Security news.
Today's security updates are dominated by actively exploited authentication vulnerabilities, with CISA issuing urgent warnings for SonicWall firewall appliances alongside emerging OpenSSH attacks. Multiple major data exposures have also come to light, involving millions of dollars in financial fraud and mass credential leaks across critical platforms. IT and security teams should prioritize patching edge appliances and auditing exposed developer secrets.
SonicWall Patches Actively Exploited SonicOS MFA Bypass Flaw
SonicWall and CISA warned of active exploitation targeting CVE-2026-19868, a critical vulnerability allowing attackers with alternate credentials to bypass SSL-VPN SAML checks and multi-factor authentication.
Attackers Target OpenSSH 'SSHole' Bypass Within Hours of Disclosure
Threat actors are actively probing for CVE-2026-123158, an authentication bypass on Linux systems running OpenSSH alongside the musl C library without PAM that allows sign-ins to passwordless accounts.
Hackers Steal $133 Million from French Bank via Third-Party Provider
French cooperative bank Crédit Mutuel Arkéa suspended several internal operations after an intrusion at an external service provider facilitated massive fraudulent transactions.
Chainalysis Breach Exposes Credentials and Live Tokens for All Customers
Blockchain intelligence firm Chainalysis temporarily restricted platform access after an intrusion exposed customer usernames, password hashes, and active authentication tokens.
Claude Code Feature Leaks Developer Secrets Across Public GitHub Repos
The "Don't Ask Again" setting in Anthropic's Claude Code coding assistant stored raw commands with hardcoded passwords and API keys, exposing secrets across more than 1,100 public repositories.
QNAP Warns of Plex2Shell Attacks Breaching NAS Devices
QNAP is urging NAS owners to immediately update Plex Media Server after detecting active attacks chaining vulnerabilities to gain unauthorized execution on storage systems.
Barracuda ESG Bug Chain Enables Remote Root Code Execution
Researchers released technical details on an exploit chain combining CVE-2026-116606 and a secondary flaw in Barracuda Email Security Gateways, enabling unauthenticated remote attackers to gain full root access.
WordPress Sites Remain Vulnerable During Active Patch Installations
Researchers revealed that systems undergoing updates for a known WordPress vulnerability (CVE-2026-119977) can still be exploited mid-process because update files unpack via the unpatched legacy code.