‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password. The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours. It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY". Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.

‼️ Hackers went after the fridges of a Danish food producer overnight, the same night supermarket freezers across Europe were turned up to 50°C. Its refrigeration supplier caught the attack and stopped it in time, a Danish industry group told broadcaster TV 2. Denmark's civil security agency now warns similar attacks can hit the country and tells firms to patch fridge controllers and limit their internet access. Last month's attack on hundreds of French supermarkets hijacked controllers made by Danish firm Danfoss.

❗️ Hackers have turned Sony's PS5 into a Steam Machine. A Linux port called PS5 Bazzite Deck boots a jailbroken console into the Steam Deck interface from a USB drive, with 4K60, Wi-Fi and the DualSense working. It can even unlock 4 GPU compute units that Sony ships disabled.

❗️ Hackers have turned Sony's PS5 into a Steam Machine. A Linux port called PS5 Bazzite Deck boots a jailbroken console into the Steam Deck interface from a USB drive, with 4K60, Wi-Fi and the DualSense working. It can even unlock 4 GPU compute units that Sony ships disabled.

‼️ Ubuntu and Red Hat still have no fix for a Linux kernel flaw that Anthropic says its unreleased AI model turned into a remote root exploit. The bug, CVE-2026-98432, is a use-after-free in the IPv4 TCP handshake, rated 9.8 out of 10. The exploit needs no credentials and targets servers with a multipath TCP listener, which Go 1.24 and later open by default. The fix reached stable kernels on 11 October and Debian has shipped it. Ubuntu still marks every release from 16.04 to 26.10 vulnerable. Red Hat now rates it Critical but has no patched kernel for RHEL 8, 9 or 10. Anthropic has not released the exploit. By its count, it takes 48 minutes to leak a kernel pointer and five more to run commands as root.

‼️ French lawmakers voted for an internet traffic tax that the makers of VLC say would cost them more than €1M a year. Content providers would pay €0.055 for every gigabyte sent to French users, as counted by ISPs. Its Socialist authors expect €10B a year. The government opposed it, warning that about half the bill would fall on smaller providers, many of them French. It passed 11 votes to 10, with 35 of 577 deputies present.

‼️ BREAKING: US officials believe Nvidia CEO Jensen Huang is the target of a Chinese spy plot. They believe Alice Huang, a Megaspeed executive seen at his side in Taiwan, is a Chinese intelligence asset. President Trump has been briefed about the matter.

‼️ The git, curl and python3 in macOS still trust compromised eMudhra certificates, 11 days after Apple was told. Anyone can recover their keys, so an attacker on your network could pose as GitHub and feed you code. Researchers say macOS 27.2 even wiped fixes applied by hand.

‼️ A hacker got the national ID numbers of signers on eSignFlow, the e-signature tool used by 120+ Belgian councils. Its maker Vanden Broele says the hashed numbers are easy to reverse. Some handwritten signatures leaked too. On Monday, its CEO said mostly metadata leaked.

❗️ Ukrainian drones hit one of two key data centres for Russia's tax service on 23 October, Ukrainian channel Exilenova+ says. Russian tech media say the Gorodets site holds tax databases and civil records. Russia hasn't confirmed the hit, and no tax outages have been reported.

❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it. 17 hours on, the wallet holds ~$2,000 and nobody has taken it. The developer says someone is crashing PHP but "still no RCE yet".

Tailscale replied on Reddit: Hi folks, Mike Shaver here, VP of Engineering at Tailscale. We've seen the concerns about Tailscale SSH and wanted to share what we know so far. If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH. We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected. A bit of technical context: Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do. While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not. Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH. In the meantime, there are a few precautions you can take: •Review your SSH access policies. Make sure only the people and devices that need access have it. •Review SSH forwarding permissions and remove access you don't need. •Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access. •Enable automatic updates where supported so you can pick up fixes when they're released. For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect. We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up. If we find anything that changes our assessment or requires immediate customer action, we'll communicate that. We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet. We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team

‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws. In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.

‼️ Sweden's Government Offices will block ChatGPT and Claude on staff computers from Monday, Sveriges Radio reports. Officials are to use approved tools like Microsoft Copilot.

‼️ After PHP2Shell comes Node2Shell, a critical bug found by OpenAI's Codex Security that can let attackers run code in Node.js apps. It was successfuly demonstrated on the official Node.js 24.22.0 image. Node 20, 23 and 25 (all EoL) get no fix.

‼️ A low-skill hacker used a jailbroken DeepSeek V4 to breach an Indian public university and steal 5,200+ student and faculty records, Unit 42 says. The AI agent even drafted a "NEXT EXPLOIT OPPORTUNITIES" plan. Unrelated criminals now run the same cheap DeepSeek setup.