1. Top Action Item

Patch OpenSSH now. A flaw tracked as CVE-2026-123158 (codename "SSHole," CVSS 8.1) lets attackers sign in to accounts that have no password set — including key-only accounts — on Linux systems running OpenSSH on the musl C library with PAM disabled; researchers observed exploitation attempts within hours of disclosure and one attacker gained root on a honeypot. OpenSSH rated the flaw critical and released version 10.6p2, and Alpine Linux has published fixed packages. Upgrade every affected SSH server (and rebuild containers/immutable images that bake in the old package) today — public proof-of-concept exploitation is already underway.

2. Exploited This Week

OpenSSH (musl/Alpine Linux deployments) — CVE-2026-123158 ("SSHole")

• Source: The Hacker News
• Link: thehackernews.com · fix details
• Severity: CVSS 8.1 (Previdian); OpenSSH rates the flaw Critical
• What's happening: Threat actors began attempting exploitation within hours of disclosure, using an overlong password (257–1,024 bytes) to authenticate to accounts with no password set and gain access — in one honeypot case, root.
• Fix: Upgrade to OpenSSH 10.6p2, or apply the fixed Alpine openssh-server packages. Requires network reachability to the SSH service plus a valid account name.

WordPress — actively exploited flaw (CVE not given in source)

• Source: The Hacker News
• Link: thehackernews.com
• Severity: see source
• What's happening: An actively exploited flaw remains risky during remediation: the update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker striking at the right moment can execute code on the server.
• Fix: Apply the vendor update, but follow researcher Umut Bayram's (Picus Security) guidance to block web access to the relevant path while installing — see source for the exact directory.

3. Critical Patch Roundup

Microsoft — Windows Paint

• Source: The Hacker News (plus Microsoft MSRC update guide)
• Link: thehackernews.com · msrc.microsoft.com
• Severity: see source (Microsoft rates — see source)
• What's happening: CVE-2026-83844 is a remote code execution flaw (out-of-bounds read) that could let an attacker run code over a network. The fix does not ship through Windows Update.
• Fix: Update Paint via the Microsoft Store to build 11.2609.401.0 or later. Standard patch-management tooling will miss this — push Store app updates separately.

Barracuda — Email Security Gateway

• Source: The Hacker News
• Link: thehackernews.com
• Severity: see source (unauthenticated root-level chain)
• What's happening: CVE-2026-116606 (authorization bypass) can be chained with a second flaw by an unauthenticated attacker to run commands as root on the appliance; watchTowr published the chain Thursday after Barracuda shipped patches Monday.
• Fix: Apply Barracuda's patches for both flaws immediately; restrict management access to the ESG while validating.

Ruby on Rails — Active Storage / ImageMagick integration

• Source: Dark Reading
• Link: darkreading.com
• Severity: Critical (per headline)
• What's happening: An attacker could write arbitrary files and read sensitive files via images uploaded through the Rails Active Storage ImageMagick integration, potentially enabling lateral movement.
• Fix: Apply the Rails security release; see source for affected versions.

Microsoft Edge (Chromium) — ingested Chromium fixes

• Source: Microsoft MSRC
• Link: msrc.microsoft.com
• Severity: see source
• What's happening: Edge has ingested multiple Chromium fixes this week — use-after-free, memory corruption, incorrect reference resolution, and improper input validation issues (e.g., CVE-2026-119260, CVE-2026-118321, CVE-2026-119263, CVE-2026-119261). MSRC defers scoring to Google Chrome Releases.
• Fix: Update Edge to the current stable build; the underlying Chromium fixes are documented at chromereleases.googleblog.com.

4. Home / SOHO Impact

• Update your browser today. Microsoft Edge has taken in a batch of Chromium memory-corruption and use-after-free fixes this week; restart the browser after updating so the new build actually loads.
• Update Paint — but through the Microsoft Store, not Windows Update. The fix for CVE-2026-83844 (Paint RCE) only arrives as Store app build 11.2609.401.0 or later. Open the Store app, check for updates, and confirm Paint's version.
• If you run a small Linux server or VPS on Alpine: update OpenSSH to 10.6p2 (or the fixed Alpine package) immediately. This one is being actively attacked, and accounts with SSH keys and no password are the target.
• Check what your AI coding assistant saved. Developer credentials typed into commands approved in Claude Code with "Yes, and don't ask again" were found stored verbatim in project settings files — 1,122 copies were public on GitHub. If you use Claude Code, check committed project settings files, remove any saved commands containing secrets, and rotate any keys or passwords that were exposed.
• Retire or isolate cheap Android set-top boxes and IoT gadgets. Google and partners disrupted a 1.3 million-device botnet built from infected set-top boxes and IoT devices; if you have a no-name streaming box, keep it on a guest network or replace it.
• Don't leave a WordPress site half-patched. Install updates promptly, and if you administer the site yourself, follow the researcher's advice to block web access during the install.

5. Enterprise Impact

• SSH fleet remediation is the priority. Inventory OpenSSH versions across Linux estates and container base images, prioritizing musl-based distributions (Alpine) with PAM disabled. Upgrade to 10.6p2 and rebuild golden images; containers running the vulnerable package inherit the flaw regardless of host patching. Hunt for authentication to accounts with no password set and for unusually long password fields (257–1,024 bytes) in SSH logs.
• Edge/Chromium is an enterprise browser problem too. Managed Edge deployments need the current stable build pushed; confirm update rings aren't holding back the Chromium fixes ingested this week.
• Windows app patching isn't covered by WSUS/Windows Update. CVE-2026-83844 in Paint is Store-delivered only. Add Microsoft Store app update management (or equivalent) to your patch process, or this class of fix will silently linger.
• Email security appliances are internet-facing root-risk targets. Patch Barracuda Email Security Gateway for CVE-2026-116606 and its companion flaw; a public attack chain for unauthenticated root access means assume scanning starts now. Restrict management interfaces and review appliance logs for unauthorized restore/configuration actions.
• Web application stacks: apply the critical Rails Active Storage/ImageMagick fix, and treat image-upload paths as untrusted input — arbitrary file write/read can set up lateral movement into the host.
• WordPress at scale: if you host many sites, sequence updates with a short window of blocked web access to the affected path, per the researcher's guidance, rather than updating live under load.
• Credential hygiene for AI tooling: audit developer repositories and project settings files for secrets captured by Claude Code's "Don't Ask Again" feature, and rotate anything found; block commits of those settings files via pre-commit hooks or secret scanning.
• OT/ICS exposure note: Unit 42's reporting on attacks against European refrigeration systems underscores that internet-exposed building/retail OT remains an attractive target — verify segmentation and remote-access paths for cold-chain and facilities equipment.

6. What To Patch First

1. OpenSSH 10.6p2 (Alpine openssh-server fixed packages) — CVE-2026-123158 — exploited in the wild within hours of disclosure, root access observed
2. WordPress — latest vendor update, installed with web access temporarily blocked — actively exploited
3. Barracuda Email Security Gateway — vendor patches for CVE-2026-116606 and chained flaw — unauthenticated root, public attack chain
4. Microsoft Paint — Store build 11.2609.401.0+ — CVE-2026-83844 — RCE on a default Windows app, not delivered by Windows Update
5. Ruby on Rails (Active Storage/ImageMagick) — vendor security release — critical, arbitrary file write/read
6. Microsoft Edge (Chromium) — current stable build — multiple memory-corruption/use-after-free fixes, widely deployed

Sources

• CVE-2026-83844 Windows Paint Remote Code Execution Vulnerability — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83844
• Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It — https://thehackernews.com/2026/11/microsoft-paint-rce-fix-now-available.html
• Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time — https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html
• Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot — https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html
• OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux — https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html
• Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login — https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html
• Critical Rails Bug Threatens to Derail Vulnerable Servers — https://www.darkreading.com/application-security/critical-rails-bug-derail-vulnerable-servers
• Chromium CVE-2026-119260: Use after free (Microsoft Edge advisory; see also companion Chromium CVEs in MSRC Update Guide) — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119260
• Claude Code's "Don't Ask Again" File Exposes Passwords and Keys in 1,122 Public Copies on GitHub — https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
• Google, Partners Disrupt 1.3 Million-Device-Strong XCPE Botnet — https://www.darkreading.com/endpoint-security/google-13-million-device-strong-xcpe-botnet
• Turning Up the Heat: Inside the Attacks on Europe's Refrigeration Systems — https://unit42.paloaltonetworks.com/europes-refrigeration-systems-attacks/