What Changed This Week for Server Owners: 13 November 2026
The big one this week: an OpenSSH password bypass on musl-based Linux is now on CISA’s exploited list, so check any Alpine boxes. Plex users on Synology also have an update waiting, and OPNsense and Nextcloud both shipped security releases.
Patch now
OpenSSH: password bypass on musl systems is now being exploited
On 9 November, CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities catalogue. It is a password authentication bypass in sshd that only bites Linux systems built with musl libc and PAM support turned off. The OpenSSH team shipped a workaround in Portable OpenSSH 10.6p2 on 5 November, noting the root cause sits outside sshd but can be blocked there. Synology says none of its DSM, SRM, BeeStation or APM releases are affected.
Why it matters: small Alpine-based servers and containers that run sshd with password logins are exactly the setup this hits, and attackers are already using it.
What to do: update OpenSSH to 10.6p2 or your distro’s patched package. If you can, switch to key-only logins; our passwordless SSH guide shows how.
Source: CISA and OpenSSH 10.6p2 release notes
Plex Media Server on Synology: Plex2Shell fixes
Synology published advisory SA-26:17 on 8 November for the Plex Media Server package. It covers the four Plex2Shell flaws (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656), which CISA added to its exploited list on 20 October. QNAP has also said attackers are breaching NAS devices through exposed Plex servers.
Why it matters: Plex is one of the most common apps on a home NAS, and it is often exposed to the internet on port 32400.
What to do: on DSM 7.3 or 7.4, update the package to 1.43.5.11079-720011079 or later; on DSM 7.2.1 or 7.2.2, use 1.43.5.11079-700011079 or later. If you don’t need remote access, turn it off and stop forwarding port 32400. QNAP’s advice is that an exposed, unpatched server should be treated as compromised.
Source: Synology and BleepingComputer
GPUStack: login bypass on self-hosted AI servers is exploited
The same 9 November CISA update added CVE-2026-102895, an improper authentication flaw in GPUStack, a tool for running AI models across your own GPUs. GPUStack’s advisory describes an unauthenticated admin bypass when the server sits behind a reverse proxy or trusts a spoofed X-GPUStack-Real-IP header, and says it saw a real attack on a 2.1.1 install.
Why it matters: home labs running their own models often put GPUStack behind a proxy, which is the risky setup here.
What to do: update to 2.2.0 or later (the latest release is the safer choice). Until then, set force_auth_localhost=true and strip that header at your proxy.
Source: CISA and GPUStack advisory
New releases
OPNsense 26.7.9
OPNsense 26.7.9 landed on 11 November with four new security advisories for the core, covering privilege checks, notification handling, PPP field validation and captive portal template parsing. It also brings OpenSSH 10.6p2 and OpenVPN 2.7.9, and a small 26.7.9_1 hotfix followed.
Why it matters: your firewall is the front door, and this release also pulls in the OpenSSH fix above.
What to do: update from System, Firmware in the web UI, ideally after a config backup.
Source: OPNsense release notes
Nextcloud 35.0.3, 34.0.6 and 33.0.11
Nextcloud released maintenance updates for all three supported Hub 26 lines (Winter, Spring and Summer) on 13 November. The announcement doesn’t list individual fixes, but says they include bug fixes, stability improvements and security upgrades, and Nextcloud strongly recommends updating.
Why it matters: Nextcloud usually holds your files, calendars and contacts, so security upgrades are worth taking promptly.
What to do: back up, then update to the release for your major version. The changelog has the detail.
Using AI safely
Your “pinned” MCP server may be pulling new code every launch
Research from Corelight, reported on 13 November, found an MCP server pinned to one release ran with 15 different dependency sets over five weeks. The uvx launcher skipped the hash-pinned lock file, so dozens of packages came fresh from PyPI on each rebuild. Corelight found 23 of 35 MCP servers it reviewed had install instructions that fetch dependencies from a public registry on every launch or build.
Why it matters: if you give an AI assistant an MCP server with access to your firewall, NAS or monitoring, any dependency that changes silently runs with those credentials.
What to do: install MCP servers once from a lock file, pin them to a commit, launch them directly rather than through npx or uvx with “latest”, and re-lock on a schedule.
That’s the week. If something here affects you and you’d like a full guide, say hello on LinkedIn.
