This week in security: OpenSSH, Zyxel and Apple exploited flaws
This week in security was dominated by exploited flaws in widely deployed infrastructure: an OpenSSH authentication bypass on musl-based Linux, a Zyxel switch zero-day that bypasses an earlier patch, and an Apple pointer authentication bypass added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. CISA added four vulnerabilities to KEV, and two of their remediation deadlines are the first week of November.
Top stories
- OpenSSH CVE-2026-123158 auth bypass on Alpine Linux exploited: it lets attackers log in to passwordless accounts on musl-based Linux such as Alpine, exploitation is reported, and the fix is OpenSSH 10.6p2.
- Zyxel GS1900 switch zero-day CVE-2026-107441: switches fixed for CVE-2026-7273 stayed exploitable, so check firmware, move to 2.90 Patch 3 and review management access.
- Apple CVE-2024-27834 pointer authentication bypass: CISA added it to KEV after reported exploitation; check iOS, macOS and Safari versions before the November 18 deadline.
- WordPress Core RCE flaw CVE-2026-119977: CISA says this upgrade-window remote code execution bug is exploited, with a 6 Nov deadline.
- Cisco Secure Email Gateway SQL injection (CVE-2026-76461): it gives unauthenticated root access and is in CISA KEV, so review affected AsyncOS versions and fixes.
- Chrome 156 fixes WebRTC, V8 and SVG flaws (CVE-2026-118328): five input validation flaws were fixed, two of them scored 9.6; check your Edge build for the matching Chromium fixes as well.
- Zero Trust Basics: Principles, Pillars and a Practical Start: an explainer on how NIST and CISA frame zero trust and a realistic way to begin.
Newly exploited vulnerabilities
These entries were added to the CISA KEV catalog this week.
| CVE | Vendor and product | Issue | CISA due date |
|---|---|---|---|
| CVE-2024-27834 | Apple Multiple Products | Improper authentication | 2026-11-18 |
| CVE-2026-119977 | WordPress Core | Time-of-check Time-of-use race condition | 2026-11-06 |
| CVE-2026-118527 | Ivanti Connect Secure | Generation of predictable numbers or identifiers | 2026-11-13 |
| CVE-2026-111357 | Ivanti Connect Secure | Missing authentication for a critical function | 2026-11-02 |
What to prioritise next week
Start with systems that are exposed to the internet and already known to be exploited.
- Anything on the KEV list first. The WordPress Core and Ivanti Connect Secure deadlines fall on or before 13 November, and the 2 November Ivanti date has already passed; confirm those systems are fixed or mitigated.
- Check Linux images for OpenSSH CVE-2026-123158. Inventory musl-based systems such as Alpine, upgrade to 10.6p2, and look for passwordless accounts.
- Audit Zyxel GS1900 switches. A June patch was not enough, so verify firmware and restrict who can reach management interfaces.
- Plan Apple updates before 18 November. Check iOS, macOS and Safari versions across managed devices.
- Update browsers. Roll out the latest Chrome 156 build to all managed endpoints and confirm Edge has picked up the matching Chromium fixes.
This prioritisation is our analysis: internet-facing systems with confirmed exploitation and an approaching CISA deadline should be handled in hours, not at the next maintenance window.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- OpenSSH CVE-2026-123158 auth bypass on Alpine Linux exploited
- Zyxel GS1900 switch zero-day CVE-2026-107441
- Apple CVE-2024-27834 pointer authentication bypass