11/04/2026-11/11/2026 Git Patches Flaw That Lets Malicious Repositories Execute Code; Debian and Ubuntu APT Flaw; Hackers Compromise Ethersphere’s bee-js and Swarm Desktop And More.

1. Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

A flaw in Git can let a malicious repository run an attacker’s code when cloned recursively with its submodules. The fix shipped this week in Git 2.56.1, with backports in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1.

Tracked as CVE-2026-111760, it is an integer truncation in index handling. An extremely long path passes Git’s safety check but is written to disk under a shorter name an attacker can set to .git. In a fresh submodule, .git is a file, so it can be swapped for a symbolic link to a folder of malicious hooks.

GitHub has patched github.com and Enterprise Cloud, and Enterprise Server 3.19.15, 3.20.11, 3.21.9 and 3.22.4 include the fix. GitHub Desktop, Copilot app, Codespaces and Actions will follow. Git for Windows had no 2.56.1-based release as of Tuesday, 19:09 UTC.

Until patched, clone only from trusted servers, avoid recursive clones of untrusted repositories, and don’t merge untrusted content or process untrusted binary patches or fast-import streams. The releases also fix CVE-2026-113408, -114467, -114469, -105437 and -114466, covering path traversal, memory corruption and unsafe fast-import features. For -105437, servers can set conflict-marker-size=7 in info/attributes or disable merge checks for untrusted repositories.

2. Debian and Ubuntu APT Flaw Lets Hackers Hijack Software Updates and Execute Code as Root

A newly disclosed flaw in APT, the package manager behind Debian and Ubuntu, lets a network attacker swap a trusted package for a malicious one, gaining root code execution. Tracked as CVE-2026-109518, it was announced by Debian on November 4, 2026.

APT verifies packages against signed data, but after an HTTP redirect it can merge two downloads sharing the same address. When resuming an interrupted download, it mishandles the file, opening a window to replace the package after verification.

The attacker must sit between the client and the archive server, on Wi-Fi, through a rogue proxy, or via a malicious mirror. The bug requires redirects, retries, and hard link reuse, and only works when Acquire::Retries is above zero.

Fixes: APT 2.6.2 (bookworm), 3.0.4 (trixie), and 3.3.6 upstream. Ubuntu needs its own patches. Users should update on trusted networks and avoid untrusted mirrors. Setting Acquire::Retries to 0 is a stopgap. No active exploitation has been reported.

3. Hackers Compromise Ethersphere’s bee-js and Swarm Desktop to Deliver Wallet-Stealing Malware

Attackers abused Ethersphere’s own release automation to publish malicious versions of two Swarm tools: bee-js 13.3.0 and Swarm Desktop 0.56.2. Both download code that steals the node wallet key and its plaintext password from config.yaml, and installs a backdoor on Windows, macOS and Linux (evjawbreaker on Linux/macOS, ScreenConnect on Windows).

bee-js 13.3.0 was live on npm for about 75 minutes; its postinstall script ran without the library being imported. Swarm Desktop 0.56.2 was available about 8.5 hours, with the updater offering it to Windows x64 and Apple Silicon Macs. Both are withdrawn; clean version 0.56.3 is out. Removal doesn’t clear existing backdoors or stolen keys. Download counts were low, and no theft has been reported.

Attackers used stolen CI credentials; the releases carried valid provenance. Socket links the group to the SleepyDuck/EtherDuck campaigns.

Defenders should treat affected machines as compromised, rotate secrets, move funds, remove ~/.solidity and related services, and search for api.frameworkmetrics[.]xyz.

4. SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, to run code on a NEAR AI inference server. Because SGLang runs inside the trusted execution environment (TEE), the attacker could have seen that day’s requests, including confidential-mode ones. The company noted a TEE doesn’t protect against vulnerabilities in software running inside it.

The attacker then moved into an internal system behind the deprecated Private Chat product, downloading names and emails of about 100 users, plus plan and balance data for some. No stored conversations or files appear to have been accessed. The attacker also took chat history, settings and logs from 18 agents on an older NEAR AI Agents deployment outside the TEE. Two customers’ API keys exposed in logs were revoked.

NEAR AI revoked sessions and credentials, took Private Chat offline, patched all inference servers and completed a forensic review, per its incident report. It hasn’t named a CVE, affected versions, or whether SGLang has issued a fix, nor whether Brave’s Leo chats were affected.

5. Claude Dispatch Flaw Lets Malicious Browser Extensions Run Code on Connected Computers

A flaw in Anthropic’s Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop. That computer could even be a different machine signed into the same Claude account.

Researcher Gal Weizman of Forever Security named the technique ThisBash and published the findings on November 4, 2026. 

Dispatch sends tasks from a phone to Claude Desktop, but the web version of claude.ai only hid the Dispatch link. An extension could open Dispatch using the user’s cookies, locate the desktop agent’s session ID, and send instructions. When Claude balked at installing an unknown npm package, the script kept rephrasing, a technique called prompt forcing. Four prompts sufficed, and a loop auto-clicked “Allow.” The package ran and opened Calculator, though it could have stolen files.

Risk is highest when personal accounts are used on work laptops. Weizman reported it May 14; Anthropic closed it as a duplicate and plans to retire Dispatch, but similar designs persist in Claude Code Remote Control and Cowork.

Defenders should inventory AI agents, disable cross-device control, restrict extensions, and keep personal and work accounts separate.

6. OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass

OpenSSH has issued emergency patches for a high-severity authentication bypass dubbed SSHole (CVE-2026-123158, CVSS 8.1). It affects sshd on musl-based Linux distributions, such as Alpine, OpenWrt, Buildroot and Yocto, when PAM is disabled. A misinterpretation of what counts as a password hash lets attackers log in to certain accounts with any password of 257 to 1,024 characters, including accounts like root that should never accept one.

Exploitation requires an account whose password field is “*” (typical for key-only accounts) and at least one other account with a 5 or 6 hash. Alpine says one connection is enough, with no retries needed. All Alpine releases from 3.16 onward are affected.

Fixes arrived in OpenSSH 10.6p2. Developer Damien Miller said the release was rushed because AI agents rediscover bugs within hours, making long embargoes dangerous. No exploitation has been reported, but researchers expect scanning within hours or days. Users should patch and restart sshd, or disable password logins as a temporary mitigation.