On Monday, November 10, 2026, the federal government published a list that says, in effect, “criminals are already using these. Fix them.” Your nonprofit was not on the distribution list, but you are on the target list.

The U.S. Cybersecurity and Infrastructure Security Agency, CISA, added four security flaws to its Known Exploited Vulnerabilities catalog, the KEV. That catalog is not a list of theoretical risks. It is a list of flaws CISA has evidence are being exploited right now, in the wild. Federal agencies were ordered to patch them by November 12, 2026. You get the same information, the same window, and none of the mandate to act on it.

For a nonprofit running a two-person IT team, or no dedicated IT team at all, that is exactly the problem. The list arrives. Nobody owns the job of reading it.

What CISA actually flagged

According to The Hacker News, CISA added four flaws affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to the KEV catalog, citing evidence of active exploitation. Three of the four carry a CVSS severity score of 9.8 out of 10, which is about as high as that scale goes.

The one getting the most attention has a nickname: SSHole. The Hacker News reports that CVE-2026-123158, an authentication bypass flaw in OpenBSD OpenSSH on Linux carrying a CVSS score of 8.1, was fixed in November 2026, and that exploitation attempts began on November 6, 2026. According to the same report, threat intelligence firm Previdian recorded 22 exploitation attempts from 14 unique IP addresses, and GreyNoise observed confirmed post-exploitation activity from six source IP addresses representing 18 distinct attack chains.

What the attackers do after they get in is the part that matters for you. The Hacker News reports those attack chains involve reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorized_keys file to gain persistent access. In at least one case, according to the report, a threat actor dubbed GT10 deployed TAC Agent, a Python-based command-and-control agent capable of shell command execution, system reconnaissance, directory enumeration, file transfer, and updating itself. Threat intelligence firm watchTowr, per the same report, has also seen the flaw weaponized for botnet and cryptocurrency miner activity.

Translated: once in, they look around, grab credentials, set up a way back in, and quietly use your machines for their own purposes. A miner on your server does not announce itself. It just makes your systems slower and your cloud bill bigger.

Why this lands harder on a nonprofit

Here is the uncomfortable math. The attackers who scan for these flaws do not check your tax status first. A vulnerable OpenSSH server protecting donor records is exactly as attractive as one protecting a Fortune 500 database, and often easier to reach, because the nonprofit behind it has fewer people watching.

Budget constraints are real, and donor data protection is non-negotiable at the same time. That tension is the daily reality for mission-driven organizations. You cannot spend your way to a 24-person security operations center, and you should not have to. What you need is a reliable answer to one question: when CISA publishes a KEV entry, who in our organization reads it, decides whether it touches us, and acts?

For most nonprofits, the honest answer is nobody. Not out of negligence. Out of staffing. The program director is running a grant deadline. The office manager is the de facto IT person. The KEV list is a government web page nobody has a reason to visit.

That gap is the risk. Not the four specific flaws. The fact that the next four, and the four after that, land in the same silence.

What to do this week

You do not need to understand OpenSSH internals to protect your organization. You need a process. Here is a realistic one for a lean team.

Find out if you run any of the four affected products. GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex. Most small nonprofits will not run GPUStack or Aspera, but OpenSSH is common on Linux servers, and FreeSwitch shows up in phone systems. If you do not know, that is your first finding.
If you do run any of them, patch them. The Hacker News reports fixes are available for all four, with the GPUStack fix dating to July 2026, FreeSwitch to October 2026, and OpenSSH and Aspera to November 2026. Apply them, or have whoever manages those systems apply them.
Assign an owner for the KEV catalog going forward. One named person, or one managed IT partner, whose job is to check new KEV entries against your actual systems. This is the step that turns a one-time scramble into a repeatable habit.
Confirm you can detect persistence. The attack chains here included modifying SSH authorized_keys files to stay in after the initial break. If no one is watching for changes like that, an attacker who got in last week is still in this week.
Write down what you learned. Which systems you run, who owns patching, how fast you can act. A nonprofit that can answer those three questions is in a different risk category than one that cannot.

None of this requires a big budget. It requires ownership. The flaws are not the story. The silence after the alert is the story.

Common Questions

Does my nonprofit need to worry about these flaws if we only use cloud apps like Google Workspace or Microsoft 365? The four flaws here affect specific server software you would run yourself or that a vendor runs for you. If your organization runs its own Linux servers, phone systems, or file transfer tools, you may be exposed. If you are entirely on managed cloud platforms, your provider handles patching for their infrastructure, but you should still confirm which systems you actually own.

What is the CISA KEV catalog and should we be checking it regularly? The Known Exploited Vulnerabilities catalog is CISA’s list of security flaws with confirmed active exploitation. Federal agencies are required to patch them on a deadline. Nonprofits are not required to, but the list is a free, high-signal guide to what attackers are using right now. Having someone check it, or a partner who does, is one of the cheapest ways to prioritize limited IT time.

We do not have dedicated IT staff. Where do we even start? Start by listing the systems and software your organization actually runs, including anything a volunteer or former staffer set up. You cannot protect what you cannot see. From there, decide who, internally or through an outside partner, owns the job of acting on alerts like this one.

centrexIT has been protecting businesses since 2002, from San Diego to Seattle, Phoenix to Portland. If reading this made you realize nobody at your organization owns the job of acting on alerts like these, that gap is worth closing before the next one lands. Take the 2-Minute Cybersecurity Assessment: https://centrexit.com/assessment/cybersecurity/