ICHI Briefs & Podcasts · ICHI Daily · five-minute podcast

ICHI Global Five Minute Cyber Rundown

ICHI Daily · Published · 5 min listen

Monday briefing: unpatched D-Link DGS-3130 switch zero-days with no fix yet, a ForgeRock identity chain that reached remote vehicle control for two automakers, Microsoft's cloud-mitigated Entra flaw rated 10.0, rising scans for the OpenSSH musl flaw, and coding-agent approvals leaking secrets to GitHub.

Listen to this episode

MP3, 4.9 MB · · the full transcript is below.

Show notes

ICHI Global Five Minute Cyber Rundown — Monday, November 9, 2026

Today's theme is identity: the weekend's most consequential problems sit in login systems, discovery protocols, and approval prompts — the mechanisms that decide who and what gets trusted.

D-Link has shared mitigation guidance for multiple unpatched flaws in its DGS-3130 series managed Gigabit stackable switches, confirmed across multiple firmware versions of the DGS-3130-30TS. The flaws, found by Spectrum Community Solutions network engineer Giresh Kumar Enugu, involve the D-Link Discovery Protocol (DDP) — its authentication, access control, and information handling — plus components of the firmware security architecture. Successful exploitation could allow attackers to obtain sensitive device data, make unauthorized credential/configuration changes, leak SNMP community strings, or cause service disruptions and device resets. No CVE identifiers or CVSS scores have been published, and no fixed firmware is available. No exploitation in the wild has been reported — this is an unpatched exposure, not a confirmed campaign. D-Link is still investigating impact on other switching platforms, SSH configuration, OS credential safeguards, and firmware encryption/embedded keys. Mitigations until firmware ships: disable DDP (the primary known attack vector), remove unnecessary or default SNMP community strings, restrict SSH, web UI, and SNMP to isolated management networks and designated admin hosts, keep offline configuration backups, and watch logs for unexpected configuration changes, unprompted reboots, or factory resets.

Identity research — ForgeRock chain gave researchers sessions for any customer of two automakers, including remote vehicle control

Researchers Sam Curry and Shubham Shah disclosed (November 6) a vulnerability chain in the ForgeRock identity platform handling customer logins for two unnamed automakers. A path-confusion bypass defeated the web application firewall's path matching, the Apache Felix management console for OpenIDM still accepted its documented default credentials, and console access to the OpenIDM scheduler yielded remote code execution on production identity servers. From there the researchers could create a valid session for any customer account; for a connected vehicle that session carried the owner app's access — location and telemetry, door lock/unlock, and remote engine start/stop. The automakers fixed the issue within about two hours of the report and rotated affected credentials. The systems served customers in multiple regions; the complete chain was tested only with US accounts and vehicles. This was authorized research disclosure — there is no evidence of criminal use.

Vulnerability status check — Microsoft Entra Device Registration CVE-2026-109469 (CVSS 10.0, cloud-mitigated, no customer action)

Microsoft published CVE-2026-109469, an authorization bypass through a user-controlled key (CWE-639) in Microsoft Entra Device Registration, rated CVSS 3.1 10.0. The flaw was in Microsoft's exclusively hosted cloud service, not customer-deployed software: Microsoft says it is already fully mitigated, no customer action is required, exploit code is unproven, and it was not known to be exploited and is not in CISA KEV. Treat it as a transparency record and a prompt to enforce Conditional Access hygiene (for example, requiring MFA for device registration and blocking device-code flow where not needed), not as a patch emergency.

Update — SSHhole scanning is rising (new evidence on Friday's OpenSSH story)

SANS Internet Storm Center honeypots counted long-password attempts consistent with the OpenSSH-on-musl flaw CVE-2026-123158 rising from 23 on November 1 to 713 on November 6, with the first genuine exploitation attempts on November 5. This is scanning/probing pressure, not confirmed compromise. The guidance from Friday's episode stands: on Alpine/musl systems without PAM, upgrade to the fixed OpenSSH and restart sshd, or disable password authentication.

Developer tooling — Claude Code "don't ask again" approvals saved secrets into a file often committed to GitHub (Apiiro)

Security firm Apiiro (research published November 5) found that Claude Code saves the exact approved command as a standing allow rule in .claude/settings.local.json when a developer chooses "Yes, and don't ask again." If the command contained a password or API key, the secret is stored verbatim in a project file that routinely gets committed. Apiiro examined 104,185 public copies and found 1,122 holding at least one real secret; including git history, shared settings, and agent transcripts, it counted 2,539 credentials across 1,994 repositories, led by 379 database passwords, plus SSH logins, GitHub/GitLab/npm tokens, and AWS keys. Apiiro did not test most credentials; at least one notified organization confirmed a flagged key was still live. Deleting the file today does not remove copies already in history or forks — affected secrets must be rotated.

Defensive implications

  • Disable DDP on DGS-3130 switches now; isolate all switch management interfaces and remove default SNMP strings.
  • Audit identity platforms for exposed management consoles, default credentials, and alternate authentication routes — the alternate route is the recurring failure mode this week.
  • Search repositories and history for coding-agent settings files; rotate any secret they contain rather than only deleting the file.
  • Keep patching OpenSSH on musl/Alpine (upgrade plus sshd restart) — scanning has already begun.
  • For Entra, enforce MFA on device registration and restrict device-code flow; no patch action exists for CVE-2026-109469.

ICHI note

No live ICHI composite score is cited in this episode because no verified live score was checked at production time. ICHI.global's production methodology remains VECTORS v7.1; no methodology change is announced. Model C scoring refinements remain under development.

SOURCES

  • BleepingComputer — D-Link warns of multiple zero-days in DGS-3130 Series switches: https://www.bleepingcomputer.com/news/security/d-link-warns-of-multiple-zero-days-in-dgs-3130-series-switches/
  • Sam Curry — Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access: https://samcurry.net/forgerock
  • Microsoft Security Response Center — CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469
  • ThreatAft — Entra ID 10.0: Microsoft Fixed It, You Can't Check (CVE-2026-109469 analysis): https://www.threataft.com/articles/cve-2026-109469-entra-device-registration-authorization-bypass
  • SANS Internet Storm Center Stormcast, Monday November 9, 2026 — sshole scans (CVE-2026-123158), via SecurityTabs: https://www.securitytabs.com/news/6e1cf5c8-4106-42db-ae99-54c300cb6cf8
  • Knoxcall — Claude Code's "Don't Ask Again" File Leaks Live Credentials (Apiiro research): https://knoxcall.com/blog/article/claude-code-dont-ask-again-secrets-leak
  • Cyware Daily Threat Intelligence, November 8, 2026 (D-Link and ForgeRock corroboration): https://www.cyware.com/resources/threat-briefings/daily-threat-briefing/cyware-daily-threat-intelligence-november-08-2026

Transcript

Akari: The daily cyber rundown, brought to you by I C H I dot global. I'm Akari, an AI-generated voice. This is Monday, November ninth, twenty twenty-six. The weekend theme is identity. The most urgent problems are not in exotic malware, but in the login systems, discovery protocols, and approval prompts that decide who and what gets trusted in the first place.

Akari: The most important development is a set of unpatched zero days in enterprise switches. D Link has warned of multiple flaws in its D G S thirty-one thirty series of managed gigabit switches, confirmed on the thirty T S model across multiple firmware versions. The flaws sit in the D Link Discovery Protocol, in its authentication, access control, and information handling, and successful exploitation could expose sensitive device data, leak S N M P community strings, allow unauthorized credential or configuration changes, or force disruptions and resets. There are no C V E identifiers yet, and there is no fixed firmware. No exploitation in the wild has been reported, so treat this as an unpatched exposure, not a confirmed campaign. Until a patch ships, disable the discovery protocol, remove default or unnecessary S N M P strings, and restrict management access to isolated networks and designated hosts only.

Akari: Next, a research disclosure with physical reach. Researchers Sam Curry and Shubham Shah described a chain in the ForgeRock identity platform used for customer logins by two unnamed automakers. A path confusion trick bypassed the web application firewall, a management console still accepted its documented default login, and that access let them run code through the identity scheduler on production servers. From there they could create a valid session for any customer account, and for a connected vehicle that meant the same access as the owner app, including location, door lock and unlock, and remote engine start and stop. Both automakers fixed the issue within about two hours after the report and rotated credentials. This was research, tested only with United States accounts, and there is no evidence criminals used it, but it shows how one identity platform can become a master key.

Akari: Two more identity items need separating by status. Microsoft published a maximum severity flaw in Entra Device Registration, rated ten point zero, that could have let an unauthenticated attacker elevate privileges over the network. Microsoft says the flaw was in its hosted cloud service, is already fully mitigated, needs no customer action, and was not known to be exploited. That is a transparency record, not a patch emergency. Separately, scanning pressure is building on last week's Open S S H flaw on musl systems. S A N S honeypots counted long password attempts rising from twenty-three on November first to seven hundred thirteen on November sixth, with the first genuine attempts on November fifth. That is scanning and probing, not confirmed compromise, and the fix from Friday still stands, upgrade and restart the daemon.

Akari: Finally, a quieter leak through developer tooling. Security firm Apiiro found that when a developer tells the Claude Code coding agent yes, and do not ask again, the exact approved command is saved into a local settings file. If that command contained a password or a key, the secret was saved with it, and that file is often committed to GitHub. Apiiro counted one thousand one hundred twenty-two public copies holding real secrets, and two thousand five hundred thirty-nine credentials across one thousand nine hundred ninety-four repositories once history and transcripts were included, led by database passwords. Apiiro did not test most credentials, though at least one organization confirmed a flagged key was still live.

Akari: Defensively, then. Disable the D Link discovery protocol today and isolate every switch management interface. Audit identity platforms for exposed consoles, default credentials, and alternate login routes, because the front door is rarely the only door. Rotate any secret that may have been saved into a coding agent settings file, and purge it from repository history, not just the current copy. And keep patching the S S H flaw, because the scanners have already arrived. The takeaway is simple. Trust is granted by the weakest configuration you forgot, not the strongest one you advertise. For the underlying evidence behind every story today, visit I C H I dot global. I'm Akari. Stay safe, stay frosty, and I will see you tomorrow.

Sources

  1. BleepingComputer — D-Link warns of multiple zero-days in DGS-3130 Series switches www.bleepingcomputer.com
  2. Sam Curry — Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access samcurry.net
  3. Microsoft Security Response Center — CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability msrc.microsoft.com
  4. ThreatAft — Entra ID 10.0: Microsoft Fixed It, You Can't Check (CVE-2026-109469) www.threataft.com
  5. SANS Internet Storm Center Stormcast, Monday November 9, 2026 — sshole scans (CVE-2026-123158), via SecurityTabs www.securitytabs.com
  6. Knoxcall — Claude Code's Don't Ask Again File Leaks Live Credentials (Apiiro research) knoxcall.com
  7. Cyware Daily Threat Intelligence — November 08, 2026 www.cyware.com

Get ICHI Daily and ICHI Weekly by email

No new episode, no email. Every email links to the episode on ICHI; audio is never attached.


What to receive


✓ Daily podcast included ✓ Weekly podcast included ✓ Weekly written brief included


✓ Daily podcast included ✓ Weekly podcast included ✗ Weekly written brief not included


✗ Daily podcast not included ✗ Weekly podcast not included ✓ Weekly written brief included


✗ Daily podcast not included ✓ Weekly podcast included ✓ Weekly written brief included


✓ Daily podcast included ✗ Weekly podcast not included ✗ Weekly written brief not included


Choose any combination below, including the weekly podcast only or the weekly written brief only.

Custom: choose any combination

We send a confirmation email first, and nothing else until you confirm. Already subscribed? Use the “manage” link in any email to change what you receive; nothing changes unless you choose it. Your address is used only to send these emails; every email has a one-click unsubscribe link.

All ICHI Daily episodes · ICHI Briefs & Podcasts

ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.

ICHI Briefs & Podcasts · ICHI Daily · ICHI Weekly · Episode calendar · ICHI Perspectives · episodes.json · ICHI dashboard · Methodology