OpenSSH Blank-Password Flaw and CWPdoor Backdoor Expose Linux Update and Auth Weaknesses

The Hacker News recap highlights two supply-chain vectors: direct binary replacement in Control Web Panel via cwpsrv_update.sh from 136.0.141[.]71 and an APT retry-condition flaw (CVE-2026-109518) that permits unverified package installation on Debian and Ubuntu when HTTP sources and retry settings are active. XLab analysis shows CWPdoor suppresses access logs while executing attacker commands only on crafted headers. Amazon's advisory confirms network-position attackers can force maintainer-script execution as root under those exact conditions.

These incidents follow a documented pattern of default or legacy configurations persisting across distributions. Alpine's musl OpenSSH setup and CWP's update mechanism both bypass standard verification paths that have been flagged in prior procurement audits of embedded Linux appliances. CERT-In's Crafty Falcon reporting adds timing correlation with low-monitoring windows, suggesting coordinated re-targeting after incomplete patches rather than novel zero-days.

Zyxel GS1900 switches compromised for credential theft further illustrate exposed management interfaces as persistent entry points. No independent technical attribution links the 13 observed IPs to specific state actors; the IP spread across Denmark, Iran, Japan and others indicates opportunistic scanning more than directed campaigns.

Next monitoring should focus on whether CWPdoor samples appear in additional control-panel deployments and whether APT retry abuse expands beyond Ubuntu 22.04/24.04 test environments within the next 14 days.