A breach response plan protects your business when attacks happen. This week alone, DigiCert suffered a data breach, OpenSSH disclosed a critical password bypass, Zyxel patches failed against active exploits, and a Linux backdoor is circulating. Your immediate action: check which of these systems you use, apply patches now, and verify backups work.
DigiCert Breach Exposes Customer Data, OpenSSH Password Bypass, and Zyxel Patch Fails to Stop Attacks
In today's cybersecurity update for November 5th, 2026, small business owners face several critical security threats requiring immediate action:
DIGICERT DATA BREACH: DigiCert, a major certificate authority, suffered a data breach after a server migration mistake exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. Businesses using DigiCert for SSL certificates or code signing should watch for notification emails and remain alert for phishing attempts. The company has secured the exposure and is notifying affected customers directly. (Source: Bleeping Computer)
OPENSSH CRITICAL PASSWORD BYPASS: A newly disclosed OpenSSH vulnerability (dubbed "*sshole") allows attackers to log into certain Alpine Linux and musl-based Linux accounts configured to block password authentication simply by entering an oversized password. OpenSSH version 10.6p2, released November 5th, 2026, includes a workaround. Businesses running Alpine Linux or musl-based distributions should update immediately, as exploitation requires only a single connection attempt. (Sources: Bleeping Computer, Cyber Security News)
ZYXEL SWITCH VULNERABILITY PERSISTS: Zyxel's June 2026 patch for GS1900 switches failed to block the exploit being used in active attacks, with 996 switches already compromised according to security firm Binarly. The flaw allows unauthenticated remote code execution. Businesses using Zyxel GS1900 switches must verify they have the absolute latest firmware beyond the June patch and confirm with Zyxel support that the current version closes the specific exploit path. (Source: Infosecurity Magazine)
LINUX CWP BACKDOOR MALWARE: A new malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. The compromised version installs a backdoor giving attackers persistent access to Linux servers. Businesses managing Linux servers with CWP should verify recent installations came from official sources only and check system integrity. (Source: Bleeping Computer)
AI-DRIVEN ATTACKS ON FINANCIAL SECTOR: India's Computer Emergency Response Team (CERT-In) has warned about a new threat group called "Crafty Falcon" using Chinese-made AI tools to attack fintech and cryptocurrency organizations. The attackers are using AI to enhance phishing campaigns and social engineering at scale, making attacks harder to detect. Financial and crypto businesses should strengthen multi-factor authentication, review access controls to financial systems, and train staff to recognize increasingly sophisticated AI-generated phishing attempts. (Source: Infosecurity Magazine)
Which five threats require your breach response plan this week?
DigiCert's internal server went public during a migration, exposing customer data and identity documents. If you use DigiCert for SSL certificates or code signing, expect notification emails and watch for phishing. OpenSSH versions before 10.6p2 allow password bypass on Alpine Linux and musl-based systems with a single oversized password attempt. Zyxel's June patch for GS1900 switches missed the active exploit, with 996 devices already compromised. A trojanized Control Web Panel installer gives attackers persistent Linux server access. Financial firms face AI-enhanced phishing from Crafty Falcon. Inventory systems using these products, apply all available patches immediately, and verify with vendors that current versions patch the specific exploits being actively used in attacks.
Key takeaways
- DigiCert breach exposed certificates and identity documents. Monitor for phishing if you hold DigiCert services.
- OpenSSH versions before 10.6p2 bypass password authentication on Alpine and musl Linux. Update immediately if you run these distributions.
- Zyxel GS1900 switches compromised despite June patch. Contact support to confirm current firmware version blocks the active exploit.
- Verify Linux Control Web Panel installations came from official sources only. Check system integrity for unauthorized backdoors.
Frequently asked questions
Do I need to worry about the DigiCert breach if I only use their certificates?
Yes. The breach exposed customer information and identity documents. Watch for phishing emails claiming to be from DigiCert, and monitor your account for unauthorized certificate requests. DigiCert is notifying affected customers directly.
How do I know if my Linux servers are vulnerable to the OpenSSH password bypass?
You are vulnerable if you run Alpine Linux or musl-based distributions with OpenSSH versions before 10.6p2. Check your version with 'ssh -V'. Update to 10.6p2 or later and verify password authentication is re-enabled if needed.
Our company uses Zyxel GS1900 switches. What do we do?
Contact Zyxel support and request confirmation that your current firmware version closes the specific exploit being used in active attacks. Do not assume the June patch is sufficient. Update to the absolute latest firmware available.
How can I defend against AI-enhanced phishing attacks?
Require multi-factor authentication on all financial systems and email accounts. Review access controls to ensure only necessary staff can approve transfers. Train employees to verify requests through a second channel, not by replying to email.
Sources
- https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/
- https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/
- https://cybersecuritynews.com/openssh-flaw-bypass-password-authentication/
- https://www.infosecurity-magazine.com/news/zyxel-gs1900-patch-missed-flaw/
- https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/
- https://www.infosecurity-magazine.com/news/india-warns-ai-cyberattacks/
Keep reading
Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].