Security news.
SonicWall has patched an actively exploited MFA bypass flaw added to CISA's Known Exploited Vulnerabilities catalog, while Chainalysis revealed a breach compromising credentials across its entire customer base. Meanwhile, OpenSSH systems face immediate automated attacks, and developers using AI coding assistants are exposing sensitive secrets across thousands of public repositories.
SonicWall Patches Exploited SonicOS MFA Bypass Flaw
SonicWall addressed CVE-2026-19868, an SSL-VPN authentication bypass flaw added to CISA's KEV catalog that allows attackers to bypass SAML checks and enforced MFA.
Chainalysis Breach Exposes Credentials and Tokens for All Customers
A cyberattack against internal tools at blockchain intelligence firm Chainalysis exposed user credentials, password hashes, and active session tokens across its customer base.
Hackers Target OpenSSH "SSHole" Flaw Within Hours of Disclosure
Threat actors are actively exploiting CVE-2026-123158, an authentication bypass affecting OpenSSH running on the musl C library without PAM, allowing sign-ins to passwordless accounts.
Claude Code Settings Expose Secrets in Over 1,100 Public GitHub Repos
Anthropic's AI coding assistant Claude Code was found storing cleartext passwords and API keys in committed project configuration files when developers select "Don't ask again."
Barracuda ESG Bug Chain Enables Pre-Auth Remote Root Execution
Researchers detailed an exploit chain combining an authorization bypass (CVE-2026-116606) and CVE-2026-111560 to achieve unauthenticated root remote code execution on Barracuda Email Security Gateways.
Financially Motivated Actors Deploy ARTEX AI Offensive Framework
Threat actor Storm-3358 has begun targeting financial sector organizations using ARTEX, an open-source agentic AI penetration testing tool, to harvest exposed secrets and compromise cloud tenants.
QNAP Warns of Plex2Shell Attacks Targeting NAS Devices
Hackers are actively breaching QNAP network-attached storage appliances by exploiting the Plex2Shell vulnerability chain in unpatched Plex Media Server installations.