BTH News: AI Finds 948 Paths to Root, a Password That Shouldn’t Work, and an Outlook Zero-Day

November 12, 2026

Artificial intelligence is finding security flaws faster. A bizarre password bug can unlock certain Linux accounts. Attackers are exploiting an Outlook vulnerability that scores just 6.5 out of 10. And a trusted IT support platform may have helped attackers reach hundreds of service providers.

Different stories, same problem: defenders have less time to decide what matters and act.

AI Developed 948 Linux Exploits. Now What?

OpenAI says an automated research system reproduced 1,724 Linux kernel vulnerabilities and created working exploits for 948 of them.

The research took place in a controlled environment. These were not attacks against 948 real-world systems. The exploits showed how someone with limited access to a Linux computer could use a vulnerability to gain full control.

The system searched the Linux kernel for possible security problems, tried to reproduce them, built exploits, explained their causes, and suggested patches.

OpenAI reported 304 critical findings to Linux maintainers with possible fixes. GPT-6 Cyber also found 81 previously unknown Firefox vulnerabilities that Mozilla rated high severity. Mozilla has already fixed many of them.

The results come from OpenAI, but they show where vulnerability research is heading.

AI can search huge amounts of code and test weaknesses much faster than a person working alone. Human researchers still have to review the results, remove false alarms, work with developers, and make sure the fixes do not cause new problems.

AI does not remove the hard parts of vulnerability management. It makes discovery much faster—for defenders and attackers.

The threat is not simply more vulnerabilities.

It is less time.

Sources: OpenAI’s Linux research report and GPT-6 Cyber announcement.

The Password Was Disabled. The Login Still Worked.

Imagine disabling password access to an account, only to discover that an attacker can log in by entering 257 characters of almost anything.

That is the basic idea behind SSHole, a vulnerability affecting certain Linux systems that combine OpenSSH with the musl software library and do not use PAM.

Linux stores an asterisk in some account records to mean password login is not allowed. When musl receives an oversized password, it can also return an asterisk as an error. OpenSSH compared the two values, saw a match, and allowed the login.

The bug does not affect every Linux computer. Alpine Linux systems and some embedded products deserve the most attention.

Organizations should install the fixes supplied by their Linux distribution or product vendor. Disabling SSH password login and requiring keys also blocks this attack path.

An asterisk meant “login disabled” in one place and “error” in another. Put them together, and the password that should never work suddenly does.

Source: OpenSSH security release notes.

Outlook’s 6.5 Is Already Being Exploited

Microsoft patched an Outlook for Windows vulnerability that attackers are already using.

CVE-2026-124194 has a CVSS score of 6.5. On a Patch Tuesday list filled with higher scores, it would be easy to overlook.

That would be a mistake.

An attacker can create an Outlook message file that exposes Windows authentication information when the victim opens it. The stolen information may help an attacker impersonate the victim or move deeper into a network.

A score of 6.5 sounds moderate. Active exploitation is not.

This supports a point I made in How to Prioritize Vulnerability Remediation: attackers do not care whether a vulnerability is labeled critical, high, or medium. They use what works.

CVSS describes how severe a vulnerability could be. It does not tell us whether attackers are using it, whether the affected system is exposed, or what an attacker could reach next.

I recently explored those differences in CVSS, KEV, and EPSS: Three Signals, Not One Answer.

Organizations using an affected version of Outlook for Windows should install the available Office updates. Security teams should also consider controls that limit outbound NTLM authentication and SMB connections to untrusted systems.

Do not let a lower score hide a problem attackers are already using.

Source: Microsoft’s advisory for CVE-2026-124194.

When Your IT Support Tool Helps the Attacker

ConnectWise is investigating unauthorized access to ScreenConnect partner accounts and the installation of unauthorized remote-access software in customer environments.

ScreenConnect allows managed service providers to reach customer computers, install software, and solve problems remotely.

Those same powers make it valuable to an attacker.

ConnectWise identified five third-party extensions that may be connected to the activity. It found at least one of them in about 400 partner environments and disabled the extensions in the cloud environments it controls.

That is not a confirmed victim count. The investigation continues.

The incident highlights two risks.

First, cloud services can become valuable single targets. Compromising a platform used by hundreds of service providers may create paths into thousands of customer systems.

Second, extensions add code and access from another developer. That is true whether the extension runs in your browser or an IT administration platform. Every extension creates another relationship you must trust.

Organizations should know which extensions are installed, what access they have, and whether anyone still needs them. Remove unused or unsupported extensions and keep the rest updated.

Customers should also know which service providers can remotely access their systems. That access should use strong multifactor authentication, limited permissions, and logs the customer can review.

Cloud management can reduce risk. It can also concentrate it.

Source: ConnectWise’s November 11 ScreenConnect advisory.

France Blames Iran for the Refrigeration Attacks

France has blamed Iran for the October cyberattacks that disrupted supermarket refrigeration systems at more than 700 locations.

French authorities attributed the attacks to Shahid Kaveh, a cyber unit connected to Iran’s Islamic Revolutionary Guard Corps.

The attacks placed refrigeration systems into abnormal defrost cycles, damaging equipment, starting fires, and spoiling food worth tens of millions of euros.

ANSSI says investigators found links including the attackers’ infrastructure, recognizable tools, Persian-language traces, and promotion by a group connected to the unit.

I have already covered the incidents in detail, so I won’t repeat the technical story here.

The practical lesson remains the same as the one in this week’s article, Internet-Connected Doesn’t Mean Internet-Accessible.

A refrigeration controller can use the Internet for remote monitoring without exposing its control panel directly to everyone online. Use a secure cloud service, VPN, or Zero Trust Network Access instead.

Sources: France’s attribution statement and ANSSI’s investigation summary.

The Week’s Takeaway

AI is speeding up vulnerability research. OpenSSH showed how two small software behaviors can combine into a serious problem. Outlook reminded us that attackers do not sort targets by CVSS score. ScreenConnect showed how cloud platforms and extensions can concentrate risk. France demonstrated that exposed operational technology can become a target for national sabotage.

Discovery is getting faster. Exploitation is getting faster.

The biggest number on the screen is not always the biggest problem.