A security-heavy week: remote bugs in two pieces of core plumbing (sshd on Alpine and APT on Debian/Ubuntu) lead the list, followed by a WordPress flaw that just landed on CISA’s exploited list and a big Home Assistant release.
Alpine: password authentication bypass in openssh-server (“sshole”)
Disclosed November 5. On Alpine’s sshd built without PAM, musl’s crypt() returns * for passwords longer than 256 bytes, and that matches any account whose shadow entry is * (which includes root in base images since roughly 3.16). It needs password authentication left on (the default) and at least one account with a $5$ or $6$ hash on the box. No CVE has been assigned yet. Fixed packages are out for edge (10.6_p2-r0) and 3.16 through 3.24 (3.24 gets 10.3_p1-r2), and the 3.21.10, 3.22.8, 3.23.8 and 3.24.4 point releases include them. Run apk upgrade -U -a and restart sshd, since the running daemon keeps the old binary. If you can’t patch right away, set PasswordAuthentication no. Worth a sweep of any Alpine-based LXC containers or VMs in your lab. Alpine advisory.
APT: on-path attacker can slip in an unverified package (CVE-2026-109518)
Ubuntu’s USN-8996-1 (November 4) fixes a bug in how APT handles hard links across HTTP redirects and download retries, which a man-in-the-middle could use to get an unverified package installed with root privileges. Fixed versions include 2.8.4ubuntu0.1 on 24.04 LTS and 3.2.1ubuntu0.1 on 26.04 LTS, and Debian has matching updates. Package signatures are the usual reason nobody worries about plain-HTTP mirrors, so this one undercuts a common assumption. Patch it on every Debian and Ubuntu host, Proxmox nodes included. USN-8996-1.
WordPress core flaw added to CISA’s exploited list (CVE-2026-119977)
CISA added the upgrade-process race condition fixed in WordPress 7.1.4 (released October 28) to its Known Exploited Vulnerabilities catalog on November 3. An unauthenticated attacker has to hit a staged PHP file in wp-content/upgrade/ during the few seconds a full core update is being unpacked, so the request never passes through WordPress or any firewall plugin running inside it. WordPress rates it low, while the CVE record scores it 8.1. Make sure you’re on 7.1.4 or your branch’s backport. Denying web access to wp-content/upgrade/ in your nginx config is a cheap extra layer on top of the update. WebHosting.Today, WordPress 7.1.4 release post.
Stable kernels 7.3.3 and 6.18.62 fix three Xen use-after-free bugs
On November 6 Greg Kroah-Hartman released seven stable kernels (7.3.3, 6.18.62, 6.12.116, 6.6.162, 6.1.192, 5.15.225 and 5.10.274) with fixes for three Xen use-after-free flaws. CVE-2026-100081 can allow privilege escalation, and CVE-2026-100080 and CVE-2026-100082 can crash the Xen host with possible information leakage. If anything you run sits on or under Xen, pick these up as your distro ships them. LWN.
Ubuntu backports nginx security fixes to older LTS releases
USN-8955-2 (November 5) brings nginx fixes already shipped for 22.04 and newer to 20.04, 18.04, 16.04 and 14.04. The bugs involve map with regex, alias combined with rewrite rules, and SSI with async file I/O, any of which could crash nginx or possibly allow code execution (CVE-2026-42533, CVE-2026-15176, CVE-2026-93479, CVE-2026-97205). If an old LTS box is still serving traffic with the distro nginx package, update and restart it. USN-8955-2.
Home Assistant 2026.11: HACS becomes the built-in Marketplace
Released November 4. HACS now lives inside Home Assistant under Settings > Marketplace, and existing HACS setups are migrated automatically (the standalone HACS installer stops at this version). Also new: excluding entities, devices, areas, floors or labels from automation targets, dashboard sections that update their own cards as devices come and go, LoRaWAN support, Matter 1.5 cameras, and backups and media on internal or USB disks. The entity naming rework changes how cards without a custom name are labeled, so expect some dashboards to look different after upgrading. Entity IDs are unchanged. Release notes.
LWN: Amutable publishes a technical overview of its image-based OS
Posted November 7. Lennart Poettering, Michael Vogt and Joaquim Rocha laid out the design of the Amutable Operating System: image-based, activates only images whose verity data is signed by a trusted key, and ships with no shell, SSH or script interpreters by default. Their case is that package-based systems drift from machine to machine in ways that are hard to reproduce. LWN commenters disputed that reasoning, and one noted it isn’t aimed at desktop users. A useful read if you’ve been weighing immutable hosts for your lab. LWN.
Leave a Reply