Jaroha
Clear reporting on money, health, technology and modern life
The latest Cybersecurity stories from Jaroha.
OpenSSH 10.6p2, released Nov. 5, works around a flaw that lets a very long password log an attacker into accounts that have no usable password. It affects Linux servers using the musl C library without PAM, not Debian, Ubuntu, Fedora or macOS. Evidence on consumer routers is thin, and the likeliest router exposure is a manually installed OpenSSH server.
OpenAI introduced GPT-6 Cyber on Nov. 5, 2026, and rates it Critical, its top cyber tier. The headline counts come mainly from OpenAI itself, and the bottleneck they reveal looks like fixing bugs rather than finding them. For ordinary users, official advice on updates and logins stays the same.
Material Security says a campaign running since mid-August 2026 used Google Calendar invites to send corporate users to a proxy of Google's sign-in page, capturing sessions even after MFA. The report is the only source for the campaign's details, but the relay technique and the defenses against it are established.
Device-code phishing tricks a person into approving the attacker's own sign-in request on Microsoft's genuine login page, so the attacker receives tokens rather than a password. Microsoft has tracked the technique from a 2024 espionage campaign to mass-market kits in 2026, and a kit called SkyW4lker is the newest reported example.
Security vendors documented fake ChatGPT and Claude installers, ads and invitation emails throughout 2026, some running the real app while malware works in the background. Appearance is an unreliable test, and the most dependable habit is checking provenance: how you reached the page, not how it looks.
The FTC advises staying calm and matching the response to the type of data exposed: logins, financial details or ID documents. DigiCert and DreamHost serve as worked examples, though public details on both remain thin and mostly secondhand.
Apple's latest threat notifications reached targeted users in 99 countries, and Germany's cybersecurity agency told recipients to assume their devices may be compromised. Here is what the alerts do and do not establish, how to confirm one is genuine, and what Lockdown Mode and device checks can realistically offer.
Quest Diagnostics says someone accessed its Quanum LSM system on or around October 21, 2026, and that personal or health information was part of it. The company has not said which data fields or how many people are involved. This guide separates what is confirmed from what is not and sets out the FTC's general steps.
Official guidance favors long, random passwords over symbol-heavy rules, and a passphrase of random words is the usual method for the few secrets a person must memorize. For everything else, agencies point to password managers, multifactor authentication and passkeys. The evidence on memorability is thinner than the guidance suggests.
