Today’s theme is credentials with legs. Not just hashes, not just dumps, but live tokens, session cookies, and the keys that let an attacker skip the boring part.

Today's Top 5

1. All Chainalysis user tokens exposed: Chainalysis says a malicious actor accessed customer info including password hashes and live tokens for all users. If your IR plan treats tokens like “nice to have,” today is your reminder. Source
2. DreamHost File Manager spill: DreamHost says an intruder accessed the server behind its web File Manager and could see FTP/SFTP usernames and passwords for users who logged in during the window. The interesting question is what else those creds unlocked downstream. Source
3. OpenSSH “*sshhole” password bypass: A bug in the OpenSSH and musl combination lets attackers log into certain password-disabled accounts by sending an oversized password. It’s the kind of edge case that lives in prod for years, until it doesn’t. Source
4. Cisco UCS Central RCE: Cisco patched CVE-2026-76506, an RCE issue in UCS Central Software. This is a classic “management plane” problem, where the tooling meant to make life easier becomes the attacker’s favorite shortcut. Source
5. Barracuda path to root: Barracuda fixes include an ESG auth bypass and a command injection that can lead to root-level code execution when chained. Email gateways keep collecting “crown jewel” privileges for doing table-stakes filtering. Source

Why today matters: We are watching a shift from “breach equals stolen records” to “breach equals stolen operating access.” Live tokens, session state, FTP/SFTP credentials, and management-plane bugs all compress time-to-impact. CISOs should be nervous if their controls stop at password resets and don’t include token revocation, key rotation, and hard segmentation around admin tooling.

XERJ Corpus Hub: Working the OpenSSH “*sshhole” mess? An AI agent loading falco-rules could draft a tight runtime alert for suspicious sshd auth patterns (oversized password attempts, new sessions to key-only accounts), then hand you a deployable rule and test plan in minutes. Pull a corpus at hub.xerj.org.

Alright, onto the blast radius.

Data Breaches

1. Chainalysis says all users’ tokens exposed: Chainalysis issued a new update saying customer information including names, usernames, password hashes, and live tokens for all users were exposed to a malicious actor. Treat this like an identity incident, not a PR incident, because tokens travel. Source: The Record
2. DreamHost File Manager breach: DreamHost says an unauthorized party accessed the server behind its web-based File Manager and could access FTP/SFTP usernames and passwords for users who logged in between roughly August 2026 and Oct. 23, 2026. It also warns a limited number of webmail sessions may have been exposed. Source: BleepingComputer
3. mSecure password manager breach notice: mSeven Software (mSecure) told customers it found suspicious activity associated with the mSecure application and urged users to rotate passwords, reset 2FA, and remove passkeys. The core risk is encrypted vault data plus weak master passwords, and nobody wants a repeat of that movie. Source: TechRadar
4. NVIDIA Brev incident may expose SSH keys for customer VMs: Reporting indicates unauthorized activity on NVIDIA’s Brev developer platform over a 16-day window, with concern that Brev-provisioned SSH keys used to access customer VMs may have been exposed and later rotated. If your dev platform owns your keys, it owns your incident. Source: Tom's Hardware

Security Research

1. OpenSSH “*sshhole” disclosure thread: The original oss-sec post details how OpenSSH on musl systems without PAM can allow a password-authentication bypass in specific configurations. If you run Alpine in prod because it’s “minimal,” you still have to inventory it like everything else. Source: oss-sec / seclists.org
2. Wakefield write-up on OpenSSH musl bypass: Wakefield published a practical breakdown, affected conditions, and notes that OpenSSH 10.6p2 (released Nov. 5, 2026) contains the fix. This is the kind of bug your scanner misses if it only keys on CVE banners. Source: Wakefield
3. Ars Technica on “passwordless” logins via oversized password: A readable explainer on the OpenSSH plus musl interaction, why Alpine is the common case, and how defaults can mislead operators into thinking password auth is fully dead. Source: Ars Technica
4. Android November 2026 patches: Google’s November updates fix 200+ issues, including a critical Framework bug tracked as CVE-2026-58868 that requires no user interaction for exploitation. For CISOs, this is a patch velocity test for fleets, not a reading assignment. Source: SecurityWeek
5. SecurityWeek roundup, Cisco and WatchGuard advisories: SecurityWeek flagged WatchGuard AuthPoint Authentication Gateway issues (multiple auth flaws) and reiterated Cisco’s UCS Central RCE. Worth it if you manage appliances that quietly ship kernels you do not track. Source: SecurityWeek

Top CVEs

1. CVE-2026-76506: Cisco UCS Central Software remote code execution vulnerability. Cisco says an authenticated attacker could execute arbitrary code remotely (and potentially leak information), with no workaround listed in the advisory. Source
2. CVE-2026-116606: Barracuda Email Security Gateway authentication bypass that can open a path to root when paired with other issues. If you treat your email gateway as “just a box,” this is how it becomes a beachhead. Source
3. CVE-2026-111560: Barracuda command injection vulnerability that can allow OS commands to run as root in impacted products. Chaining scenarios should be assumed, because attackers love glue code. Source
4. CVE-2026-123158: OpenSSH on musl systems without PAM, tracked for the “*sshhole” password authentication bypass and mitigated in OpenSSH 10.6p2 and distro updates. Expect noisy internet scanning once patch notes hit the group chats. Source
5. CVE-2026-58868: Android Framework vulnerability patched in the November 2026 security updates, described by Google as exploitable without user interaction. If you support BYOD or rugged devices, your MDM compliance gates should enforce the patch level. Source

Podcasts & Talks

1. Risky Business #858, “The $6.3b laptop”: A good listen if you want a reality check on how big-money crypto incidents still come down to operational mistakes and access controls, not wizardry. Listen: Risky Business
2. Darknet Diaries (Nov 3, 2026 episode): A follow-up style episode that’s useful for CISOs because it’s about the humans, planning, and consequences when “physical meets cyber” in a real operation. Listen: Darknet Diaries

Final Words

The uncomfortable pattern today is that the best targets are no longer databases, they are the systems that mint access. Password managers, web hosting file managers, identity tokens, SSH keys, and management planes all sit upstream of everything you actually care about. If attackers can steal the “things that let them act,” the rest of your controls become documentation.

This week, do three things:

• Force a Chainalysis access review: rotate API keys, revoke all sessions, and validate SSO configuration and token lifetime policies for every Chainalysis tenant user.
• Inventory DreamHost exposure: identify any accounts that used files.dreamhost.com File Manager in Aug 2026 to Oct 23, 2026, then rotate FTP/SFTP creds and audit downstream reuse across CI, CMS deploy keys, and backups.
• Patch OpenSSH to 10.6p2 (or distro backport) on musl-based hosts without PAM, and add a temporary control to rate-limit and alert on oversized SSH password attempts.

Your turn: If a vendor told you today that live tokens for all users were exposed, do you have a written, tested “revoke everything” playbook for that SaaS, or are you about to improvise on a Friday? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone who still treats session tokens like “not real credentials”? Forward them this issue and point them at the Chainalysis update, it costs 30 seconds and the alternative costs a lot more. For forwarded readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!