CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Trust boundaries enterprises assumed were safe failed this cycle. ThisBash shows that a browser extension can drive Claude Desktop through Dispatch and run code on a paired, possibly corporate, endpoint. The cPGuard update-channel hijack ran a credential-stealing script as root on about 2,950 servers, and updating does not revoke the stolen secrets. CVE-2026-123158 lets long passwords bypass sshd on Alpine/musl images, so restart sshd and rebuild containers. Separately, the UK Cyber Security and Resilience Bill now gives ministers powers over AI-agent compromise incidents at deployers.
Overnight Research Output
ThisBash: Browser Sessions as Remote Shells via Claude Dispatch
CRITICAL URGENCY
Summary: Forever Security’s ThisBash research shows that any extension able to script claude.ai could reach Dispatch, send instructions to the paired Claude Desktop agent, and auto-accept its approval prompts to install a malicious npm package. According to The Register, Anthropic accepted the report in May, closed it as a duplicate, issued no CVE, and planned to retire Dispatch by the end of October. The researcher says Claude Code Remote Control and Cowork share the same session design, although that has not been independently reproduced. No in-the-wild exploitation has been reported.
Key Sources:
Forever Security — ThisBash: Claude Dispatch browser extension RCE
The Register — Anthropic won’t fix a Claude Dispatch flaw
The Hacker News — Malicious browser extensions could use Claude Dispatch
Anthropic Help Center — Assign tasks from anywhere in Claude Cowork
Hijacked Security-Agent Updates: The cPGuard Compromise and Root-Level Update Channels
HIGH URGENCY
Summary: On November 2, an attacker reportedly moved from OPSSHIELD’s billing and licensing system to its update-publishing key and pushed a malicious script that ran as root. SecurityWeek reports about 2,950 servers ran it and roughly 7,900 billing records were taken. The script collected password hashes, root SSH keys, MySQL root credentials, and shell history, and left a setuid-root shell. As webhosting.today notes, fixed builds remove the backdoor but cannot revoke stolen credentials.
Key Sources:
The Hacker News — cPGuard update channel hijacked to backdoor Linux servers
BleepingComputer — Hackers hijack cPGuard autoupdate to deploy backdoor, steal data
Help Net Security — Poisoned cPGuard update hits thousands of web hosting servers
Any Long Password Works: CVE-2026-123158 and the Alpine/musl Container Estate
HIGH URGENCY
Summary: According to Alpine’s advisory, sshd built on musl without PAM accepts a 257–1,024-byte password for any account whose shadow field is “*” when another account on the host has a real hash. Exploitation is deterministic, works over a single connection, and needs no special tooling. OpenSSH 10.6p2 and patched Alpine packages shipped November 5. Root is exposed only where PermitRootLogin yes is set, but non-root “*” accounts are exposed regardless. No in-the-wild exploitation has been reported.
Key Sources:
Alpine Linux — openssh-server password authentication bypass
OpenSSH — 10.6p2 release notes
Orca Security — *sshole: OpenSSH authentication bypass on Alpine Linux
BleepingComputer — OpenSSH flaw lets attackers log into password-disabled Linux accounts
UK Cyber Resilience Bill: AI-Agent Incident Powers for Deployers
MEDIUM URGENCY
Summary: The bill completed its Lords stages on November 2 and returns to the Commons. A government clause lets ministers make regulations for incidents in which an organisation loses control of an AI agent. The Register reports these could authorise inspectors, searches, and document seizure. Peers rejected a frontier-developer reporting duty by 165 to 95. Sources disagree on whether the clause was agreed at Report Stage or Third Reading.
Key Sources:
UK Parliament — Lords completes examination of Cyber Security and Resilience Bill
The Register — UK ministers seek powers to investigate when AI agents are let off the leash
CSRB Guide — Cyber Security and Resilience Bill clears the Lords
The Remote Off Switch: Vendor-Cloud Account Takeover as Fleet-Scale Physical Risk
MEDIUM URGENCY
Summary: Since late October, criminals have hijacked Li Auto “master accounts” belonging to Russian owners. They have disabled dashboards and ignition and demanded 45,000–250,000 rubles, according to The Moscow Times. Grey-market imports registered through intermediary phone numbers are hit hardest. CSA’s note generalises the pattern: solar inverters, batteries, EV chargers, and vehicles accept commands from a vendor cloud, and research from 2024 to 2026 shows ordinary web flaws can lead to fleet control. In the 2022 KA-SAT attack, 5,800 wind turbines lost remote control as collateral damage.
Key Sources:
The Moscow Times (RU) — Hackers mass-lock Chinese cars belonging to Russians
Notable News & Signals
Zyxel GS1900 Zero-Day Bypasses June Patch
Binarly reports that CVE-2026-107441, an exploited web-interface flaw, works on switches already patched for CVE-2026-7273. Install the October 22 firmware and verify the running version on every unit.
APT29 Watering Holes Serve Mobile N-Day Exploits
Sekoia links APT29 to compromised and lookalike sites, plus a hijacked analytics tracker, that delivered iOS and Chrome-Android exploit chains to stale devices. Enforce mobile OS patch minimums.
Chainalysis Breach Scope Under Review
Feeds suggest the agentic intrusion reached all customers, which goes beyond Chainalysis’s earlier disclosure. Verify against the official notice before rotating integrations.
Topics Already Covered (No New Action Required)
- OpenAI GPT-6 Cyber / 948 Linux root exploits: Covered by “948 Paths to Root” (Nov 5), “The Disclosure Bottleneck” (Nov 6), and “Gated Exploitation” (Oct 30).
- ChatGPT Lockdown Mode bypass (Check Point): Covered by “When the Sandbox Leaks” (Nov 6).
- ARTEX backdoor / CERT-In AI-driven attack advisory: Covered by two notes on Nov 6 and “Auditable Agents: CERT-In” (Nov 6).
- Chainalysis agentic intrusion: Covered by “Agentic Intrusion Enters the Breach Record” (Nov 3) and a follow-up detection note (Nov 4).
- Binance $6.3B theft / DPRK attribution: Covered by “From One Laptop to $6.3 Billion” (Oct 31).
- European refrigeration and cold-chain attacks: Covered by “When Fridges Fail Together” (Nov 3).
- VOLTA infostealer, XCPE botnet, NIS2 board liability, Black October LLMjacking: Covered Nov 2–5.
- eMudhra intermediate CA compromise: Covered by “When Trust Infrastructure Fails” (Oct 21) and “Credential Custodians” (Oct 22).