Morning Review in IT Security — November 9, 2026

The cybersecurity landscape continues to present urgent threats across multiple vectors this morning, from critical open-source vulnerabilities requiring immediate patching to active exploitation campaigns and supply-chain compromises. Organizations face pressure on multiple fronts as attackers move swiftly to weaponize newly disclosed flaws and target high-value assets.

Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication

A critical security vulnerability in React Server Components enables attackers to execute arbitrary code remotely without requiring authentication. The React team published an advisory tracked as GHSA-xqc2-xf4c-x3h3 on October 14, 2026, assigning the flaw a CVSS v4 score of 9.5. The vulnerability affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages, necessitating immediate updates for all affected applications. Source: Cyber Security News

@ethersphere/bee-js 13.3.0 Compromised

Version 13.3.0 of the @ethersphere/bee-js npm package has been compromised with malicious install-time code designed to target Swarm wallet data and establish persistent access on affected systems. The compromise appears to have leveraged stolen release credentials to inject malicious payloads. Indicators of compromise include the domain api.frameworkmetrics[.]xyz, which was contacted by the malicious code. Source: StepSecurity

Scans for Sshole Vulnerability Detected Across Honeypots

Security researchers monitoring honeypots with Cowrie SSH data collection tools have observed a significant increase in exploitation attempts targeting the sshole vulnerability, tracked as CVE-2026-123158, following its disclosure last week. The activity demonstrates rapid weaponization of the flaw, with multiple source IP addresses launching attacks. Notably, honeypot data collection captured only the first 255 characters of SSH passwords, which is unusual given that typical password brute-forcing attacks do not employ longer password strings. Source: SANS Internet Storm Center

NVIDIA Investigates Suspected Chinese Spy Operation Targeting CEO Jensen Huang

NVIDIA announced on November 8, 2026, that it has initiated an independent investigation into reports of a foreign intelligence operation targeting founder and CEO Jensen Huang. The company's board stated it has no reason to believe that company secrets or U.S. national security have been compromised as a result of the suspected activity. The review will examine the scope and nature of the reported targeting and any potential security implications. Source: Cyber Security News

Organizations should prioritize patching the React Server Components vulnerability immediately, audit their npm dependencies for the compromised bee-js package, monitor for sshole exploitation attempts on SSH infrastructure, and remain vigilant regarding advanced persistent threats targeting executive leadership and sensitive corporate information.