Tech news, 7 November 2026: an exploited OpenSSH flaw, browser extensions and Claude Dispatch, Microsoft and Oracle, and child online safety in California and Canada

1. An OpenSSH flaw on Alpine Linux is exploited within hours

CVE-2026-123158, nicknamed "sshole", lets attackers log in over SSH without a password to certain accounts on Linux systems built on the musl C library without PAM, most notably Alpine Linux; OpenSSH released a fix in version 10.6p2 on 5 November¹². Help Net Security reports exploitation began within hours of disclosure, mainly against accounts with no usable password, such as key-only users¹. glibc-based distributions such as Debian, Ubuntu and Fedora are reported as not affected².

CTO take: Alpine is everywhere in containers, appliances and cloud images, often in places nobody thinks of as "a server". Find every Alpine or other musl-based system that runs sshd, patch and rebuild images, and in the meantime disable password authentication or SSH entirely where it is not needed. Longer term, containers should not run SSH at all, and management access belongs on a separate, tightly controlled path; see hardening a management plane.

2. Researchers show a browser extension steering Claude Desktop through Dispatch

Security researchers reported that a malicious or compromised browser extension with access to claude.ai could use Claude's Dispatch feature to make Claude Desktop run commands on a connected computer, which they demonstrated in testing³. They reported no attacks in the wild; coverage differs on whether and how Anthropic will change the feature³⁴.

CTO take: once a desktop agent can act on a machine, everything that can talk to that agent is part of its attack surface, including browser extensions. Manage extensions with an allowlist on company browsers, keep human approval for agents running commands locally, and avoid automatic approval settings on machines with sensitive access. See agentic infrastructure and prompt injection defence for agents.

3. Microsoft winds down rented AI capacity from Oracle

Microsoft is winding down a 2023 arrangement to rent AI computing from Oracle, reportedly because the capacity ran on older Nvidia chips that no longer met its needs, The Next Web reports, citing Bloomberg⁵. Oracle said demand for its AI infrastructure remains strong, including for earlier-generation GPUs⁵.

CTO take: AI hardware ages fast, and a contract for a specific chip generation can become poor value well before it ends. When you reserve capacity, prefer terms tied to performance or allowing upgrades, keep commitments shorter than the hardware's useful life, and keep workloads able to move. See planning around the AI capacity crunch and the multi-region AI capacity case study.

4. Google, Meta and TikTok sue to block California's youth social media law

Google, Meta and TikTok filed separate lawsuits to block a California law, due to take effect on 1 January 2027, that restricts features such as addictive feeds, endless scrolling and autoplay for users under 16, arguing it violates the First Amendment⁶.

CTO take: whatever the courts decide, the direction of travel is clear: age-aware product behaviour is becoming a legal requirement in more places. Products with younger users should be able to switch features on or off by age and jurisdiction through configuration, not code changes. See New York's youth chatbot law and the US page.

5. Canada funds a new online safety regulator covering AI chatbots

Canada's Budget 2026, released on 5 November, proposes $176.3 million over five years for a Digital Safety and Data Protection Commission⁷. BetaKit reports the commission would enforce proposed legislation covering social media and AI chatbot services, with powers including binding orders, audits and fines⁸.

CTO take: AI chatbots are now named directly in online safety regimes, not just social networks. If you offer a chatbot to the public in Canada, start recording how you assess and reduce risks of harmful content, especially for younger users; the same evidence will serve in other markets. See where I work.

What I'd do this week

• Inventory Alpine and other musl-based systems running sshd, patch to OpenSSH 10.6p2 and rebuild images.
• Review browser extension policies on machines that run desktop AI agents.
• Check reserved AI capacity contracts for chip generation and upgrade terms.
• Make age and jurisdiction a configuration in consumer products.

I am based in India, the United States and the UAE, working globally. Analyse your challenge and bring the result to a call.