2026-11-06
1. SSH: Check musl systems without PAM
A security issue in the interaction between OpenSSH and musl can, under specific conditions, allow password authentication for accounts that should not accept passwords.
This is not a general flaw in all OpenSSH installations. The described configuration requires musl, SSH without PAM, enabled password authentication, an account with * in its password field and another account with an actual password hash. Alpine and some embedded Linux environments warrant investigation. An Alpine container image alone is not evidence of an exposed SSH service.
The technical disclosure identifies OpenSSH 10.6p2 as the fix. Check distribution updates, as fixes may be backported. The extent of any exploitation has not been established here.
Action: Inventory exposed SSH services running on musl and install your distribution's fix. Disable password authentication where unnecessary. Verify key-based access first and keep an existing session open while making changes.
Sources: Technical description and fix
2. Claude Code: Report of email addresses in outgoing requests
A bug report describes Claude Code sending the user's email address in the User-Agent header of web requests without permission. It concerns version 2.1.318 on macOS and was opened on 2026-11-05.
A built-in privacy safeguard was intended to block this behaviour from version 2.1.317. Gaps in the checks have subsequently been reported. It remains insufficiently established whether the safeguard covers all relevant cases.
The report does not establish that all installations are affected. A claimed connection to subsequent scam emails has not been established either. A local test of a safeguard is not, by itself, evidence of a network request leaking data.
Action: Restrict agents' access to personal data and inspect actual outgoing requests. If an integration requires a contact address, use a separate, approved address rather than the user's private details.
Sources: Bug report, response and follow-up observations
3. Microsoft Paint: Check the application fix, not just Windows Update
CVE-2026-83844 is an out-of-bounds read vulnerability in Microsoft Paint that can enable remote code execution. It was disclosed on 2026-10-13, so this is not a new disclosure this morning.
The official assessment describes a network attack requiring neither authentication nor user interaction, but with high attack complexity. At the original disclosure, the flaw was not listed as exploited. That does not guarantee the current threat status.
The documentation contains different version references: The update table lists build 11.2609.401.0, while the CVE record lists affected versions before 11.2605.91.0. Do not use this briefing alone to determine a safe minimum version.
Action: Update Paint through your managed application channel or Microsoft Store and check the installed version against the current update guidance. An updated operating system is not, by itself, evidence that the application is patched.
Sources: Security advisory and update table · CVE record