ICHI Briefs & Podcasts · ICHI Daily · five-minute podcast

ICHI Global Five Minute Cyber Rundown

ICHI Daily · Published November 10, 2026 · 5 min listen

CISA confirms active exploitation of GPUStack, FreeSWITCH, IBM Aspera Faspex and the OpenSSH SSHhole flaw with a November 12 deadline; Google patches the eighth exploited Chrome zero-day of 2026; SonicWall's VPN MFA bypass nears its deadline; fake GitHub security tools infect over 2,000 PCs.

Listen to this episode

MP3, 4.8 MB · · the full transcript is below.

Show notes

ICHI Global Five Minute Cyber Rundown — Tuesday, November 10, 2026

Today's theme is confirmation: four flaws defenders were told to patch last week are now confirmed under active exploitation, a browser zero-day makes eight for the year, and the window to fix all of it is measured in days, not weeks.

Most important development — CISA adds four actively exploited flaws to KEV (federal deadline November 12)

On Monday, November 9, CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation, with a November 12, 2026 remediation deadline for federal civilian agencies under BOD 26-04:

GPUStack — CVE-2026-102895 (CVSS 9.8): improper authentication allowing unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution. Fixed in July 2026; active in-the-wild exploitation was reported at the end of July.
SignalWire FreeSWITCH — CVE-2026-116779 (CVSS 9.8): code injection in inbound SIP MESSAGE handling (the "To" user / chat-protocol selection path) that can disclose configuration and credentials, allow arbitrary call control, and execute commands with the privileges of the FreeSWITCH process. SignalWire's October 28 advisory notes exploitation has been observed in the wild. Fixed in FreeSWITCH 1.11.3.
IBM Aspera Faspex — CVE-2026-123218 (CVSS 9.8): incorrect authorization allowing an authenticated user to craft a message to bypass authorization and escalate to full administrative privileges. IBM patched it Friday in Aspera Faspex 5.0.19 PL1; IBM's advisory makes no mention of exploitation and no attack details are public.
OpenSSH "SSHhole" — CVE-2026-123158 (CVSS 8.1): see the status change below.

CISA has not identified the attackers behind the GPUStack, FreeSWITCH, or Faspex exploitation, and no scale figures are public for those three.

Status change — SSHhole (CVE-2026-123158) moves from scanning to confirmed exploitation with post-compromise activity

This is new evidence on a story covered November 6 and November 9, not a repeat: CISA's KEV listing confirms active exploitation. Previdian counts 22 exploitation attempts from 14 unique IP addresses. GreyNoise reports the first honeypot attempt on November 7 at 12:46 AM UTC and confirmed post-exploitation activity from six source IPs across 18 distinct attack chains, including reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorized_keys file for persistence. In at least one case an actor dubbed GT10 deployed TAC Agent, a Python-based command-and-control agent. watchTowr reports the flaw being weaponized for botnet and cryptocurrency-miner activity; Defused Cyber describes the activity as not yet widespread. The fix from last week stands and is now urgent: on Alpine/musl systems without PAM, upgrade to OpenSSH 10.6p2 or the patched package and restart sshd, then hunt for unauthorized keys and persistence.

Browser zero-day — Google patches Chrome CVE-2026-125350, the eighth actively exploited Chrome zero-day of 2026

Google on Monday, November 9 released Chrome updates fixing nine vulnerabilities, including CVE-2026-125350, a high-severity use-after-free in the XML component that Google confirms is exploited in the wild. The flaw was reported by an anonymous researcher on November 6, 2026; Google has published no CVSS score and no details on attackers, targets, or exploitation method, and is restricting bug details until most users update. Fixed versions: 157.0.8103.50/.51 for Windows and macOS, 157.0.8103.50 for Linux (restart Chrome to apply). Users of other Chromium-based browsers should apply equivalent fixes as they arrive.

VPN authentication — SonicWall SonicOS SAML/MFA bypass CVE-2026-19868 (KEV since November 6; deadline November 20)

CVE-2026-19868 (CVSS 7.1 per SonicWall; 7.5 in CISA enrichment) is an authentication-enforcement flaw in SonicOS SSL-VPN when SAML is configured: a user with valid credentials for an alternate authentication method can bypass SAML controls — and with them, SAML-enforced MFA. This is not a credential-free login flaw. SonicWall investigated a report indicating potential exploitation; CISA added it to KEV on November 6, 2026 with a November 20 federal deadline and lists ransomware use as unknown. Affected: Gen7 7.3.3-7015 and older, Gen8 8.2.2-8015 and older. Fixed: Gen7 7.3.4-7013+, Gen8 8.2.3-8015+. SonicWall lists no workaround.

Adversary activity — Fake GitHub security tools infected more than 2,000 PCs (Doctor Web)

Doctor Web reports malware hidden in GitHub projects posing as security tools has infected more than 2,000 PCs, disabling defenses and stealing sensitive data. The campaign began about two years ago with Visual Studio projects aimed at blockchain-game users (game bots and cheats, targeting crypto wallets) and has more recently targeted information security professionals. The attackers are still developing the malware. Treat download provenance as a control, not a courtesy — even for tools that look like security tooling.

Defensive implications

Meet the November 12 KEV deadline for GPUStack, FreeSWITCH, Faspex, and SSHhole in your own estate — not just federal systems.
On any reachable, unpatched musl/Alpine SSH system, hunt for persistence (new authorized_keys entries, unexpected processes/agents) in addition to patching; exploitation now includes post-compromise activity.
Update and restart Chrome to 157.0.8103.50/.51; track Chromium derivatives.
Patch SonicWall Gen7/Gen8 firewalls before November 20; review SSL-VPN logs for alternate-method logins that skipped SAML.
Verify the provenance of downloaded developer/security tools; scan downloads and prefer signed, official distribution channels.

ICHI note

No live ICHI composite score is cited in this episode because the live score did not render in the pre-production check at production time. ICHI.global's production methodology remains VECTORS v7.1; no methodology change is announced. Model C scoring refinements remain under development.

SOURCES

The Hacker News — CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws: https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
SecurityWeek — IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks: https://www.securityweek.com/ibm-aspera-faspex-signalwire-freeswitch-vulnerabilities-exploited-in-attacks/
eSecurity Planet — CISA Adds 4 Exploited Flaws to KEV: Nov. 12 Deadline: https://www.esecurityplanet.com/vulnerabilities/news-cisa-kev-gpustack-freeswitch-openssh-ibm-november-2026/
The Hacker News — Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026: https://thehackernews.com/2026/11/google-issues-chrome-security-update.html
BleepingComputer — SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks: https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
Cybernoz (Doctor Web research) — Fake GitHub Security Tools Infect Over 2,000 PCs With Malware: https://cybernoz.com/fake-github-security-tools-infect-over-2000-pcs-with-malware/

Transcript

Akari: The daily cyber rundown, brought to you by I C H I dot global. I'm Akari, an AI-generated voice. This is Tuesday, November tenth, twenty twenty-six. Today the theme is confirmation. Four flaws defenders were told to patch last week are now confirmed under active exploitation, a browser zero day makes eight for the year, and the window to fix all of it is measured in days, not weeks.

Akari: The most important development is that C I S A on Monday added four vulnerabilities to its Known Exploited Vulnerabilities catalog, all with evidence of active exploitation, and gave federal agencies until November twelfth to fix them. Three are rated nine point eight. In G P U Stack, an improper authentication flaw lets an unauthenticated attacker take full administrative access, create persistent administrator keys, read worker and cloud provider secrets, and run code. In SignalWire FreeSwitch, a code injection flaw in how inbound messages are handled can disclose configuration and credentials, take control of calls, and run commands. And in I B M Aspera Faspex, an authorization bypass lets an authenticated user escalate to full administrator privileges. I B M patched Faspex on Friday, and FreeSwitch version one point eleven point three carries its fix.

Akari: The fourth entry is the S S H hole flaw in Open S S H we covered last week, and here the status has genuinely changed. What was scanning on Friday is now confirmed exploitation with post compromise activity. GreyNoise reports eighteen distinct attack chains, including attempts to query cloud metadata services, read password hashes and root S S H keys, and rewrite the authorized keys file for persistence. One actor has been seen deploying a Python command and control agent, and researchers at watchTowr report the flaw being used for botnet and cryptocurrency mining activity. Previdian counts twenty-two exploitation attempts from fourteen addresses so far. If you run Open S S H on Alpine or another musl system without P A M, upgrading and restarting the daemon is now an incident response task, not routine patching, and you should check for keys you did not add.

Akari: Next, Google on Monday patched the eighth actively exploited Chrome zero day of the year. The flaw, C V E twenty twenty-six, one two five three five zero, is a high severity use after free bug in Chrome's X M L component, reported anonymously on November sixth. Google says an exploit exists in the wild but has shared no details about who is exploiting it or how, and details stay restricted until most users update. The fix is in Chrome version one hundred fifty-seven point zero point eight one zero three point five zero and point five one for Windows and Mac, and point five zero for Linux. Restart the browser to apply it, and watch for the same fix landing in other Chromium based browsers.

Akari: Two shorter items deserve attention. SonicWall's S S L V P N flaw, C V E twenty twenty-six, one nine eight six eight, lets someone holding valid credentials for an alternate login method bypass the S A M L sign in, and with it any multi factor authentication that S A M L enforces. C I S A listed it as exploited on November sixth, the federal deadline is November twentieth, and there is no workaround, only the firmware update. Separately, Doctor Web reports fake security tools on GitHub have infected more than two thousand computers with malware that disables defenses and steals data, in a campaign that began by targeting blockchain game users and now aims at security professionals themselves.

Akari: Defensively, then. Treat the November twelfth K E V deadline as your own for G P U Stack, FreeSwitch, Faspex, and S S H hole, and hunt for persistence, not just exposure, on any S S H system that was reachable and unpatched. Update Chrome everywhere and restart it. Patch SonicWall firewalls before November twentieth and review V P N logins for alternate method sign ins that skipped S A M L. And vet any tool you download, however professional it looks. The takeaway is simple. Exploitation is no longer a warning about these flaws, it is the documented present. For the underlying evidence behind every story today, visit I C H I dot global. I'm Akari. Stay safe, stay frosty, and I will see you tomorrow.

Sources

The Hacker News — CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws thehackernews.com
SecurityWeek — IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks www.securityweek.com
eSecurity Planet — CISA Adds 4 Exploited Flaws to KEV: Nov. 12 Deadline www.esecurityplanet.com
The Hacker News — Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 thehackernews.com
BleepingComputer — SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks www.bleepingcomputer.com
Cybernoz (Doctor Web research) — Fake GitHub Security Tools Infect Over 2,000 PCs With Malware cybernoz.com

All ICHI Daily episodes · ICHI Briefs & Podcasts

ICHI Daily and ICHI Weekly are editorial commentary on ICHI’s evidence. They never change the VECTORS score, incident evidence classifications or intelligence rankings.

ICHI Briefs & Podcasts · ICHI Daily · ICHI Weekly · Episode calendar · ICHI Perspectives · episodes.json · ICHI dashboard · Methodology