{"id":4113,"date":"2026-11-10T08:28:44","date_gmt":"2026-11-10T16:28:44","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=4113"},"modified":"2026-11-10T14:41:32","modified_gmt":"2026-11-10T22:41:32","slug":"mag212-cyber-daily-2026-11-10-openssh-sshole-sonicwall-qubole","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/mag212-cyber-daily-2026-11-10-openssh-sshole-sonicwall-qubole\/","title":{"rendered":"Des attaquants s'introduisent par des portes de confiance\u00a0: faille OpenSSH, contournement de l'authentification multifacteur SonicWall, abus de Qubole sur AWS \u2014 MAG212 CYBER Daily, 10 novembre 2026"},"content":{"rendered":"\n
\n
Download the PDF (22 pages)<\/a><\/div>\n<\/div>\n\n\n\n

MAG212 CYBER \u00b7 Daily Cyber Intelligence \u00b7 Tuesday, November 10, 2026 \u00b7 Research cutoff 06:15 PT.<\/strong> Today’s thread is trust that was granted once and never re-examined. An OpenSSH bug lets attackers log in to Alpine and other musl-based Linux systems with an oversized password, and CISA gave federal agencies until November 12 to fix it. A SonicWall SSL-VPN flaw skips SAML-enforced MFA. A data platform’s own AWS account was used to assume roles its customers had created for it. And a real release pipeline signed and published malware. Most of the fixes are configuration discipline, not new tools.<\/p>\n\n\n\n

What needs attention today<\/h2>\n\n\n\n
#<\/th>Action<\/th>How<\/th><\/tr><\/thead>
1<\/td>Turn off password SSH on Alpine\/musl hosts and containers, then patch and hunt<\/strong><\/td>Set PasswordAuthentication no<\/code>, upgrade to your branch’s fixed openssh package, restart sshd, then search logs for Accepted password for<\/code> on passwordless accounts. CVE-2026-123158, CISA KEV due Nov 12.<\/td><\/tr>
2<\/td>Upgrade every SonicWall firewall; close exposed NAS media ports<\/strong><\/td>SonicOS 7.3.4-7013 or 8.2.3-8015, SAML SSL-VPN first (no workaround). On NAS boxes, stop forwarding Plex port 32400, update Plex and rotate passwords.<\/td><\/tr>
3<\/td>Audit vendor access into your cloud accounts<\/strong><\/td>List every IAM role that trusts a vendor account, starting with Qubole’s 805246085872. Delete unused ones, add source-IP or VPC-endpoint conditions, and review CloudTrail from October 1.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What\u2019s inside<\/h2>\n\n\n\n