SANS Stormcast Friday, November 6th, 2026: RootEvidence Cisco IOS Opt-Out Scans; OpenSSH musl sshhole (CVE-2026-123158); Refrigeration OT Hardening; Zyxel GS1900 OOB Write (CVE-2026-107441)
Runs 7:53. Streams from traffic.libsyn.com only when you press play.
Today: RootEvidence Cisco IOS vulnerability scans with HTTP opt-out headers; a critical OpenSSH password bypass on musl (sshole / CVE-2026-123158); a U.S. government factsheet on hardening industrial refrigeration OT; and an actively exploited Zyxel GS1900 out-of-bounds write (CVE-2026-107441). RootEvidence Cisco IOS Scans / Opt-Out Headers ISC honeypots saw Cisco IOS vulnerability scans from exposure-management firm RootEvidence. Unlike typical Internet-wide scanners, their HTTP requests include Opt-Out-Email and Opt-Out-Url headers so administrators can request exclusion.
Show notes from SANS Internet Storm Center StormCast.
Explained
The technology and terms in this story. Learn more
- TechnologyOpenSSHThe most widely used SSH implementation, shipped with Linux, macOS and Windows.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
