⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More

This week's roundup highlights active exploitation of the OpenSSH flaw dubbed SSHole (CVE-2026-123158, CVSS 8.1), which lets attackers log into passwordless accounts on Linux systems running musl libc with PAM disabled — Alpine Linux's default setup is among those affected, with 20 exploitation attempts already logged from 13 IPs across multiple countries. Also covered: a Debian/Ubuntu APT package manager bug (CVE-2026-109518, CVSS 7.7) that lets a man-in-the-middle attacker trigger root-level code execution through manipulated HTTP package retries, and a Zyxel GS1900 zero-day (CVE-2026-107441, CVSS 8.8) exploited by the Kapibala/Red Heron actor to compromise roughly 1,000 switches worldwide, deploying the JITTERLY backdoor and SIXZUT rootkit before a patch arrived. Other stories in the digest include a trojanized Control Web Panel server spreading the stealthy CWPdoor backdoor, a hijacked cPGuard update channel pushing malware, mSecure's vague breach warning urging password resets, and roughly 15,000 compromised websites tied to a broader campaign — underscoring how supply-chain tampering and legacy misconfigurations keep fueling real-world intrusions.