CISA added four actively exploited bugs to its KEV catalog Monday. One is SSHole, which I’ve already covered a lot. The other three are worth a look if you self-host AI or VoIP.
The three
- GPUStack (CVE-2026-102895, 9.8): unauthenticated admin access, including user and model changes, persistent admin API keys, leaked worker and cloud secrets, and code execution. Fixed in July.
- SignalWire FreeSWITCH (CVE-2026-116779, 9.8): code injection leading to credential disclosure, call control and command execution. Fixed in October.
- IBM Aspera Faspex (CVE-2026-123218, 9.8): an authenticated user can bypass authorization and escalate privileges. Fixed this month.
What to do
If you run a GPU model server like GPUStack, it should never face the internet, and it should be patched. The same goes for FreeSWITCH admin interfaces. For SSHole, see my patch-check how-to.
God Bless, and Use the Source!
