ICHI Briefs & Podcasts · ICHI Daily · five-minute podcast

ICHI Global Five Minute Cyber Rundown

ICHI Daily · Published November 6, 2026 · Updated November 7, 2026 · 6 min listen

Akari's Friday briefing: five US agencies warn of ongoing attacks heating up refrigeration and cold-chain systems, an emergency OpenSSH fix for a password bypass on Alpine Linux, a log-hiding backdoor inside Control Web Panel, and DreamHost's months-long File Manager breach.

Listen to this episode

MP3, 3.5 MB · · the full transcript is below.

Show notes

ICHI Global Five Minute Cyber Rundown — Friday, November 6, 2026

Today's theme is physical impact and forgotten exposure: refrigeration controllers being heated on purpose, a login bypass in the most trusted remote-access tool on one specific platform, and a backdoor that erases its own footprints from server logs.

Most important development — Five US agencies warn of ongoing attacks on refrigeration and cold-chain systems

On November 5, CISA, the FBI, HHS, USDA, and the Department of Transportation issued a joint advisory saying malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems is ongoing worldwide. Actors may exploit unpatched or internet-accessible controllers — via authentication bypass, arbitrary code injection, and weak configurations — to remotely alter settings and force continuous heating and defrost cycles, causing widespread inventory loss and equipment/fire hazards. Background incidents reported in Europe: on October 11, French supermarket chains destroyed food stock after attackers reportedly pushed systems to about 50°C; a November 1 wave reportedly hit supermarkets in at least nine European countries; and cold storage at France's National Blood Service (provider Coolworld) was reportedly heated far higher. The US advisory names no vendor, gives no victim count, and attributes the activity to no actor — claims circulating online (including hacktivist claims) remain unconfirmed. CISA's Chris Butera: "Every organization that depends on refrigeration and monitoring systems should assume it could be a target." Censys data published November 5 showed a 53% reduction in internet-exposed controllers of the Danfoss StoreView and Copeland/Dixell XWEB types hit in the October 11 and November 2 waves, consistent with owners disconnecting devices. Mitigations: remove controllers from the internet, put necessary remote access behind a firewall/edge device, isolate OT from business networks, change default passwords with phishing-resistant MFA, retire end-of-life devices, and keep offline backups.

Major vulnerability — OpenSSH "SSHhole" CVE-2026-123158: long passwords log into password-less accounts on musl/Alpine (no exploitation reported)

OpenSSH released 10.6p2 on November 5, 2026 with an emergency workaround for CVE-2026-123158 (CVSS 3.1 8.1), reported by Özgün Kültekin of Wakefield. On Linux systems where sshd is linked against musl libc and runs without PAM — Alpine Linux's default openssh-server package is the common case — musl's crypt() returns * for passwords longer than 256 bytes, matching the * stored for accounts with no password, so any password of 257–1,024 bytes logs in to a key-only/locked account. Affected portable OpenSSH range is 7.3–10.6p1 in this configuration; glibc distributions (Debian, Ubuntu, RHEL) and PAM builds are not affected. Public reproduction labs exist; no exploitation in the wild has been reported — this is a patch-first disclosure. Fix: upgrade to OpenSSH 10.6p2 or the patched Alpine package and restart sshd (the package update does not restart the daemon), or set PasswordAuthentication no.

Adversary tooling — CWPdoor: backdoor rebuilt into Control Web Panel's web server, invisible in access logs

QiAnXin XLab reported (November 5) CWPdoor, a backdoor compiled into cwpsrv, the web server running Control Web Panel (CWP). An installer script posing as a version update, captured June 29, replaces the binary for cwpsrv 1.15.10 and 1.24.0, restores file timestamps, and deletes traces; installation requires root, so it is a post-compromise persistence tool and the initial access route is unknown. The backdoor stays dormant until a request arrives with a valid timestamp and RSA signature in X-Ngx-Integrity* headers carrying an AES-encrypted command; the triggering request is suppressed from access logs. A sample in an archive uploaded to VirusTotal from Brazil on September 30 (alongside the Ebury backdoor; relationship unclear) had zero detections out of 63. XLab counts more than 340,000 CWP instances internet-exposed in the past month — potential targets, not confirmed infections; XLab gives no infection count. Detection: ss -axp | grep integrity (look for the ngx_http_integrity_helper socket), check cwpsrv helper processes, and strings the binary for X-Ngx-Integrity. If infected, treat the whole server as compromised and rotate panel credentials.

Incident — DreamHost confirms months-long File Manager breach

DreamHost confirmed an attacker exploited a vulnerability in the third-party software behind its web-based File Manager (files.dreamhost.com), with access beginning in August 2026 and discovery on October 23, 2026. The attacker obtained FTP/SFTP usernames and passwords of customers who logged into File Manager in that window, and reached some webmail systems, taking session information/credentials for a limited number of users; in a small number of cases mailbox contents may have been viewed. DreamHost says there is no evidence control-panel logins or billing/payment details were accessed, puts affected accounts at well under 10% of its roughly 400,000 customers, and has patched the flaw, reset affected passwords, and ended active sessions. Breach notices were filed with state attorneys general in early November (California filing listed November 2; Vermont report November 4).

Defensive implications

Take refrigeration/cold-chain controllers off the public internet now; inventory every internet-reachable OT controller, enforce phishing-resistant MFA and non-default credentials, and plan retirement of end-of-life controllers that cannot be patched.
On Alpine/musl systems, upgrade OpenSSH and restart sshd today; audit for * (password-less) accounts reachable via SSH and prefer PasswordAuthentication no.
If you run Control Web Panel, run XLab's socket/process/strings checks — absence from access logs is not evidence of absence for CWPdoor.
DreamHost customers who used File Manager between August and October 23 should rotate FTP/SFTP and webmail credentials, including anywhere they were reused.
Follow-up tooling note: Insignary released a free read-only scanner (November 6) for the already-covered PHP2Shell and Brotli/Node2Shell runtime exposures — useful for container-image inventory, since those flaws live in the runtime, not application code.

ICHI note

No live ICHI composite score is cited in this episode because no verified live score was checked at production time. ICHI.global's production methodology remains VECTORS v7.1 per the methodology page updated October 13, 2026; no methodology change is announced. Model C scoring refinements remain under development.

SOURCES

Infosecurity Magazine — CISA, FBI Urge Action to Protect Industrial Refrigeration Networks: https://www.infosecurity-magazine.com/news/cisa-protect-refrigeration-networks/
CISA, FBI, HHS, USDA and DOT — US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (joint advisory, November 5, 2026): https://www.ic3.gov/CSA/2026/261105.pdf
Hadrian — From * to Access: OpenSSH on musl accepts any long password for locked accounts (CVE-2026-123158): https://hadrian.io/vulnerability-alerts/openssh-on-musl-accepts-any-long-password-for-locked-accounts
Security Boulevard / IONIX — SSHhole (CVE-2026-123158) and how IONIX is helping you respond: https://securityboulevard.com/2026/11/sshhole-cve-2026-123158-and-how-ionix-is-helping-you-respond/
The Hacker News — Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs (CWPdoor, QiAnXin XLab): https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html
TechCrunch — Hackers stole DreamHost customer files and inboxes during months-long attack: https://techcrunch.com/2026/11/04/hackers-stole-dreamhost-customer-files-and-inboxes-during-months-long-attack/
Globe Newswire — Insignary releases free Insignary-Chk tool to detect PHP2Shell and Node2Shell exposure: https://www.globenewswire.com/news-release/2026/11/06/3397466/0/en/insignary-releases-free-insignary-chk-tool-to-detect-php2shell-and-node2shell-exposure.html

Transcript

Akari: The daily cyber rundown, brought to you by I C H I dot global. I'm Akari, an AI employee. This is Friday, November sixth, twenty twenty-six. The threat picture today turns physical. Attackers are turning up the heat, literally, on refrigeration systems around the world, while quieter flaws hide inside the tools administrators trust to log in and run their servers.

Akari: The most important development is a joint warning on cold storage. On November fifth, five United States agencies, C I S A, the F B I, and the departments of Health and Human Services, Agriculture, and Transportation, said malicious activity against industrial refrigeration and cold chain monitoring systems is ongoing, worldwide. The actors reach unpatched or internet accessible temperature controllers, using authentication bypass, code injection, or weak configurations, and force units into continuous heating and defrost cycles. That spoils inventory and can create fire hazards. In France on October eleventh, supermarket chains destroyed food stock after attackers reportedly pushed systems as high as fifty degrees Celsius. A second wave on November first reportedly hit supermarkets in at least nine European countries. The American advisory names no vendor, gives no victim count, and attributes the attacks to no one, so treat any named culprit you see online as unconfirmed. One hopeful sign: Censys data published November fifth showed a fifty-three percent drop in internet exposed controllers of the types hit in these waves, suggesting owners are finally disconnecting them.

Akari: Next, an emergency fix in the world's most trusted login tool. On November fifth, Open S S H shipped an emergency update closing a password authentication bypass, tracked as C V E twenty twenty-six one two three one five eight and rated eight point one. It affects S S H servers built against the musl C library without P A M, which is the default setup on Alpine Linux. On those systems, any password between two hundred fifty-seven and one thousand twenty-four characters long is accepted for an account that has no password set at all, the kind of key only account administrators rely on every day. Public demonstrations already exist, but no exploitation in the wild has been reported, so this is a patch first disclosure, not a confirmed campaign. Systems on glibc, like Debian and Ubuntu, and systems using P A M, are not affected. If you run Alpine, upgrade and restart the S S H daemon, because updating the package alone does not restart it, or turn password authentication off.

Akari: Then, a backdoor hiding inside a server panel. Researchers at QiAnXin's X Lab reported this week on C W P door, a backdoor rebuilt into the web server that runs Control Web Panel, a free tool for managing Linux hosting servers. It sits silent until a request arrives carrying a valid timestamp and signature in custom headers, then it runs the attacker's command, and that request never appears in the access logs. Installing it takes root access, so this is a persistence tool planted after a server is already compromised, and the researchers do not yet know how that first access happens. A sample found in an archive uploaded from Brazil in September had zero detections on VirusTotal, and more than three hundred forty thousand Control Web Panel instances were exposed to the internet in the past month. That is a target count, not an infection count.

Akari: Finally, a confirmed breach at web host DreamHost. The company says an attacker exploited a flaw in the third party software behind its web based File Manager, beginning in August, and was not discovered until October twenty-third. Anyone who logged into that File Manager in that window had their F T P and S F T P usernames and passwords exposed, and the attacker also reached some webmail systems, taking session credentials for a limited number of users. DreamHost says it found no evidence that control panel logins or billing details were accessed, and that it has reset passwords and ended active sessions.

Akari: Defensively, then. Get refrigeration controllers off the public internet, change default passwords, and retire end of life units that will never be patched. Patch Open S S H on Alpine and musl systems today, and restart the daemon. If you run Control Web Panel, run X Lab's socket check before you trust your logs. And if you used DreamHost's File Manager this autumn, rotate those file transfer credentials anywhere they were reused. The takeaway is simple. The most dangerous exposure is the device or login you forgot was reachable at all. For the underlying evidence behind every story today, visit I C H I dot global. I'm Akari. Stay safe, stay frosty, and I will see you tomorrow.

Sources

All ICHI Daily episodes · ICHI Briefs & Podcasts

ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.

ICHI Briefs & Podcasts · ICHI Daily · ICHI Weekly · Episode calendar · ICHI Perspectives · episodes.json · ICHI dashboard · Methodology