[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (CISA KEV catalog 2026.11.09, four entries added Nov 9, federal due date Nov 12, forensic triage required; ransomware use Unknown for all four); vendor fixes per GPUStack GHSA-gj9m-f8ph-pmhr, IBM bulletin 7295921, OpenSSH 10.6p2 and FreeSWITCH GHSA-mg63-h38w-8p9p

CISA KEV adds four with a three-day deadline: SSHole in OpenSSH, GPUStack's loopback admin bypass, FreeSWITCH SIP command injection and IBM Aspera Faspex privilege escalation

  • OpenSSH CVE-2026-123158 (SSHole): upgrade to OpenSSH 10.6p2 or your distribution's patched package (Alpine published its own advisory Nov 5). Prior items cover the exploitation evidence from watchTowr, Previdian and SANS ISC.
  • GPUStack CVE-2026-102895: upgrade to gpustack 2.2.0. If you can't yet, set force_auth_localhost=true, strip client-supplied X-GPUStack-Real-IP at the edge, and keep the API off untrusted networks. After upgrading, review admin API keys (scope *) and inference backends created from YAML, since minted keys stay valid.
  • FreeSWITCH CVE-2026-116779: upgrade per GHSA-mg63-h38w-8p9p; if SIP chat is unused, enable-chat=false on every profile closes the reported path.
  • IBM Aspera Faspex CVE-2026-123218: upgrade to 5.0.19 PL1 and confirm the faspex-core image reads 5.0.19 (1ce4b13, Fix Pack 1). Exploitation needs an authenticated user, so external-user and guest accounts are the exposure.
  • Deadline: Nov 12 is unusually short. CISA's KEV notes tell agencies to discontinue use if mitigations aren't available.

Sources: CISA Known Exploited Vulnerabilities Catalog (four entries added Nov 9) · CISA KEV JSON feed (catalogVersion 2026.11.09) · GPUStack advisory GHSA-gj9m-f8ph-pmhr: authentication bypass via trusted loopback source grants unauthenticated admin · IBM Security Bulletin: IBM Aspera Faspex authorization bypass (CVE-2026-123218) · OpenSSH release notes (10.6p2, Nov 5) · FreeSWITCH advisory GHSA-mg63-h38w-8p9p