My Next Class

Today: RootEvidence Cisco IOS vulnerability scans with HTTP opt-out headers; a critical OpenSSH password bypass on musl (sshole / CVE-2026-123158); a U.S. government factsheet on hardening industrial refrigeration OT; and an actively exploited Zyxel GS1900 out-of-bounds write (CVE-2026-107441).

RootEvidence Cisco IOS Scans / Opt-Out Headers
ISC honeypots saw Cisco IOS vulnerability scans from exposure-management firm RootEvidence. Unlike typical Internet-wide scanners, their HTTP requests include Opt-Out-Email and Opt-Out-Url headers so administrators can request exclusion.
https://isc.sans.edu/diary/Vulnerability%20Scans%20for%20Older%20Cisco%20IOS%20Vulnerability%20%20%20Opt-Out%20Headers/33492
https://www.rootevidence.com/scanners/

OpenSSH musl Password Bypass (sshole / CVE-2026-123158)
A critical password-authentication bypass affects OpenSSH on musl libc systems (Alpine Linux, OpenWrt, and similar) when sshd allows password logins without libpam. Passwords longer than 256 characters can authenticate accounts that have no password set (shadow field "*"). Details and walkthrough at sshhole.com; fixed in OpenSSH 10.6p2.
https://sshhole.com/
https://nvd.nist.gov/vuln/detail/CVE-2026-123158
https://www.openssh.org/txt/release-10.6p2
https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

Guidance to Secure Refrigeration / Cold-Chain Systems
U.S. government agencies published a joint factsheet urging owners of industrial refrigeration and cold-chain monitoring systems to harden them after grocery-store and military-base fridge attacks that spoiled large amounts of food. Advice is largely standard OT hygiene (reduce Internet exposure, isolate OT, credential security, patching) and applies beyond refrigeration.
https://www.cisa.gov/sites/default/files/2026-11/joint-factsheet-usg-partners-urge-hardening-industrial-refrigeration-cold-chain-monitoring-systems-508c.pdf

Zyxel GS1900 Out-of-Bounds Write Exploited (CVE-2026-107441)
Zyxel released firmware updates for GS1900 series switches fixing an out-of-bounds write that is being exploited in the wild. Binarly found a Python exploit in a malware repository; attacks steal configuration data including hashed passwords. The advisory says the attacker needs network access. Patch to 2.90 Patch 3 builds.
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
https://www.binarly.io/advisories/brly-2026-057
https://nvd.nist.gov/vuln/detail/CVE-2026-107441

SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Login here to join the discussion.