Five flaws in one week, and the pattern is the supply chain: a package manager, a GPU stack, a debugging tool, SSH and a leaked key

Five flaws, one pattern

The week's vulnerability disclosures share a shape: none of them is a flaw in a model. They sit in the plumbing underneath AI work. Ostorlab reported that APT, the Debian and Ubuntu package manager, could be made to install a package an attacker supplied instead of the one it verified, because the verified package could be replaced during a network retry. Debian 12 and later, and Ubuntu 22.04 and later, run with package retries enabled by default. The flaw, CVE-2026-109518, is rated CVSS 7.7, and no exploitation is known. m:…8384

The fix is telling about the cause. Ostorlab found the vulnerable code opened the download destination without an exclusive-create flag, and the fix opens every download destination with an exclusive flag. Setting Acquire::Retries to zero removes the retry the attack needs, which makes this a one-line mitigation for anyone who cannot upgrade immediately. The fix commit preceded the public advisory by 23 days, and no public proof of concept has been published. m:…8384

The AI stack's weak joints

The most urgent of the five is the one already being used. GPUStack versions before 2.2.0 treat requests appearing to come from 127.0.0.1 as the built-in administrator, and same-host reverse proxies configured with proxy_pass to 127.0.0.1 make remote requests look like loopback traffic. CVE-2026-102895 carries a CVSS score of 9.8 and has been observed exploited in the wild against a 2.1.1 deployment, where attackers created inference backends that ran reverse shells on worker hosts. m:…0669

GPUStack 2.2.0 removes the loopback shortcut entirely, requiring authentication for all requests. But upgrading does not revoke API keys an attacker created before the upgrade, so anyone who ran an exposed deployment needs to audit keys as well as upgrade. The same theme runs through Pillar Security's finding in the MCP Inspector, the official debugging tool for the Model Context Protocol. An attacker-controlled remote MCP server could execute arbitrary code on a developer's Windows or WSL machine during the OAuth process, with no user interaction. m:…0669 m:…9515

The MCP Inspector flaw, CVE-2026-119025, was rated High with a CVSS 4.0 score of 7.7, and the fix shipped in version 2.12.0. The root cause was the 'open' package, versions 10.x and below, improperly handling URLs in PowerShell, and the flaw was exploitable because auto-open was on by default in an interactive terminal. Pillar notes the Inspector is widely used, with 11,000 stars and 768,000 weekly downloads, and over 80% of 'open' package weekly downloads still resolve to an affected version. The tool built to vet untrusted servers was itself trusting them. m:…9515

SSH and the leaked key

The fourth flaw is older infrastructure with a new twist. Ethiack reported CVE-2026-123158, dubbed sshole, which allows unauthorised SSH login without a password on musl-based Linux systems. The bug occurs because musl's crypt() returns '' for keys longer than 256 bytes, matching the '' stored in /etc/shadow for passwordless accounts. Alpine Linux official cloud images from 3.18.11 to 3.24.3 are exploitable for root access if any $6$ hash exists on the system. The vulnerability affects OpenSSH versions before 10.6p2 when built without PAM, and glibc-based distributions like Debian, Ubuntu, Fedora and RHEL are not affected. m:…3920

No exploitation in the wild had been reported as of November 5, 2026, and the fix rejects any stored hash shorter than four characters. But Ethiack warns that upgrading the OpenSSH package does not automatically restart the service; users must run rc-service sshd restart. A patched package with a running vulnerable daemon is still vulnerable, which is the kind of detail that gets lost between the advisory and the fleet. m:…3920

The fifth item is not a CVE at all, and it may be the most useful. Aikido's researchers argue that deleting a file, rewriting git commit history, or deleting a repository does not protect a leaked secret, because attackers routinely scan the internet for secrets and should be assumed to already have a copy. Their example is LiteLLM, whose developers accidentally committed an administrative key to a public GitHub repository in May, deleted the file within three hours, and still saw the key stay live for over four months before an attacker used it to pull a GitHub token. GitHub still serves 'deleted' commits to anyone who has their SHA-1 hash. Credential rotation is the only action that fully protects an account after a secret is exposed. m:…9709

What to do this week

The practical list is short. Upgrade APT or set Acquire::Retries to zero; upgrade GPUStack to 2.2.0 and audit API keys created before the upgrade; update the MCP Inspector to 2.12.0 and the 'open' package to 11.0.0; upgrade OpenSSH to 10.6p2 on musl systems and restart sshd; and rotate any credential that has ever appeared in a repository, whether or not the file was deleted. None of this is novel, which is the point. The week's flaws were not in exotic model behaviour. They were in package managers, proxies, debuggers, SSH and git history — the ordinary infrastructure that AI teams now depend on without thinking about it. m:…8384 m:…0669 m:…9515 m:…3920 m:…9709

The deeper lesson is about where AI security attention goes. Jailbreaks and prompt injection get the conference talks, but this week the exploitable surface was the serving stack, the developer's debugging tool and the package manager on the build machine. GPUStack's flaw was exploited in the wild while the others were still being disclosed. Teams that patch models' guardrails and ignore the infrastructure around them are defending the wrong layer. m:…0669 m:…8384 m:…9515