The Week in 60 Seconds
Security & Exploitation
Identity · The Hacker News
What happened
On some Alpine Linux servers using the standard openssh-server package, attackers can log in to passwordless accounts, including SSH key-only accounts, by supplying an unusually long password. [4]
Exploitation requires network access to the server, a valid account name, and a password 257–1,024 bytes long. [4]
Why it matters
OpenSSH rates the flaw critical and released version 10.6p2 to block it. [4]
Cloud · Theregister Security
What happened
The *sshole vulnerability can permit root or other password-disabled accounts to be accessed with a 257–1,024-character password when specific musl Linux and OpenSSH conditions are met. [3]
Affected systems use musl libc, run OpenSSH without PAM, enable password authentication, have an asterisk-marked target account, and have at least one other account with a valid password hash. [3]
Why it matters
Musl is common in embedded Linux and is the standard C library for Alpine Linux, including official AWS and Azure cloud images; some systems may therefore be vulnerable depending on configuration. [3]
AI & Agent Security
AI & Agents · Helpnetsecurity
What happened
GTIG and Mandiant researchers found that criminals use stolen corporate cloud-account access to run AI models at victims’ expense, with some incidents exceeding $100,000 in charges in a single day. [1]
Mandiant responded to several LLMJacking incidents in 2026, according to the supplied article excerpt. [1]
Why it matters
The supplied excerpt characterizes stolen AI access as capable of causing substantial cloud-billing exposure for affected companies. [1]
AI & Agents · Theregister Security
What happened
OpenAI released GPT-6 Cyber, describing it as a cybersecurity-tuned model intended to improve vulnerability discovery and exploitation while adhering to researchers’ authorized rules of engagement. [2]
In OpenAI’s ExploitGym evaluation, GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber on the same benchmark tests. [2]
Why it matters
OpenAI classified GPT-6 Cyber as Critical, its highest cyber-capability risk tier, describing that tier as including functional zero-day exploit development in real-world critical systems and end-to-end cyberattacks. [2]
Cloud & Platform
Cloud · Securityaffairs
What happened
The FBI attributed the theft of more than $6 billion in virtual assets from Binance, occurring on or about October 29, 2026, to North Korea-linked TraderTraitor, also tracked as Lazarus Group and APT38. [5]
TRM said approximately $6.36 billion moved from Binance wallets across ten blockchains, mostly within about 20 minutes; Binance confirmed a security incident and suspended withdrawals on several networks. [5]
Why it matters
The FBI alert asks THORNode and RPC operators, instant exchanges, DeFi platforms, blockchain analytics firms and other crypto providers to block transactions involving TraderTraitor wallet addresses and funds derived from them. [5]
AI & Agents · Theregister Security
What happened
Cloudflare CEO Matthew Prince said nation-state actors and criminals likely exploited the PHP2SHELL vulnerability before disclosure, and that Cloudflare was reviewing logs for evidence of past use. [8]
Prince argued that container-based architectures at hyperscalers and neoclouds cannot cost-effectively keep pace with emerging agentic paradigms, while acknowledging containers improve on bare metal and virtual machines. [8]
Why it matters
Prince said an AI agent might inspect 1,000 restaurant websites and menus while the user selects only one, imposing costs on the other 999 without benefit; he cited Cloudflare’s prediction that agentic activity could reach 1,000 times human click traffic. [8]
Research & Emerging Techniques
AI & Agents · Schneier Blog
What happened
The authors report identifying a substantial number of previously unrecorded vulnerabilities in the German legal system using LLMs and present potential exploits for a selection they believe would not cause serious harm. [7]
The source characterizes written law as potentially containing vulnerabilities that can invite exploitation, with courts absorbing most exploits through interpretation. [7]
Why it matters
The authors believe highly capable AI could enable vulnerability discovery at unprecedented scale and that proliferating cheap legal reasoning could jeopardize the functioning of current legal systems. [7]
Policy & Industry
AI & Agents · Cyberscoop
What happened
CISA 2015 provides legal protections for threat-data exchanges between the government and private sector and among companies; it is scheduled to expire on Dec. 11, 2026. [6]
Thirty-five business groups asked House and Senate Armed Services leaders to include a 10-year CISA 2015 renewal in final negotiations on the fiscal year 2027 National Defense Authorization Act. [6]
Why it matters
The business groups argued that AI systems can identify and exploit software vulnerabilities at machine speed and make sophisticated cyber capabilities cheaper, faster, and easier to use; they said information-sharing speed depends on the legal certainty provided by CISA 2015. [6]