Attack warning for GPUStack, FreeSwitch, OpenSSH and IBM Aspera Faspex

Attackers are exploiting security vulnerabilities in GPUStack, FreeSwitch, OpenSSH, and IBM Aspera Faspex. Software updates help patch the targeted vulnerabilities.

The U.S. Cybersecurity and Infrastructure Security Agency CISA confirms the observed attacks and has added the vulnerabilities to its “Known Exploited Vulnerabilities” catalog. In GPUStack, an open-source cluster manager for administering AI models and GPU instances, attackers can gain admin access without prior authentication and use those privileges to inject and execute malicious code ( CVE-2026-102895 , CVSS 9.8 , risk “ critical ”). I

FreeSwitch provides telecommunications services such as SIP. Any logged-in account can execute arbitrary code or, for example, read credentials and control calls ( CVE-2026-116779 , CVSS 9.8 , risk “ critical ”). Version 1.11.3 and later fix the vulnerability. With crafted messages, attackers can bypass authorization in IBM Aspera Faspex versions 5.0.0 through 5.0.19 and gain admin privileges ( CVE-2026-123218 , CVSS 9.8 , risk “ critical ”). Version 5.0.19 PL1 and later fix the vulnerability. Version 2.2.0 and later versions of the software fix the security flaw.

A vulnerability was disclosed last week that, in rare configurations, allows password authentication to be bypassed. The flaw occurs when a system uses “musl libc” without PAM and has at least one account with a SHA-256 or SHA-512 password hash. In that case, any password entered for accounts without a password set will work if it is between 257 and 1,024 bytes long ( CVE-2026-123158 , CVSS 8.1 , risk “ high ”). For example, the maintainers of Alpine Linux warned this vulnerability . The problem is not expected to occur with OpenSSH 10.6p2 and later.

As usual, CISA has not provided details the attacks, such as exactly what they look like or how widespread they are. That also means there are no indicators of Compromise (IOCs) — clues that an attack has succeeded — for admins to use when checking their systems. Admins should install the updates promptly if they have not already done so and assume that systems accessible from the internet have been compromised.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.