OpenSSH auth bypass bug hits Alpine Linux, OperWRT

0:03An Open SSH authentication bypass bug hits Alpine Linux and OpenWrt. Hackers attempt to raise fridge temperatures at French blood banks, a French bank gets hacked for$133 million, and the Thai opposition has been targeted with spyware. This is the Risky Bulletin, prepared by Catalan Kempanu and read by me, Claire Aird. Today is the 6th of November, and this podcast episode is brought to you by Sublime Security. In today's top story, the Open SSH project has released a security update to patch a bug that lets attackers authenticate with any random password as long as it exceeds 256 characters. The so-called SSH hole vulnerability only works against Open SSH versions running on Linux distros that use the Muscle C library as standard.

1:00This includes Alpine Linux, OpenWRT, BuildRoot and Yocto. The bug impacts all Open SSH versions released in the last decade. In other news, hackers unsuccessfully attempted to raise the temperature of blood bank refrigerators across France this week. Staff noticed the sudden temperature rise and intervened. The French blood establishment agency says no plasma bags were compromised in the attack. Hackers have stolen$133 million from French banking group Credit Mutual Arkea. Blockchain security researcher Zach XBT discovered the theft this week as the stolen money was being laundered on the blockchain.

1:44The bank is working to recover at least some of the funds. Several devices connected to the White House computer network are running residential proxy apps. According to journalist Brian Krebs, at least one of the residential proxy apps is owned by a Russian company that was linked to cyber attacks against the 2016 U.S. election. Hackers have breached the internal network of Japan's Ministry of Foreign Affairs. The intruders stole the data of 3 ,600 employees, including their names and email addresses. The hack took place at the end of July. The ministry says the secure part of its internal network was not impacted.

2:26Hackers have stolen the personal data of more than 20 ,000 grant applicants from Norway's international aid agency. NORAD, the Norwegian Agency for Development Cooperation, says the hackers breached its network via 27 compromised accounts. The agency is now working with the country's National Security Authority to investigate the intrusion. NORAD works under the Ministry of Foreign Affairs. It distributes international aid to foreign organisations that promote human rights, climate protection and sustainable development. A student hacked into a system used by schools in Iceland in an attempt to alter grades and attendance data.

3:07According to local media, the student exploited a login vulnerability in the inner system, which is used by at least 16 upper secondary schools in Iceland. Japanese gaming company Seeger has temporarily suspended its arcade game network following a cyber attack this week. The hack impacted the Seager All.net and Amy Networks. The company is investigating whether user data was stolen. Supermarket chain Arhold Delhaize expects to lose up to€250 million in sales due to a cyber attack that defrosted its freezers last month. This projected figure is separate to the millions of euros worth of products that were spoiled as a direct result of the attacks.

3:52Hackers hit Arholt supermarkets in Belgium, Luxembourg, the Netherlands and Romania. Hackers have stolen customer data from blockchain hosting platform Chainstack. The incident took place last month. Chainstack says the attacker used AI tools to speed up and automate the intrusion. A threat actor redirected 15 cryptocurrency-related domains to wallet-draining phishing sites in late October. The incident was traced back to a compromised customer support account at the domain registrar, name.com. Affected crypto platforms include Flap, Kintsu, Pickle Finance and Origami Finance. Apple has notified two Thai opposition party figures that their devices were targeted with mercenary spyware.

4:40The People's party leader Natapong Ruan Panyalwut and the Democrat party leader Abhisit Wachachiwa disclosed the attacks in a press conference this week. The two demanded the government confirm its involvement. The Thai government is a known NSO Group customer. Ukraine's intelligence service has dismissed two high-ranking officials as part of an anti-corruption investigation. The two allegedly accepted bribes to allow local scam call centres to operate. The arrests are part of a broader crackdown against local scam centres that led to the firing of Ukraine's Prosecutor General in September. Two Canadian men have been charged with deploying cryptocurrency miners on hacked US university systems.

5:25The campaign ran for three years from 2016 and even breached a US supercomputer. That breach allegedly caused damages of$337 ,000. One of the suspects was extradited and arraigned in a New York court this week. Cryptocurrency companies have quietly pulled the pin on an industry group established to counter crypto crime groups. The T3 Financial Crime Unit was established in 2024 and was backed by Binance, Tron, Tether and TRM Labs. According to Bloomberg, the group helped freeze more than$250 million in stolen assets last year but ceased all activity this August without explanation. A Chinese cyber espionage group has carried out a DNS hijack against the SoGo input method software, delivering malicious updates to Chinese speakers abroad.

6:19The malicious update installed the dark vigil backdoor on targeted systems. ESET says the hackers behind the operation have been active since last year. The company tracks them as slippy nunchucks. Russian espionage group APT29 is conducting a large-scale watering hole attack against Android and iOS smartphones. The group is using hacked websites to run malicious scripts on the devices to steal cookies, Wi-Fi passwords and other data. The campaign is targeting Ukraine and uses older end-day exploits. Threat actors are exploiting a recently patched race condition vulnerability in WordPress. According to Pycas Security, the bug allows an attacker to replace a WordPress site's configuration file during the update process.

7:08The bug was patched last week and CISA added it to the KEV database this week. Syxel has released security updates to patch an actively exploited Zero Day in its GS1900 switch series. The vulnerability has been exploited since June. Attackers used it to deploy the Jitali backdoor and 6-SUT rootkit on almost 1 ,000 devices. According to security firm Binary, an earlier patch didn't actually fix the Zero Day. The exploitation of the Zyxel devices was part of a larger campaign linked to the Red Heron Group that also targeted other technologies. SonicWall will not release fixes for two vulnerabilities in its firewall management platform.

7:52The two bugs allow attackers to read files and execute SQL injection attacks against the company's so-called global management system. SonicWall retired the platform in June 2025. Bitdefender researchers have crafted an app installation package that can put Android devices in a crash loop. The technique is possible due to how Android parses the data stored inside an app's zip installation package. The malformed data can make Android OS map the app to a memory space it didn't allocate and trigger an infinite crash loop. The crash loop also triggers after a phone restart, even if a device is in safe mode.

8:34And finally, the US Department of Justice has fined two defense companies a combined$13 million for lying about their cybersecurity posture to obtain government contracts. ILC Dover and ILC Astrospace stored controlled unclassified information at a cloud provider that lacked FedRAMP accreditation. The two companies also failed to implement cybersecurity controls on their networks and patch vulnerabilities. They had contracts with NASA, the US Army and the Missile Defense Agency. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Sublime Security. Find them at sublime.security.

9:17Thanks for your company.