An OpenSSH password bypass, fridge-attack evidence and an AI bug hunt with 948 kernel finds
The TF cybercrime round-up for 06-08 November 2026 covers OpenSSH, fridge attacks and AI bug hunting. Attackers exploited the OpenSSH flaw within nine hours of its public listing.
What’s Happening & Why It Matters
OpenSSH “A$$hole” Bypass Affects Alpine, Musl Systems
OpenSSH fixed CVE-2026-123158 in version 10.6p2 on 05 November 2026. Researcher Özgün Kültekin nicknamed the flaw “sshole”. The CVSS score is 8.1, according to The Hacker News.
Two older behaviours combine to cause the bug. The musl C library returns “” when a password hash fails, and sshd reads “” as a passwordless account. An attacker sends a password of 257 to 1,024 bytes and logs in.
Linux systems on glibc, such as Debian, Ubuntu and Fedora, are unaffected. Systems using PAM for password checks are safe, as are Dropbear and OpenBSD. Alpine Linux’s default OpenSSH server is affected. Kültekin names OpenWrt, Buildroot and Yocto as additional risks.
Threat intelligence firm Previdian saw the first attack less than nine hours after the CVE listing. Eight attempts came from one Japan-based IP address, and one gained root on a honeypot. CISA has not added the flaw to its Known Exploited Vulnerabilities catalogue.
My take: Patching is half the job. Installing 10.6p2 does not restart the running daemon, so restart sshd, or set PasswordAuthentication to no until then.
Hackers Probed Europe’s Fridge Systems Before the Attacks
Lupovis recorded more than 276 attempts from 91 threat actors. The target was Danfoss refrigeration controllers, between about 20 and 30 October 2026. Activity peaked on 26 October. Fridge attacks followed on 2 and 3 November, as TF reported in the second wave of attacks.
Lupovis sensors outside Europe saw no such activity. The attackers used bulletproof hosting, which some Russian groups have used before. Many controllers were reachable from the internet with factory-default credentials.
Lupovis CEO Xavier Bellekens said the coordination points to a state actor, and Russia is a possibility. He added the server location does not prove the operators’ nationality. No group has claimed responsibility, and no ransom demand has appeared, according to The Grocer.
My take: Attribution is open. The proven weakness is default passwords on internet-facing controllers, and a VPN would have blocked much of the traffic.
OpenAI Agents Find 948 Kernel Flaws, and a Quantum Estimate Drops
OpenAI says an automated pipeline found 948 distinct privilege-escalation flaws in the Linux kernel. The campaign ran in mid-October 2026. The run cost $1.21 million in API credits (about €1.08 million), or $1,279 per flaw (about €1,138). OpenAI sent hundreds of reports and patches to maintainers through its Patch the Planet effort. The figures come from a company research post by OpenAI, and the model is unnamed.
French firm Alice & Bob estimates 22,593 cat qubits could break RSA-2048 in about 3.14 days. Its 2023 estimate was 49,649 qubits. The figure comes from a paper on the IACR ePrint archive and a company announcement. No machine of such size exists, and nobody has broken RSA-2048.
My take: One story shows defenders gaining speed, and the other shows a deadline for post-quantum migration. US and UK guidance targets 2035 for completion.
Huang and the Suspected Chinese Agent: Reports Stay Unproven
The New York Times reported on 29 October US suspicions about Alice Huang, a former Megaspeed executive. Officials suspect her of gathering intelligence for China. Megaspeed is a Singapore-based buyer of Nvidia chips. According to the Times, she met Nvidia CEO Jensen Huang several times. The Times adds he was never warned. PCMag’s version could not be read, so the summary draws on Fox Business coverage.
Nvidia called the meetings usual for a CEO and customer. China rejected the claims as smears. TF covered the original report and the congressional briefing request for 18 November.
My take: Officials doubted Huang knew of the activity, according to the Times. The report offers no public evidence he did.
EU Tells TikTok to Change Its “For You” Feed
The European Commission issued a preliminary finding on 06 November: the “For You” feed of TikTok breaches the Digital Services Act. Regulators cite a “rabbit holes” effect. Engagement with one topic triggers more of the same. Children and vulnerable users could see harmful posts on sadness, isolation or body image.
The Commission wants stated preferences to carry more weight, less reliance on viewing time, easier controls and regular algorithm tests. A preliminary finding is not a final decision, and Euronews reports no deadline or fine. TikTok rejected the findings and said they misrepresent how the platform works.
My take: Expect a negotiated redesign before any fine. The earlier findings on addictive design and children’s privacy raise the pressure.
TF Summary: What’s Next
Patch OpenSSH, restart sshd and audit Alpine containers within days. Operators of Danfoss controllers should remove internet exposure and change default credentials. TikTok can respond to the Commission before a final decision.
MY FORECAST: Researchers will publish more exploit code for the OpenSSH flaw before 30 November 2026. Investigators will tie the fridge attacks to a named group in 2027. Alice & Bob’s estimate will draw a peer-reviewed rebuttal.
Related Stories
- TF Cybercrime Round-up: 03-04 November 2026
- Hackers Target Supermarket Refrigeration in Europe: Second Wave
- Cooling Hacks Target French Blood Banks
- Was Jensen Huang a Chinese Espionage Target?
- Congress Asks Jensen Huang for a Closed-Door Briefing