CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
Summary: CISA added four flaws affecting GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation. For CVE-2026-123158, 22 exploitation attempts from 14 unique IP addresses were recorded since November 6, 2026, with post-exploitation activity from six source IP addresses across 18 distinct attack chains involving cloud metadata queries, attempts to read password hashes and root SSH keys, and edits to the authorized_keys file for persistence.
What you should know: An unknown actor dubbed GT10 has already deployed TAC Agent, a Python-based command-and-control agent, in at least one case, and watchTowr observed the OpenSSH flaw weaponized for botnet and cryptocurrency miner activity - while federal civilian agencies have until November 12, 2026 to apply fixes.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-102895CVE-2026-123158
- Related
- CISA Adds Four Known Exploited Vulnerabilities to Catalog Cyber Risks · Nov 09, 2026Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th) Cyber Risks · Nov 12, 2026CVE-2026-123158: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability Known Exploited Vulnerabilities · Nov 09, 2026