{"id":243,"date":"2026-11-06T07:45:15","date_gmt":"2026-11-06T06:45:15","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/patchwork-friday-6-november\/"},"modified":"2026-11-06T07:46:37","modified_gmt":"2026-11-06T06:46:37","slug":"patchwork-friday-6-november","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/patchwork-friday-6-november\/","title":{"rendered":"Patchwork &#8211; Friday 6 November"},"content":{"rendered":"<p id=\"top\"><strong>This edition opens with an OpenSSH flaw that lets an overly long password bypass login on musl Linux and an APT flaw in Ubuntu that lets an attacker on the network install packages as root. In addition, a trojanised Control Web Panel web server is spreading an invisible backdoor and DigiCert has leaked customers&#8217; identity documents.<\/strong><\/p>\n<ul>\n<li><a href=\"#openssh\">OpenSSH warns of flaw that lets a long password bypass login on musl Linux<\/a><\/li>\n<li><a href=\"#apt\">Ubuntu fixes APT flaw: attacker on the network can get a malicious package installed as root<\/a><\/li>\n<li><a href=\"#cwpdoor\">CWPdoor: trojanised Control Web Panel web server contains invisible backdoor<\/a><\/li>\n<li><a href=\"#digicert\">DigiCert leaks customer data and identity documents through exposed internal system<\/a><\/li>\n<\/ul>\n<h4 id=\"openssh\">OpenSSH warns of flaw that lets a long password bypass login on musl Linux<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Authentication bypass in sshd on Linux systems using musl libc (such as Alpine) without PAM. A password of 257 to 1,024 bytes allows a login to succeed on accounts without a password (field &#8216;*&#8217;). Fixed in OpenSSH 10.6p2<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned yet<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, no attacks had been reported at the time of publication on 5 November 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, OpenSSH 10.6p2 and Alpine packages for all releases up to and including 3.16. Alternative: set PasswordAuthentication to &#8216;no&#8217; and restart sshd<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How can the vulnerability be exploited?<\/strong><\/p>\n<p>The <a href=\"https:\/\/www.openssh.org\/releasenotes.html\" target=\"_blank\" rel=\"noopener\">OpenSSH release notes<\/a> describe a password authentication bypass in the portable release, reported by \u00d6zg\u00fcn K\u00fcltekin of Wakefield. According to <a href=\"https:\/\/thehackernews.com\/2026\/11\/openssh-issues-emergency-fix-for-flaw.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, the crypt() function on musl fails with passwords longer than 256 bytes and returns &#8216;*&#8217;. That matches the stored &#8216;*&#8217; of accounts without a password, after which the login succeeds. A server is only vulnerable if four conditions apply simultaneously: sshd runs without PAM, PasswordAuthentication is set to &#8216;yes&#8217; (the default), at least one account has &#8216;*&#8217; as its password field and at least one other local account has a $5$ or $6$ hash. The issue does not affect glibc systems, PAM authentication or OpenWrt with Dropbear.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>An attacker can log in to accounts intended for key-based authentication, such as root on Alpine. On Alpine cloud images, the &#8216;alpine&#8217; account is affected, which has passwordless doas, putting full control within reach. The researcher also recommends checking OpenWrt, Buildroot and Yocto, as these often use musl. For MSPs, the main risk lies in customers&#8217; containers, cloud images and embedded appliances.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Update Alpine with <code>apk upgrade -U -a<\/code> and restart sshd with <code>rc-service sshd restart<\/code>, because updating the package alone leaves the running sshd vulnerable. If you cannot update immediately, disable PasswordAuthentication, check the configuration with <code>sshd -t<\/code> and restart sshd. First test that key-based login works and keep your current session open. Search \/var\/log\/messages for &#8216;Accepted password for&#8217; on accounts without a password. If a login cannot be ruled out, treat the machine as compromised.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"apt\">Ubuntu fixes APT flaw: attacker on the network can get a malicious package installed as root<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Bug in the HTTP backend of the APT library that causes a package to be installed even though the signature check fails. All APT frontends are affected. Ubuntu 22.04 LTS and later are vulnerable by default, older releases only if Acquire::Retries is set to a value above zero<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">CVE-2026-109518<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVSS score<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">7.7 (CVSS 4.0, Ubuntu rating &#8216;High&#8217;)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, the sources do not mention any exploitation<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, including apt 2.4.15ubuntu0.1 (22.04), 2.8.4ubuntu0.1 (24.04) and 3.2.1ubuntu0.1 (26.04). ESM is required for 14.04 up to and including 20.04<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How can the vulnerability be exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/ubuntu.com\/blog\/apt-vulnerability-fixes-available\" target=\"_blank\" rel=\"noopener\">Ubuntu&#8217;s announcement<\/a>, the flaw was reported by Max Justicz: an attacker who can manipulate HTTP traffic between APT and the archive server can replace a requested .deb file with a malicious one. A malicious mirror is also sufficient. Exploitation requires APT to retry a failed download. Snap installations and transports other than HTTP are not affected. Dutch security news site <a href=\"https:\/\/www.security.nl\/posting\/960531\/Ubuntu+dicht+APT-kwetsbaarheid+waardoor+aanvaller+root+kan+worden\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a> also reports that Ubuntu has released updates and that Debian had already issued patches earlier.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>Package installation scripts run as root, so a successful attack gives full control over the server or workstation. The risk lies mainly in untrusted networks, such as shared Wi-Fi, and with servers that update over HTTP via a proxy or a public mirror.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Use <code>apt list --installed '?source-package(^apt$)'<\/code> to check whether the patched version is running. Ubuntu recommends running the update itself with <code>sudo apt update &amp;&amp; sudo apt upgrade -o Acquire::Retries=0<\/code>, so that the retry behaviour cannot be exploited during the update. Where possible, switch archive sources from http:\/\/ to https:\/\/, then run <code>apt update<\/code> to see whether the mirror supports HTTPS. With unattended upgrades, enabled by default since Ubuntu 16.04, the fix will arrive automatically within about 24 hours.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"cwpdoor\">CWPdoor: trojanised Control Web Panel web server contains invisible backdoor<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">&#8216;CWPdoor&#8217; backdoor in a counterfeit version of cwpsrv, the web server of Control Web Panel (formerly CentOS Web Panel). A fake updater script replaces the genuine binary (versions 1.15.10 and 1.24.0)<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, XLab found the malware on 29 June 2026 and concludes that there are real victims; the scale is unknown<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, this is not a software vulnerability. Restore a legitimate cwpsrv, update and rotate all panel credentials<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>XLab researchers found the malware on 29 June via a script posing as an updater, <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server\/\" target=\"_blank\" rel=\"noopener\">BleepingComputer<\/a> reports. <a href=\"https:\/\/blog.xlab.qianxin.com\/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel\/\" target=\"_blank\" rel=\"noopener\">XLab&#8217;s research report<\/a> states that the backdoor stays dormant until an attacker sends an HTTP request with three special headers, X-Ngx-Integrity-Data, -Time and -Sig. The signature is verified with RSA, and commands and output are encrypted with AES-256-CBC. The malware then wipes its tracks: file timestamps are restored, the command history disappears and the trigger request is removed from the access logs. On 30 September, an archive containing CWPdoor appeared on VirusTotal, together with the Ebury backdoor, without a single detection. The link with Ebury remains unclear.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>An attacker can execute commands remotely on the hosting server while leaving virtually no trace in the logs. XLab observed more than 340,000 CWP instances on the internet over the past month. For MSPs and hosting providers managing CWP as an alternative to cPanel or Plesk, a single infected panel can affect the websites and mailboxes of all customers on that server.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>On CWP servers, look for the Unix socket <code>ngx_http_integrity_helper<\/code>, suspicious cwpsrv helper processes, the string &#8216;X-Ngx-Integrity&#8217; in the server binary and files named cwpsrv.suspeito. If a server is infected, restore a legitimate binary, update CWP, rotate all panel passwords and credentials and examine the host for additional malware. Block access to the CWP management interface from the open internet.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n<h4 id=\"digicert\">DigiCert leaks customer data and identity documents through exposed internal system<\/h4>\n<table style=\"border-collapse: collapse; width: 100%; margin: 0.5em 0 1em;\">\n<tbody>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Vulnerability<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">During a server migration in February 2025, an internal DigiCert business system was exposed to the internet without a VPN. A self-registration feature and an authorisation flaw gave unauthorised accounts read access to archived customer data<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">CVE number<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No CVE assigned<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Actively exploited<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">Yes, an unauthorised account accessed customer data between 27 June and 2 July 2026; DigiCert confirmed this on 19 October 2026<\/td>\n<\/tr>\n<tr>\n<td style=\"border: 1px solid #999; padding: 6px 10px; font-weight: 600; vertical-align: top; width: 160px;\">Patch available<\/td>\n<td style=\"border: 1px solid #999; padding: 6px 10px; vertical-align: top;\">No, this is a configuration error. DigiCert disabled self-registration and restricted access; affected customers have been receiving notifications since 5 November 2026<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>How has this been exploited?<\/strong><\/p>\n<p>According to <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/digicert-data-breach-exposes-customer-information-identity-documents\/\" target=\"_blank\" rel=\"noopener\">BleepingComputer<\/a>, the system had previously only been reachable via VPN. In June 2026, DigiCert spotted unauthorised accounts and applied fixes, but the incident was initially treated as an account issue rather than as data access. Only the investigation of 19 October revealed that archived data had been accessed. The incident is also covered in an <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=2084460#c2\" target=\"_blank\" rel=\"noopener\">incident report at Mozilla<\/a>. According to <a href=\"https:\/\/www.security.nl\/posting\/960537\/Certificaatautoriteit+DigiCert+lekt+id-bewijzen+en+gegevens+van+klanten\" target=\"_blank\" rel=\"noopener\">Security.nl<\/a>, the accounts did not have multi-factor authentication.<\/p>\n<p><strong>What could the impact be?<\/strong><\/p>\n<p>The data involved includes names, business email addresses, phone numbers and postal addresses, and for some customers copies of passports, driving licences or utility bills submitted for validation. The number of affected customers has not been disclosed. DigiCert says CertCentral and DigiCert ONE were not compromised, that login credentials and issued certificates remain secure and that the unauthorised account could not modify anything or issue certificates. The data could, however, be used for targeted phishing and identity fraud.<\/p>\n<p><strong>What should IT administrators do now?<\/strong><\/p>\n<p>Check whether your MSP or your customers request certificates from DigiCert and whether identity documents were submitted in the process. Watch for notifications from DigiCert in the contact person&#8217;s mailbox. Warn relevant colleagues and customers about phishing posing as DigiCert or a certificate renewal, and check that the MFA settings for your CertCentral accounts are in order.<\/p>\n<p><a href=\"#top\">top ^<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>An OpenSSH bypass on musl Linux, an APT flaw in Ubuntu, the CWPdoor backdoor in Control Web Panel and a DigiCert data breach exposing customer identity documents.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169581,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/patchwork-vrijdag-6-november\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/patchwork-freitag-6-november\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-R.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/09\/patchwork-R-400x225.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"OpenSSH, Ubuntu APT, CWPdoor and DigiCert: four security alerts from 6 November for MSPs, with explanations and what to do now.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-243","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=243"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/243\/revisions"}],"predecessor-version":[{"id":244,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/243\/revisions\/244"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=243"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}