At The Edge Clear: November 2 – 9, 2026
Summary: Adversaries exploited a new OpenSSH authentication bypass on GreyNoise sensors roughly 40 hours after its fix, and GreyNoise captured them adding SSH keys and staging a remote control implant. Over the November 2–9, 2026 analysis period, three hosting ranges sent nine in ten Sophos Firewall exploitation attempts on a known exploited flaw (up about half, with the same client fingerprint), Cisco SSL VPN credential attempts rose about a third for the third straight week, and on a single day 16 or 17 malicious IPs attempted each of five ASUS RT-AX55 command injection flaws.
Bottom line: Exploitation came about 40 hours after the OpenSSH fix, and blocking last week's hosts would miss more than half of the VPN password-guessing attempts - the attackers rotated to new infrastructure while the old blocklists stayed in place.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026