Daily Brief for Friday, November 6, 2026

Added to KEV

No additions

No additions to the catalog in this edition’s window.

Source: CISA’s Known Exploited Vulnerabilities catalog, version 2026.11.04

Vulnerabilities and patches

1 item

OpenSSH

Exploited

OpenSSH flaw lets attackers log in to musl Linux accounts with a long password

It needs an account with no password and another with a SHA-256 or SHA-512 hash, and OpenSSH 10.6p2 and Alpine Linux’s updated packages fix it.

Further readingWakefield research, further reading on OpenSSH flaw lets attackers log in to musl Linux accounts with a long password OpenSSH release notes, further reading on OpenSSH flaw lets attackers log in to musl Linux accounts with a long password Alpine Linux advisory, further reading on OpenSSH flaw lets attackers log in to musl Linux accounts with a long password

Breaches and campaigns

2 items

Attackers target cold storage controllers to alter temperatures, US agencies say

The fact sheet from CISA, the FBI and three other agencies names no vendor, flaw or indicator, and tells operators to take the controllers off the internet.

Further readingCISA guidance, further reading on Attackers target cold storage controllers to alter temperatures, US agencies say

Microsoft Azure, Entra ID and Microsoft 365

GitHub

Attackers’ AI agents use leaked app secrets to steal Azure data, Microsoft says

Microsoft lists four IP addresses and hunting queries, and saw one agent go from searching GitHub to taking Key Vault data in five minutes.

Further readingMicrosoft research, further reading on Attackers’ AI agents use leaked app secrets to steal Azure data, Microsoft says

Coming up

1 item

Ruby on Rails

Ruby on Rails 8.0 reaches end of support on Nov 7

The 8.0 series gets no more security fixes after that date, and the Rails maintenance policy lists 8.1 as getting them until Oct 10, 2027.

Further readingRuby on Rails support dates, further reading on Ruby on Rails 8.0 reaches end of support on Nov 7

Worth reading

2 items

CrowdStrike

CrowdStrike on how quickly public exploit code turns into attacks

Of flaws with public exploit code that CrowdStrike saw attacked from January to July, more than half were hit within a day of release, and 91% within 48 hours.

Read

Microsoft

Microsoft on how security exceptions let spoofed business-service email through

Microsoft saw about 129 million malicious messages spoofing business services like DocuSign from July to September, and many were delivered because tenant or user exceptions overrode its protections.