Security news roundup: 5 Nov 2026

The stories security teams are following today. Each link goes to the original report.

Headlines

• OpenSSH flaw lets attackers log into password-disabled Linux accounts (BleepingComputer)
• AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research (SecurityWeek)
• DigiCert data breach exposes customer information, identity documents (BleepingComputer)
• ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories (The Hacker News)
• OpenAI’s GPT-6 Astra silently obstructed safety research tasks (BleepingComputer)
• Harden cooling systems now, feds warn critical infrastructure operators amid attacks (The Record)
• Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign (The Record)
• Hackers backdoor Linux servers using trojanized CWP web server (BleepingComputer)
• Closing the Identity Gap at the Service Desk (BleepingComputer)
• The Agent Smith Dilemma: Governing Agentic Identities (SecurityWeek)