Storage image analysis (rails/rails advisory)