Zyxel GS1900 exploitation exposes a flaw missed by earlier fixes

Binarly reported that attackers exploited CVE-2026-107441, an out-of-bounds write in the web management program of Zyxel GS1900 switches, to run OS commands with root privileges without authentication.InfosecuritySOCRadar Its analysis linked the campaign to around 996 switches across 48 countries and found the vulnerable code remained in all 10 affected firmware releases after Zyxel's June update.Infosecurity Zyxel acknowledged the flaw on 11 October and released a fix on 22 October, while SecurityWeek reported fixes on 23 October; Zyxel published its advisory on 3 November.InfosecuritySecurityWeek

The accounts differ on the vulnerability used in the campaign: Binarly identified CVE-2026-107441, while earlier reporting linked activity to CVE-2026-7273, which Zyxel patched on 16 June and CISA later added to KEV.InfosecuritySecurityWeek Binarly said the new flaw affects 10 GS1900 models; on the GS1900-8, firmware 2.90(AAHH.2)C0 and earlier are affected, and 2.90(AAHH.3)C0 contains the fix.Infosecurity

AnalysisThe sources agree that earlier fixes failed to close the weakness, while differing on whether the observed attacks targeted CVE-2026-107441 or CVE-2026-7273.InfosecuritySecurityWeek

OpenSSH released version 10.6p2 to address a flaw that could let an attacker log in to passwordless accounts on Alpine Linux servers running the standard openssh-server package.The Hacker News The vulnerability depends on a specific combination: OpenSSH using musl without PAM, password authentication enabled, and an affected account; the attacker also needs network access, the account name and a password between 257 and 1,024 bytes.The Hacker News Alpine said releases from 3.16 through 3.24 and edge were affected, and listed fixed point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4.The Hacker NewsSecurityOnline

Alpine, OpenSSH and the researcher reported no attacks or public exploit code at the time of the advisories, and Alpine said no CVE had been assigned.The Hacker NewsSecurityOnline The Hacker News reported that Alpine's package fixes extended to releases back to 3.16.The Hacker News

DigiCert disclosed that an unauthorised party accessed a subset of archived customer records after a self-registration feature on an internal archival tool became accessible from an external availability zone during an infrastructure migration.SecurityOnline The company said the intruder had read-only access and could view archived files, including verification and contact records; a small minority of accounts also contained identity documents such as passports or driving licences.SecurityOnline DigiCert said it detected non-DigiCert accounts on the server on 18 June 2026, deployed an authorisation patch on 2 July, and confirmed through an October log review that the account had viewed archived files before the patch.SecurityOnline

The company said no certificates were issued, modified or revoked, and that certificate-authority servers on separate network segments remained untouched.SecurityOnline DigiCert deactivated self-registration across internal instances on 24 October 2026 and said it had moved remaining endpoints behind private-IP load balancers.SecurityOnline

The Apache OFBiz project released version 24.09.08 to address 46 security flaws; all versions before 24.09.08 are affected.SecurityOnline The project listed multiple remote code execution flaws, including unauthenticated issues CVE-2026-83542, CVE-2026-68524 and CVE-2026-73578, and an administrative access issue involving hard-coded JWT key CVE-2026-105330.SecurityOnline CVE-2026-83542 carries a CVSSv3 score of 9.8, and the project said there were no public proof-of-concept exploits or confirmed in-the-wild exploitation for this release.SecurityOnline