OpenSSH password bypass moves into active weekend exploitationExploited SonicWall flaw can bypass SAML-enforced MFAChainalysis restoration does not close the credential incidentWorkOS incident turns AI-agent containment into a control-plane decision
Monday flagship · Weekend decision brief
OpenSSH password bypass moves into active weekend exploitation
Sunday honeypot evidence showed exploit-shaped traffic against the musl-specific OpenSSH authentication bypass, making exposure discovery and compromise hunting Monday’s first decision.
Security.io Intelligence Desk · Monday, 9 November 2026
Executive consequence
CVE-2026-123158 permits password authentication bypass on specific musl-based OpenSSH configurations. SANS ISC reported rising exploit attempts through the weekend, including 713 long-password requests on Friday.
Decision today
Inventory internet-reachable musl-based hosts and appliances running sshd.
Read the full decision briefPrimary reporting: Alpine Linux · OpenSSH Project · SANS Internet Storm Center · Wakefield
Decision intelligence, not a headline feed.Every edition ranks what security leaders should read first, assign today and monitor next.
Daily executive briefing
Security.io Daily Headlines
Five equally weighted stories: what happened and the leadership decision each creates.
CVE-2026-19868 lets a holder of valid alternate-method credentials bypass SAML controls, including SAML-enforced MFA, on affected SonicOS SSL VPN deployments. CISA confirmed exploitation through KEV; SonicWall supplied fixed builds and no workaround.
Do today
Inventory every internet-reachable SonicOS Gen 7 and Gen 8 appliance.
Chainalysis restored Reactor, KYT and Address Screening after an incident exposing password hashes and live tokens for all users. Customers must complete password resets, API-key rotation and trusted-IP controls, while pressing the vendor to reconcile inconsistent public token language.
Do today
Reset every Chainalysis user password through the verified login route.
WorkOS attributed an internal-tool breach to a researcher's ARTEX agent and published detailed network indicators. The confirmed root cause was conventional: public exposure, a weak development credential, no throttling and delayed detection.
Do today
Suspend agent evaluations with unrestricted internet egress.
Doctor Anywhere and Adept Health disclosed unauthorised access affecting personal data used for corporate benefits. HSBC Life identified possible identity, banking, policy and claims fields. The intrusion window, affected count, entry method and indicators remain unpublished.
Do today
Identify employees and dependants enrolled through Adept Health or Doctor Anywhere.
