[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fx2ReuN1azfcOjWQkZnsgY-rK66S3ykPD9raxZBsiKRc":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"9a87fb68-4d4e-411b-842f-1c8ab1694392","⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More","weekly-recap-sshole-exploited-apt-root-rce-robot-takeovers-15k-hacked-sites-and-dca974","A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack. Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed","This weekly recap highlights multiple critical security incidents including SSHole vulnerability exploitation via blank passwords, an APT root-level remote code execution attack, widespread robot\u002Fbotnet takeovers, and compromises affecting 15,000 websites. The article emphasizes how attackers exploit both system misconfigurations and legitimate security tools as attack vectors, while also targeting network devices for credential theft.","Weekly security recap covers SSHole, APT RCE, bot takeovers, and 15K compromised sites.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fweekly-recap-sshole-exploited-apt-root.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiLQ4v79OUmrbGdf2uJWMlUUmpCSu70Pr6v7oyodgSjFMfLU6JIe6Mr7xpp7AnqIX_vmKca44ImxEkczL88e_4sr2oBw0NL3Zh_JVEOb4cYmYg5pjbrITVv6KgPsv13-RrlBjq6bu7inR7w5-seDsUZvoqn6q7idkElfWysH1itsfgI5-NmFZ-BybjG0gR0\u002Fs1600\u002Frr.jpg","2026-11-09T13:28:25+00:00","2026-11-09T15:00:24.258872+00:00",7,[17,20],{"name":18,"type":19},"SSHole exploitation campaign","campaign",{"name":21,"type":22},"APT group conducting RCE attacks","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":25,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[50],{"type":48,"value":51,"context":52},"SSHole","Vulnerability exploited via blank passwords for unauthorized access",[],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"blank-passwords-botnet-takeovers-and-15k-compromised-sites-expose-persistent-security-basics-failure","Blank Passwords, Botnet Takeovers, and 15K Compromised Sites Expose Persistent Security Basics Failures","This week's incidents collectively reveal that attackers continue to exploit foundational security failures — blank passwords enabling SSHole exploitation, misconfigured systems allowing APT root-level RCE, and unpatched or poorly segmented web infrastructure falling to mass compromise. The SSHole vulnerability is particularly alarming because blank or default credentials represent a configuration error that organizations should eliminate before deploying any internet-facing system. When attackers can achieve root-level remote code execution or hijack 15,000 websites at scale, it signals systemic gaps in both preventive hardening and continuous monitoring. These incidents matter because each compromised node becomes a launchpad for deeper intrusion, credential theft, or botnet enrollment, multiplying the damage far beyond the initial victim.",[149,150,151,152,153,154,155],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1078: Valid Accounts","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":157,"MITRE ATT&CK T1078: Valid Accounts":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"CIS Control 7: Continuous Vulnerability Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":162,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":163},"NIS2 requires operators of essential and important entities to implement incident handling and access control measures; the blank-password SSH exploitation and botnet takeovers both represent failures of basic access control that NIS2 compliance would mandate addressing.","Attackers exploiting blank passwords to gain SSH access exemplifies the use of valid or trivially obtained credentials as an initial access technique, underscoring the need for strong credential hygiene and authentication enforcement.","This control requires organizations to identify, report, and correct information system flaws on defined timelines, which would have driven patching of the SSH and web platform vulnerabilities exploited across all incidents.","The APT root RCE and mass website compromises exploited known vulnerabilities; continuous scanning and time-bound remediation would have identified and closed these exposures before attackers leveraged them.","This control requires timely identification and remediation of technical vulnerabilities, which would have mandated action on the SSH flaw and CMS weaknesses before the mass exploitation campaigns succeeded.","SSHole exploitation via blank passwords is a direct result of insecure default configuration; this control mandates establishing and maintaining secure configurations before deployment to prevent exactly this class of attack.","Blank passwords exploited in the SSHole attack represent a complete failure of authentication controls; this CSF outcome requires that credentials be managed and enforced to prevent unauthorized access."]