Black October is barely over and November has already delivered four significant incidents. A western government lost 18,566 records to a WordPress exploit chain. A French cooperative bank lost $133 million overnight through a compromised service provider. The Linux kernel has a CVSS 9.8 TCP use-after-free that Ubuntu has still not patched. And a named OpenSSH authentication bypass affects every Alpine Linux container running with password authentication enabled.
Two of these are actively exploited. Two have public proof-of-concept code. All four require action. At Peham we run Linux infrastructure, deploy Alpine-based containers, and work with clients on WordPress. This week mattered. Here is the full breakdown.
CVE-2026-98432: Linux Kernel TCP Use-After-Free Rated CVSS 9.8 — Ubuntu Still Unpatched
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake rated CVSS 9.8 critical. When a server receives a SYN packet containing IP options, the kernel saves those options and passes them to the new socket without copying them. Because request sockets are processed without the listener lock, another CPU handling a retransmitted SYN can read options from memory that has already been freed. The result is kernel memory corruption and a potential path to remote code execution.
Red Hat confirmed that Multipath TCP is not required: hosts with MPTCP disabled remain affected. Internet-wide scanning for MPTCP listeners from residential proxies has been observed since November 2, which the security community reads as active reconnaissance ahead of exploitation.
Patched distributions: upstream kernels 5.10.272 through 7.3, RHEL 8.10 and 9.8, AlmaLinux, Rocky Linux, Oracle Linux, Debian 12 and 13, Fedora, Amazon Linux, and SLES. Live patches are available from SUSE, Oracle Ksplice, and TuxCare.
Not yet patched: Ubuntu on all releases. Fixed kernels exist in Ubuntu's -proposed pocket but no Security Notice has been published as of this writing. Ubuntu 20.04 and older have no staged fix at all. OpenShift, CentOS Stream 9, and AKS and GKE Ubuntu node images are also unpatched.
What to do now: If you run RHEL, Debian, Rocky, AlmaLinux, or Amazon Linux, apply the kernel update immediately. If you run Ubuntu, enable TCP SYN cookies (sysctl net.ipv4.tcp_syncookies=1), restrict TCP listeners at the firewall level, and watch for the official Security Notice. Do not rely on Livepatch until an advisory has been published.
WordPress wp2shell Exploit: CVE-2026-63030 Hits Government, Steals 18,566 Records
A threat actor using the wp2shell exploit chain, tracked as CVE-2026-63030 and CVE-2026-60137, carried out a targeted intrusion against at least one western government and 48 other organizations across 29 countries. Researchers withheld the government name due to victim sensitivity, but described it as the most serious intrusion in the campaign.
The attack chain is methodical. Initial access on July 22 used the wp2shell exploit to drop a custom webshell. From there the attacker dumped the WordPress user table, stole 13 administrator accounts, created a lookalike account on the victim's domain, used a custom reconnaissance plugin to enumerate the installation, identified running security tools and open ports, found database credentials in readable configuration files, and used those credentials to reach an internal SQL server. The final exfiltration pulled 18,566 records including accounts, plaintext passwords, and personally identifiable information linked to law enforcement and government agencies.
CISA added the separate CVE-2026-119977, a WordPress core upgrade race condition rated CVSS 8.1, to its KEV catalog on November 3. Wordfence blocked more than 12,600 attacks against it in a single 24-hour period. FCEB agencies had until November 6 to patch. Fixed in WordPress 7.1.4.
What to do now: Update WordPress core to 7.1.4. Harden wp-config.php permissions so it is not web-readable. Audit your user table for accounts you did not create. Never store plaintext passwords in a WordPress database. If you need help securing a WordPress deployment, the wp2shell series covers the full attack chain: read the initial wp2shell disclosure and the week two update with CISA KEV listing.
CVE-2026-123158 (sshole): OpenSSH Authentication Bypass on Alpine Linux Containers
CVE-2026-123158, nicknamed sshole, is an OpenSSH authentication bypass affecting Alpine Linux, OpenWrt with openssh installed, Buildroot, and Yocto builds using musl libc without PAM. Disclosed November 5 by Ozgun Kultekin, CVSS 8.1 high.
Three design decisions in musl libc combine to create the flaw. First, musl's crypt() returns an asterisk on failure rather than NULL. Second, musl caps crypt input at 256 bytes, so passwords longer than that cause crypt to fail and return the same asterisk. Third, OpenSSH's non-PAM code path borrows a salt for accounts that have no valid password hash. An account whose shadow field is already set to that asterisk, meaning login disabled, will have its hash compare equal to the hash of a 257-byte or longer password, and sshd accepts the connection.
A host is only exposed if all of these conditions hold: unpatched sshd on musl libc without PAM, PasswordAuthentication yes, an SSH-permitted account with the disabled-login marker in its shadow field, and at least one local account with a real password hash. The bypass works from the second attempt in the same connection, using a password of 257 bytes or longer. Lab testing reproduced the bypass on Alpine 3.24 and in Docker containers. No confirmed in-the-wild exploitation as of November 6, but public proof-of-concept code exists in the oz9un/sshole repository.
If your infrastructure runs Alpine-based containers, which describes a large share of Docker and Kubernetes deployments, check this today. The default Alpine tiny-cloud image is safe on first boot, but any configuration that enables PasswordAuthentication and has accounts with no password set is vulnerable.
Fixed versions: Alpine edge 10.6_p2-r0, Alpine 3.24: 10.3_p1-r2, Alpine 3.23: 10.2_p1-r1, Alpine 3.22: 10.0_p1-r11, Alpine 3.21: 9.9_p2-r1, Alpine 3.20: 9.7_p1-r6. Patches also shipped for Alpine 3.19 through 3.16. Upstream OpenSSH 10.6p2 is the base fix.
What to do now: Run apk upgrade openssh on every Alpine host and container base image. Restart sshd after upgrading since the package upgrade alone does not replace the running daemon. If you cannot patch immediately, set PasswordAuthentication no and use key-based authentication only, or set UsePAM yes. Verify your package revision with apk info -v rather than version-string checks, which give false positives on backported packages.
Credit Mutuel Arkea Supply Chain Attack: $133 Million Stolen via Service Provider
Credit Mutuel Arkea, a French cooperative banking group with over 5.8 million members and 211.5 billion euros in assets, was attacked in late October. Blockchain investigator ZachXBT estimated up to 118 million euros (approximately $133 million USD) was withdrawn as USDC and USDT stablecoins. The bank acknowledged the amount was significant but stopped short of confirming the exact figure, saying it could only validate the order of magnitude. Some funds were blocked.
The attack did not go through customer accounts. The attacker reached Arkea's network through a third-party service provider's platform, then used the bank's own institutional account to transfer funds to other banking institutions before converting to cryptocurrency. No CVE has been identified. The bank described it as a sophisticated attack and ruled out human error on their side.
The timeline is a warning about disclosure speed. ZachXBT reported the incident on November 2 without naming the bank. By November 3, approximately $30 million had already been laundered, which ZachXBT attributed directly to the lack of public disclosure giving the attacker a window to move funds before EU authorities could freeze them. The bank disclosed on November 4, stating the attack was contained.
What to do now: This was a supply chain attack via a service provider. Audit which third parties have direct access to your internal network or financial systems. Require MFA and IP allowlisting for all service provider access. Know your incident disclosure obligations under DORA (EU financial sector) and have a playbook ready before you need it.
Other High-Priority Advisories: Ivanti, Node-RED, Rails, OFBiz, APT, GitLab, SonicWall
Ivanti Connect Secure CVE-2026-111357 (CVSS 8.8) and CVE-2026-118527 are both in CISA KEV from October 30. The first is a missing authentication flaw enabling local privilege escalation; the second allows an authenticated user to upload content to a predictable path. Both are fixed in Ivanti Connect Secure 25.1.1.3 and 22.8R2.6.
Node-RED CVE-2026-58115 (CVSS 10.0): A single unauthenticated request to the admin API deploys arbitrary flows. This also affects Siemens SIMATIC IoT2050 Advanced, fixed in firmware 4.3.4.1. Listed in VulnCheck KEV, not yet CISA KEV as of November 4.
Ruby on Rails Active Storage GHSA-f3w6-w445-fwh9 (CVSS 9.8): File uploads can trigger ImageMagick writes and reads that may expose your secret_key_base. Fixed in Rails 8.1.4.1 and 8.0.5.2 with mini_magick 5.1 or later. High priority for any Rails application handling file uploads.
Apache OFBiz: Five vulnerabilities patched in 24.09.08, including pre-authentication RCEs via attacker-controlled screen definitions, login-page widget injection, a hard-coded JWT key granting unauthenticated admin access, REST endpoints skipping authentication by default, and a flawed password-reset algorithm. Update to 24.09.08 to address all five at once.
APT on Debian 12 and Ubuntu 22.04 and later, CVE-2026-109518 (CVSS v4 7.7): Tampered HTTP traffic during a package download can cause APT to retry and substitute a malicious package, running code as root. Using HTTPS sources and verifying GPG signatures mitigates this.
GitLab: Over 11,300 internet-exposed instances remain vulnerable to CVE-2026-110264 (CVSS 10.0) and over 1,000 to CVE-2026-97229. We covered both in our Black October 2026 security roundup. If your self-managed GitLab has not been updated this week, it is overdue.
SonicWall GMS CVE-2026-109593 and CVE-2026-109594: Unauthenticated file read and SQL injection in a product that reached end of life in October 2025. No patch will be released. If you are still running SonicWall GMS, decommission it.
Control Web Panel cwpsrv supply chain backdoor: A trojanized version of the cwpsrv web server with a dormant backdoor has been found on more than 340,000 exposed instances. No CVE assigned. If you use CWP on hosting infrastructure, audit your cwpsrv binary.
What This Week Tells Us
The government breach and the bank heist share the same underlying pattern: a trusted access path that bypasses normal security controls. The wp2shell attackers exploited a CMS vulnerability and moved laterally using credentials left readable in configuration files on the same server. Credit Mutuel Arkea was entered through a service provider with direct network access. Neither attack required a zero-day on the day of intrusion.
The Linux TCP and Alpine SSH issues are different in character. Both are remotely exploitable without authentication under specific conditions. Both have public proof-of-concept code. Neither has a complete patch story for the most common environments. Ubuntu remains unpatched for the kernel flaw. Alpine requires a manual apk upgrade and daemon restart that many automated deployment pipelines will not handle automatically. If you run containers, the Alpine sshd bypass deserves attention today.
Need Help Securing Your Infrastructure?
If your team needs help hardening your deployment pipeline, reviewing service provider access controls, or auditing container images for exposure, that is work we do at Peham. Our Cloud and DevOps service covers reliable deployments, infrastructure security hardening, and monitoring that catches problems before they become incidents. If you are running WordPress and want a thorough security review, we have been following the wp2shell exploit chain since day one.
Visit our Cloud and DevOps service page or get in touch directly to discuss your situation. We are based in the UK and work with clients across Europe and beyond.
Related reading: Black October 2026 security roundup, the original wp2shell disclosure, the week two update with CISA KEV listing, and our coverage of the Brotli Bomb Node.js vulnerability.
