#privileged-access

OpenSSH 10.6p2, released November 5, works around a password authentication bypass in sshd on Linux systems built with musl libc and PAM disabled. An oversized password can log in to accounts meant to be key-only, including root on Alpine.

Binance's initial findings trace the $6.34 billion theft to a September fake recruiter whose coding assignment infected an engineer's Mac. An internal AI tool let the attacker reach two wallet engineers, and a container deployment token on one laptop opened the signing service.

Binance said on October 30 that attackers used a DevOps engineer's compromised laptop to reach a service container and submit unauthorized withdrawals, moving about $6.3 billion on October 29. TRM Labs attributes the theft to North Korea's TraderTraitor; about $2.7 billion was frozen.

Microsoft investigated two intrusions that began with attackers posing as IT support on Teams and ended with Active Directory Certificate Services abuse. ESC1 yielded certificates for 11 privileged accounts, ESC8 one for a domain controller, and one account left out of automated containment carried the data out.

Tailscale published four security bulletins on October 26, fixed in 1.104.4. The worst, TS-2026-014, let an authenticated Tailscale SSH peer allowed to forward ports reach root-only sockets such as Docker or the tailscaled local API.

Cisco FMC, Cisco ISE, N-able N-central and an unnamed security product at Bitget were all exploited in September 2026. Each one held credentials or authority that other systems trust. Patching them is necessary; treating the compromise as an identity incident is what actually ends it.

Attackers exploited a zero-day in an unnamed security product Bitget used, reached an internal management system, and inserted withdrawal commands while posing as administrators. Private keys were never touched; they did not need to be.