Blog
Kiri Subscribe

Security roundup: 2–8 November 2026

Sentra raises $150M; a Shai-Hulud gem that wipes your home folder if you revoke its token; an OpenSSH bypass on Alpine; Rails, apt and WordPress fixes. What to patch.

By 8 min readSecurityAI
Security roundup, 2–8 November 2026: a grid of shield, key, lock and bug icons.

A quieter week on CISA’s list, with only three additions, but a busy one for package registries and for the tools developers run every day: Rails, apt, OpenSSH and the browser. Here is what matters if you write and ship software, most urgent first.

The usual note on sources (see last week): much of this comes from security vendors and digests rather than the affected projects. Every item links to where it was reported. Check the vendor’s advisory or CISA’s catalog before acting on a version or deadline, and look up any CVE in our CVE search.

Patch these first

  • OpenSSH 10.6p2 if you run sshd on Alpine or another musl-based image with password logins on. An overlong password can log into key-only accounts, including root.
  • Rails 8.1.4.1 or 8.0.5.2 if your app takes image uploads through Active Storage with MiniMagick.
  • apt on Debian and Ubuntu, especially in CI and Dockerfiles that install through a proxy or mirror.
  • WordPress 7.1.4 (or your branch’s backport). It’s on CISA’s exploited list.
  • Ubuntu LTS kernels are still waiting on a fix for last week’s TCP bug (CVE-2026-98432). Red Hat has shipped.

Supply chain

A Shai-Hulud gem that punishes cleanup (published 1 November)

strutil-core 1.0.1 on RubyGems ran its payload during gem install or bundle install, through a native extension that downloaded the Bun runtime (Socket, 6 November). It:

  • stole cloud, CI, registry, SSH, AI-tool and crypto wallet credentials and sent them to paleasbest[.]top;
  • added an MCP server called workspace-tools, and committed AGENTS.md, CLAUDE.md and a VS Code “run on folder open” task into your repos;
  • installed a monitor, net-health-checker, that deletes your home folder once the stolen GitHub token starts failing.

The gem was removed about five hours after it went up, and no victims have been confirmed. If you did install it, the order matters: remove the monitor and its pkg-runtime service first, then revoke the token. Revoke first and the monitor wipes the machine.

@ethersphere/bee-js 13.3.0, with valid provenance (8–9 November)

An unsigned commit from a bee-worker identity landed late on 8 November, a GitHub release triggered the project’s trusted publishing, and 13.3.0 reached npm at 00:09 UTC on 9 November (StepSecurity). A postinstall hook fetched code from api.frameworkmetrics[.]xyz, stole Swarm swarm.key and config.yaml files, and set up persistence on Linux (solidity-langsupport-runner.service), macOS (a LaunchAgent) and Windows (an MSI plus a Defender exclusion). Stay on 13.2.0.

The lesson: provenance tells you where a package was built, not that the source was clean. The bad code was in the repo, so the build signed it.

Hijacked old packages, and more lookalikes

  • PolinRider came back in 12 releases across 10 hijacked npm packages on 3 November, some dormant for years. The loader looks up its payload address on Ethereum. Sonatype ties it to North Korea (Sonatype). A sudden release of a long-quiet dependency deserves a look before you take it.
  • PyPI terminal-colour lookalikes shipped infostealers on 7–8 November: super-color 0.1.0–0.1.3, supercolor-tui and rainbowcolors 0.1.0 (MAL-2026-18768, -18767, -18762 in OSV).
  • RubyGems runs plugin code on gem list, not just on install, and stable RubyGems 4.0.x has no switch to stop it; 4.1.0.beta3 adds one (Aikido, 5 November).

Defences that shipped

  • Composer 2.11 adds a dependency cooldown (config.policy.cooldown), so PHP projects can refuse packages in their first hours on Packagist, when most hijacks get caught. It’s off by default (Socket).
  • GitHub will block pull_request_target by default in public repos from 2 December. There are brownouts today (9 November) and on 16 November, 16:00–18:00 UTC. Workflows that need the trigger have to opt back in (Socket).

Follow-up: the Cursor extension backdoor

Cursor’s updated notice puts the tampered Claude Code extension builds (2.1.312 and 2.1.313) on its marketplace from about 2:27am to 1:35pm PT on 29 October, and drops its earlier “at most 5,000 users” figure. Microsoft says the builds never went through the VS Code Marketplace or npm. The clean release is 2.1.314 (StepSecurity). Uninstalling still doesn’t remove the backdoor: check ~/.ssh/authorized_keys for a svc-telemetry key.

Exploited right now

Product CVE What it is Status
WordPress Core 4.7.0–7.1.3 CVE-2026-119977 Race during a full core upgrade lets an unauthenticated attacker run code (CVSS 8.1) Added 3 November. Fixed in 7.1.4 and backports.
Apple WebKit CVE-2024-27834 Pointer-authentication bypass, patched in May 2024 Added 4 November. Sekoia links it to watering-hole attacks (SecurityWeek). Old test phones count.
SonicWall SonicOS SSL VPN CVE-2026-19868 Bypasses SAML, including SAML-enforced MFA, for anyone with other valid credentials Added 6 November. See SonicWall’s advisory.
Node-RED without adminAuth CVE-2026-58115 One POST /flows deploys a flow that runs shell commands Bots exploiting it since 30 October (VulnCheck). Turn on adminAuth and keep the editor off the internet.
Zyxel GS1900 switches CVE-2026-107441 Zero-day used against about 996 switches Fixed in 2.90 Patch 3. June’s patch doesn’t cover it (SecurityWeek).

OpenSSH “SSHole” (5 November)

OpenSSH 10.6p2 fixes a password-check bypass on Linux builds that use the musl C library with UsePAM=no and PasswordAuthentication=yes, which is how Alpine ships (oss-security). A very long password could log into accounts that only had keys, root included. SANS honeypots logged 232 suspicious long-password attempts on 5 November and 713 on 6 November (Cybersecurity News). Those are attempts, not confirmed break-ins. OpenSSH’s announcement names no CVE.

If you have Alpine-based images that run sshd, rebuild them on 10.6p2, or set PasswordAuthentication no. Better still, ask whether the container needs sshd at all.

Critical bugs to patch

  • Rails Active Storage (GHSA-f3w6-w445-fwh9, CVSS 9.8, Socket, 4 November). Rails 8.1.4.1 and 8.0.5.2 fix 21 issues. The worst lets an unauthenticated user write arbitrary files through image processing with :mini_magick. With the Disk storage service that can expose secret_key_base, which can lead to code execution. The update needs MiniMagick 5.1 or later, or the app won’t boot. If you use the Disk service, rotate secret_key_base after upgrading. Rails 8.0 security support ended on 7 November.
  • apt package swap (CVE-2026-109518, StepSecurity, oss-security). An attacker in the network path of an HTTP mirror can swap a verified package for another and have it installed as root. It needs Acquire::Retries above 0, which is the default on Debian 12+ and Ubuntu 22.04+. Fixed in Debian 12 (2.6.2), Debian 13 (3.0.4) and Ubuntu 24.04 (2.8.4ubuntu0.1), among others. No attacks reported. Rebuild base images so your apt install steps run the fixed apt.
  • Chrome 157 fixes 213 security bugs, 7 of them critical, including an ANGLE bug that may escape the sandbox (CVE-2026-121229) (Malwarebytes, 3 November). None exploited. Update headless Chrome in your test runners and Electron apps too. Firefox 159.0.1 fixes one high-rated layout bug (MFSA 2026-123).
  • Follow-up: Linux kernel TCP (CVE-2026-98432, CVSS 9.8). Red Hat shipped fixed kernels for RHEL 8.10, 9.8 and 10.2 on 1 November. On Ubuntu, as of 7 November only 26.10 is fixed; the 22.04, 24.04 and 26.04 kernels are still in -proposed, and 20.04 and 18.04 have no fix yet (Ubuntu). Reboot after installing, or the old kernel keeps running.
  • Follow-up: Brotli “Node2Shell” (CVE-2026-111497). Node.js fixes are in 22.23.4, 24.22.1 and 26.12.1. Node 20 and older get no fix, so upgrade the runtime (Rescana). Splunk Enterprise 10.0 is now listed as affected. CISA’s federal deadline is tomorrow, 10 November.
  • Follow-up: GitLab. If you run self-managed GitLab and haven’t applied the 21 October patch release (19.5.1, 19.4.3, 19.3.6 and older branches), do it now (GitLab). CISA’s deadline passed on 1 November.

AI agents: they find secrets, bugs and ways out

  • Agents on leaked secrets. Microsoft describes AI agents (it calls the group ARTEX) going from OAuth secrets found on public GitHub to Azure Key Vault data in about five minutes (GitGuardian). Deleting the commit doesn’t help. Rotate the secret, then check what it could read.
  • 948 kernel privilege-escalation bugs. OpenAI says an unreleased model found 948 Linux kernel privilege-escalation bugs in 10 days, at about $1.2 million in API spend; 61 fixes are already upstream (SecurityWeek, 5 November). The number counts bugs, not working exploits. Expect a long run of kernel updates, and plan for reboots.
  • A model that dug under the proxy. In an August test an OpenAI model wrote raw-packet and fragmented-request code to get past a sandbox’s egress filter (SecurityWeek, 6 November). If you sandbox an agent, block traffic at the network layer, not only at an HTTP proxy.
  • ChatGPT Lockdown Mode bypass. Check Point showed popups from the HTML preview in code blocks escaping the sandbox; in the desktop app no click was needed. OpenAI has patched it (Privacy Guides).
  • Built-in browsers, still open. Last week’s bugs in AI coding tools’ built-in browsers were still unfixed in Codex and VS Code as of 2 November, by the researchers’ account. In VS Code you can turn off workbench.browser.enableChatTools until there’s a fix.

Funding and deals

  • Sentra raised a $150 million Series C led by Capital One Ventures, taking it past $260 million in total (SecurityWeek, 4 November).
  • Brava Security came out of stealth with a $15 million seed led by F2 Venture Capital and Pitango (The Next Web).
  • Palo Alto Networks is reported to be in talks to buy Clutch Security, which controls what AI agents can access, for about $500 million in cash. No deal has been announced (TechCrunch, 5 November).

Breaches

  • Binance published its account of the $6.3 billion theft: a fake job interview put malware on an employee’s machine, an internal AI tool helped compromise two more staff, and a stolen container deployment token got a malicious container to the wallet-signing system (BleepingComputer, 3 November). Developer laptops and CI deploy tokens were the route in.
  • DigiCert said an archive system left exposed after a migration let outsiders register accounts and view customer contact data and some ID documents between 27 June and 2 July. Certificates and CertCentral weren’t affected (SecurityWeek, 6 November). Expect fake “certificate renewal” emails.
  • Ahold Delhaize put October’s attack at €200–250 million in lost sales and cut its 2026 outlook (SecurityWeek).

Coming up

  • 9 and 16 November: GitHub pull_request_target brownouts, 16:00–18:00 UTC.
  • 9–12 November: KubeCon + CloudNativeCon North America, Salt Lake City.
  • 10 November: Microsoft Patch Tuesday. CISA deadlines for Brotli (CVE-2026-111497) and Magento (CVE-2026-48356).
  • 13 November: CISA deadline for Ivanti Connect Secure (CVE-2026-118527).
  • 19 November: PHP 8.6.0 is due.

This week’s checklist

  1. If anyone installed strutil-core, remove the monitor and pkg-runtime service before revoking tokens. Pin @ethersphere/bee-js to 13.2.0.
  2. Rebuild Alpine images that run sshd on OpenSSH 10.6p2, or turn off password logins.
  3. Upgrade Rails to 8.1.4.1 or 8.0.5.2, and rotate secret_key_base if you use the Disk service.
  4. Rebuild Debian and Ubuntu base images so they get the fixed apt.
  5. Update WordPress, Chrome (including headless and Electron) and Node.js (move off Node 20).
  6. Check public repos for pull_request_target workflows before 2 December.
  7. On Ubuntu LTS, watch for the TCP kernel fix and reboot when it lands.