Good morning. SonicWall fixed a SonicOS bug that lets VPN users skip SAML-enforced MFA, and CISA already lists it as exploited with a November 20 deadline. OpenSSH closed a one-connection login bypass on Alpine, the Paint fix Microsoft promised in October reached the Store, and Apiiro found Claude Code project files holding real passwords on GitHub.
Coffee first. Then one firewall upgrade, one sshd restart, one Store push and one secrets search.
Lead Story
SonicWall SSL VPN: a second login method skips SAML MFA, and attackers are using it. Upgrade Gen7 to SonicOS 7.3.4-7013 and Gen8 to 8.2.3-8015, and turn off non-SAML VPN logins for users who should be on SAML.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Also Worth Your Attention
OpenSSH on Alpine: one very long password opens key-only accounts. Update openssh on every Alpine host that runs sshd, then restart sshd. No update yet? Turn password login off.
Windows Paint: the code-execution fix ships only through the Microsoft Store. Push the Store update and check every user’s copy for 11.2609.401.0.
Claude Code: approved commands, passwords included, sit in 1,122 public settings files. Search your repos for .claude/settings.local.json, rotate what it held, then untrack it.
On the radar
- UnrealIRCd 6.0.0 before 6.2.7.1: CVE-2026-114713 lets an ordinary user on a network with linked servers run commands with server authority. The project rates it critical and ships a hot-patch. oss-security announcement.
- Symfony 7.4.23 and 8.1.11 fix CVE-2026-121623 (DataUriNormalizer local file read) and CVE-2026-121971 (ScopingHttpClient sends default credentials to other origins). Release notes.
Slack paste
Today’s brief: (1) SonicWall CVE-2026-19868 exploited, upgrade SonicOS to 7.3.4-7013 / 8.2.3-8015 and kill non-SAML VPN logins. (2) Alpine sshd: apk upgrade, restart sshd, or PasswordAuthentication no. (3) Paint: Store update to 11.2609.401.0 for every user. (4) Search repos for .claude/settings.local.json and rotate.
Go Deeper
Identity and access: IAM library. Tools and checkers: cybersecurity tools. Resetting VPN and database passwords this week? Our password strength checker shows how long a new one holds up.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
