This edition opens with an OpenSSH flaw that lets an overly long password bypass login on musl Linux and an APT flaw in Ubuntu that lets an attacker on the network install packages as root. In addition, a trojanised Control Web Panel web server is spreading an invisible backdoor and DigiCert has leaked customers’ identity documents.
- OpenSSH warns of flaw that lets a long password bypass login on musl Linux
- Ubuntu fixes APT flaw: attacker on the network can get a malicious package installed as root
- CWPdoor: trojanised Control Web Panel web server contains invisible backdoor
- DigiCert leaks customer data and identity documents through exposed internal system
OpenSSH warns of flaw that lets a long password bypass login on musl Linux
| Vulnerability | Authentication bypass in sshd on Linux systems using musl libc (such as Alpine) without PAM. A password of 257 to 1,024 bytes allows a login to succeed on accounts without a password (field ‘*’). Fixed in OpenSSH 10.6p2 |
| CVE number | No CVE assigned yet |
| Actively exploited | No, no attacks had been reported at the time of publication on 5 November 2026 |
| Patch available | Yes, OpenSSH 10.6p2 and Alpine packages for all releases up to and including 3.16. Alternative: set PasswordAuthentication to ‘no’ and restart sshd |
How can the vulnerability be exploited?
The OpenSSH release notes describe a password authentication bypass in the portable release, reported by Özgün Kültekin of Wakefield. According to The Hacker News, the crypt() function on musl fails with passwords longer than 256 bytes and returns ‘*’. That matches the stored ‘*’ of accounts without a password, after which the login succeeds. A server is only vulnerable if four conditions apply simultaneously: sshd runs without PAM, PasswordAuthentication is set to ‘yes’ (the default), at least one account has ‘*’ as its password field and at least one other local account has a $5$ or $6$ hash. The issue does not affect glibc systems, PAM authentication or OpenWrt with Dropbear.
What could the impact be?
An attacker can log in to accounts intended for key-based authentication, such as root on Alpine. On Alpine cloud images, the ‘alpine’ account is affected, which has passwordless doas, putting full control within reach. The researcher also recommends checking OpenWrt, Buildroot and Yocto, as these often use musl. For MSPs, the main risk lies in customers’ containers, cloud images and embedded appliances.
What should IT administrators do now?
Update Alpine with apk upgrade -U -a and restart sshd with rc-service sshd restart, because updating the package alone leaves the running sshd vulnerable. If you cannot update immediately, disable PasswordAuthentication, check the configuration with sshd -t and restart sshd. First test that key-based login works and keep your current session open. Search /var/log/messages for ‘Accepted password for’ on accounts without a password. If a login cannot be ruled out, treat the machine as compromised.
Ubuntu fixes APT flaw: attacker on the network can get a malicious package installed as root
| Vulnerability | Bug in the HTTP backend of the APT library that causes a package to be installed even though the signature check fails. All APT frontends are affected. Ubuntu 22.04 LTS and later are vulnerable by default, older releases only if Acquire::Retries is set to a value above zero |
| CVE number | CVE-2026-109518 |
| CVSS score | 7.7 (CVSS 4.0, Ubuntu rating ‘High’) |
| Actively exploited | No, the sources do not mention any exploitation |
| Patch available | Yes, including apt 2.4.15ubuntu0.1 (22.04), 2.8.4ubuntu0.1 (24.04) and 3.2.1ubuntu0.1 (26.04). ESM is required for 14.04 up to and including 20.04 |
How can the vulnerability be exploited?
According to Ubuntu’s announcement, the flaw was reported by Max Justicz: an attacker who can manipulate HTTP traffic between APT and the archive server can replace a requested .deb file with a malicious one. A malicious mirror is also sufficient. Exploitation requires APT to retry a failed download. Snap installations and transports other than HTTP are not affected. Dutch security news site Security.nl also reports that Ubuntu has released updates and that Debian had already issued patches earlier.
What could the impact be?
Package installation scripts run as root, so a successful attack gives full control over the server or workstation. The risk lies mainly in untrusted networks, such as shared Wi-Fi, and with servers that update over HTTP via a proxy or a public mirror.
What should IT administrators do now?
Use apt list --installed '?source-package(^apt$)' to check whether the patched version is running. Ubuntu recommends running the update itself with sudo apt update && sudo apt upgrade -o Acquire::Retries=0, so that the retry behaviour cannot be exploited during the update. Where possible, switch archive sources from http:// to https://, then run apt update to see whether the mirror supports HTTPS. With unattended upgrades, enabled by default since Ubuntu 16.04, the fix will arrive automatically within about 24 hours.
CWPdoor: trojanised Control Web Panel web server contains invisible backdoor
| Vulnerability | ‘CWPdoor’ backdoor in a counterfeit version of cwpsrv, the web server of Control Web Panel (formerly CentOS Web Panel). A fake updater script replaces the genuine binary (versions 1.15.10 and 1.24.0) |
| CVE number | No CVE assigned |
| Actively exploited | Yes, XLab found the malware on 29 June 2026 and concludes that there are real victims; the scale is unknown |
| Patch available | No, this is not a software vulnerability. Restore a legitimate cwpsrv, update and rotate all panel credentials |
How has this been exploited?
XLab researchers found the malware on 29 June via a script posing as an updater, BleepingComputer reports. XLab’s research report states that the backdoor stays dormant until an attacker sends an HTTP request with three special headers, X-Ngx-Integrity-Data, -Time and -Sig. The signature is verified with RSA, and commands and output are encrypted with AES-256-CBC. The malware then wipes its tracks: file timestamps are restored, the command history disappears and the trigger request is removed from the access logs. On 30 September, an archive containing CWPdoor appeared on VirusTotal, together with the Ebury backdoor, without a single detection. The link with Ebury remains unclear.
What could the impact be?
An attacker can execute commands remotely on the hosting server while leaving virtually no trace in the logs. XLab observed more than 340,000 CWP instances on the internet over the past month. For MSPs and hosting providers managing CWP as an alternative to cPanel or Plesk, a single infected panel can affect the websites and mailboxes of all customers on that server.
What should IT administrators do now?
On CWP servers, look for the Unix socket ngx_http_integrity_helper, suspicious cwpsrv helper processes, the string ‘X-Ngx-Integrity’ in the server binary and files named cwpsrv.suspeito. If a server is infected, restore a legitimate binary, update CWP, rotate all panel passwords and credentials and examine the host for additional malware. Block access to the CWP management interface from the open internet.
DigiCert leaks customer data and identity documents through exposed internal system
| Vulnerability | During a server migration in February 2025, an internal DigiCert business system was exposed to the internet without a VPN. A self-registration feature and an authorisation flaw gave unauthorised accounts read access to archived customer data |
| CVE number | No CVE assigned |
| Actively exploited | Yes, an unauthorised account accessed customer data between 27 June and 2 July 2026; DigiCert confirmed this on 19 October 2026 |
| Patch available | No, this is a configuration error. DigiCert disabled self-registration and restricted access; affected customers have been receiving notifications since 5 November 2026 |
How has this been exploited?
According to BleepingComputer, the system had previously only been reachable via VPN. In June 2026, DigiCert spotted unauthorised accounts and applied fixes, but the incident was initially treated as an account issue rather than as data access. Only the investigation of 19 October revealed that archived data had been accessed. The incident is also covered in an incident report at Mozilla. According to Security.nl, the accounts did not have multi-factor authentication.
What could the impact be?
The data involved includes names, business email addresses, phone numbers and postal addresses, and for some customers copies of passports, driving licences or utility bills submitted for validation. The number of affected customers has not been disclosed. DigiCert says CertCentral and DigiCert ONE were not compromised, that login credentials and issued certificates remain secure and that the unauthorised account could not modify anything or issue certificates. The data could, however, be used for targeted phishing and identity fraud.
What should IT administrators do now?
Check whether your MSP or your customers request certificates from DigiCert and whether identity documents were submitted in the process. Watch for notifications from DigiCert in the contact person’s mailbox. Warn relevant colleagues and customers about phishing posing as DigiCert or a certificate renewal, and check that the MFA settings for your CertCentral accounts are in order.
This article was originally published in Dutch on MSP Business. Read the original →
