Security news.
Widespread active exploitation is taking center stage today, led by mass scans targeting the newly uncovered "SSHole" OpenSSH vulnerability and state-sponsored physical sabotage hitting retail supply chains. Defenders also face critical cloud and identity risks, highlighted by cross-tenant breaches via trusted AWS platform roles and malicious packages poisoning decentralized developer ecosystems.
Hackers Actively Exploit "SSHole" OpenSSH Vulnerability
Attackers and botnets are actively exploiting CVE-2026-123158, an OpenSSH flaw that allows unauthorized command execution, credential theft, and persistent access across Linux environments.
CISA Adds Four Actively Exploited Flaws to KEV Catalog
CISA has mandated federal remediation for four actively abused vulnerabilities, including OpenSSH flaw CVE-2026-123158, SignalWire FreeSwitch injection CVE-2026-116779, and GPUStack bug CVE-2026-102895.
France Blames Iranian State Hackers for Supermarket Sabotage and Fires
State-backed cyberattacks targeted industrial refrigeration systems across more than 700 French supermarkets, causing widespread food spoilage and triggering at least 15 physical fires.
Hackers Abuse Qubole AWS Platform Access to Breach Customer Clouds
Attackers compromised Qubole-managed trusted AWS credentials between October 14 and October 26, using them to access customer cloud accounts and steal stored data and secrets.
Malicious Ethersphere bee-js and Swarm Desktop Packages Steal Crypto Keys
Threat actors hijacked Ethersphere's automated release pipeline to distribute trojanized versions of bee-js (13.3.0) and Swarm Desktop (0.56.2) designed to exfiltrate node wallet keys and passwords.
Russian Cloud Provider Beget Wiped Clean in Destructive Malware Attack
Russian cloud host Beget is rebuilding its core infrastructure from scratch after a destructive data-wiping cyberattack completely crippled its platform.
LNbits Urges Immediate Shutdown of Bitcoin Lightning Wallet Servers
The open-source LNbits project warned administrators to take servers offline immediately amid active exploit campaigns draining Bitcoin balances ahead of incoming security fixes.
Iris Plaza Cloud Compromise Exposes Data of 7.7 Million Shoppers
Japanese retailer Iris Ohyama confirmed unauthorized access to an integrated third-party cloud service, potentially exposing sensitive personal information belonging to nearly 7.7 million customers.