{
  "id": 19297978,
  "title": "CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws",
  "url": "https://urgent.news/2026/11/10/cisa-warns-of-active-exploitation-of-openssh-gpustack-freeswitch-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-10T06:31:42.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html"
  },
  "original_language": "en",
  "account": "On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) included four vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. These flaws affect GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. The KEV catalog addition follows reports of exploitation attempts since November 6, 2026, with 22 attempts recorded from 14 IP addresses. Defused Cyber observed a limited number of actors targeting the SSHole flaw, but emphasized the activity is not widespread. GreyNoise recorded the first exploitation attempt against its honeypot network on November 7, 2026, at 12:46 a.m. UTC. Post-exploitation activity has been detected from six source IP addresses, involving seven distinct attack chains, including reconnaissance, cloud metadata service queries, password hash and root SSH key reading, and modification of the SSH authorized_keys file. TAC Agent, a Python-based command-and-control (C2) agent, has been deployed, enabling shell command execution, system reconnaissance, directory enumeration, file transfer, and updates. The OpenSSH flaw is reportedly being used in botnet and cryptocurrency mining activities. GPUStack's maintainers credited multiple researchers for independently reporting the flaw, noting active exploitation by Ulex Innovative Systems Javier Sixto. No additional information is publicly available on the exploitation methods, perpetrators, or scale of the efforts. FCEB agencies are advised to apply the fixes by November 12, 2026.",
  "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}