Microsoft Audits Rust Library as OpenSSH Flaw Hits Linux Hosts

Foundational software libraries and Linux cloud infrastructure faced intense security scrutiny on Monday as Microsoft's FORGE Lab disclosed memory-safety soundness bugs in Rust's standard library, threat researchers tracked active exploitation of the "SSHole" OpenSSH vulnerability on Linux hosts, and cloud provider Beget worked to rebuild 1,000 servers from scratch following a destructive data-wiper attack.

Microsoft FORGE Lab Identifies Soundness Bugs in Rust's Standard Library

Researchers at Microsoft's FORGE Lab—whose team previously created the Rudra static analyzer in 2021—used Hyenas, the frontier research version of an AI-powered vulnerability scanner codenamed MDASH, to audit unsafe blocks inside Rust's foundational std and core libraries. With Rust designated a Tier-1 internal language at Microsoft alongside C++, C#, and TypeScript, and adopted in GitHub Copilot's agent runtime, Bun, Android, the Linux kernel, and Cloudflare, billions of people interact with Rust-based software daily.

The audit identified three recurring patterns of misplaced trust in unsafe code:

• Panic safety bugs: In Rust 1.97.0, MapWindows::clone (issue #156501) armed a destructor over uninitialized MaybeUninit slots before calling user Clone code, fixed by wrapping the buffer in ManuallyDrop. Similarly, unsound allocator unwinding in BTreeMap::insert and related reports (#159334, #159368, #159370) led maintainers to require that custom allocators never unwind when the Allocator API stabilizes in Rust 1.100 on November 12.
• Trusting caller trait implementations: In Rust 1.96.0, str::replace (issue #156491) trusted a custom Pattern returning a single non-ASCII byte (0x80), producing invalid UTF-8 strings; maintainers fixed it by storing &str instead of &[u8]. The researchers also noted incomplete fixes in join (first patched as CVE-2020-36323 in 2020 and patched again in April 2026) as well as open range-checking issues in strip_prefix_of (#158265) and split_once (#165076 and #164904).
• Trusting operating-system state: In Rust 1.98.0, calling process::exit from a spawned secondary thread (issue #161018, a bug dating back 11 years to 2015) unmapped the main thread's alternate signal stack (MAIN_ALTSTACK) via munmap while the main thread was still running. In Rust 1.99.0, CommandExt::exec (issue #156951, dating to 2021 after a 2018 lock change and 2024 edition env::set_var update) modified the process-global environ pointer while holding only a read lock, alongside a separate thread-local destructor double-free report (#164243). Findings from MDASH now feed directly into Microsoft Defender and the multi-agent Microsoft Perception security system.

Hackers Exploit 'SSHole' OpenSSH Vulnerability on musl Linux Systems

In operational cloud security, multiple threat intelligence firms confirmed active exploitation of "SSHole" (CVE-2026-123158), an OpenSSH authentication bypass disclosed by security researcher Ozgun Kultekin that affects musl-based Linux distributions such as Alpine Linux. When an account's /etc/shadow password field is set to an asterisk (*) to block password logins, supplying an oversized password causes musl's hashing function to return * on error, which OpenSSH prior to version 10.6p2 mistakenly accepts as a match.

OpenSSH maintainers released version 10.6p2 on November 5, 2026, roughly four hours before proof-of-concept code became public. Attack attempts began on November 5, watchTower observed botnet and cryptomining exploitation on November 6, and GreyNoise recorded its first successful in-the-wild compromise on November 7 at 00:46 UTC—about 40 hours after the patch—logging 16 exploitation chains from 6 source IP addresses amid 27.5 million port-22 scans and 20.1 million attempted SSH sessions. Network security firm Previdian recorded 20 exploitation attempts from 13 IP addresses across 9 countries, while Finnish firm Defused also tracked probing. In one breach analyzed by GreyNoise, attackers gained root access and installed TAC Agent, a Python command-and-control implant configured to contact tac.vpnla.org.

Cloud Provider Beget Rebuilds 1,000 Servers After Data-Wiper Attack

Meanwhile, Russian web-hosting and cloud provider Beget—which serves more than 200,000 customers—is rebuilding its cloud architecture from scratch after attackers breached its management layer on the night of November 1 and executed data-zeroing scripts across its VPS, S3, and Kubernetes clusters. Following status updates on November 3 and November 6, Beget reported that 60% of its shared hosting and 40% of its dedicated servers have been restored as engineers manually inspect roughly 1,000 servers for hidden scripts. While VPS binary backups were completely wiped, Beget estimated that surviving VPS file backups will be recoverable for roughly half (50%) of its VPS customers.