The daily cybersecurity brief
No. 258
15 stories 3 critical 6 min read Updated 06:30 IST
Top stories
- CISA Adds SonicWall SSLVPN Vulnerability to KEV Catalog CVE-2026-19868 for SonicWall SSLVPN is now in the KEV Catalog due to active exploitation. Do this today Patch SonicWall SonicOS against CVE-2026-19868. Read the full story ↓
- Microsoft Paint RCE (CVE-2026-83844) Fix Available via Microsoft Store An unauthenticated RCE flaw in Windows Paint requires a Microsoft Store update, not a standard Windows Update. Do this today Update Windows Paint via the Microsoft Store to build 11.2609.401.0. Read the full story ↓
- Chainalysis Breach Exposed Credentials and Live Tokens for All Customers An attack on Chainalysis exposed credentials, password hashes, and live tokens for all users. Do this today Reset all user passwords and rotate API keys for Chainalysis access. Read the full story ↓
From the editor
Defenders must prioritize patching SonicWall SSLVPN due to active exploitation of CVE-2026-19868. Additionally, apply the Microsoft Store update for the Paint RCE vulnerability (CVE-2026-83844). Review access controls following the Chainalysis credential exposure.
Anmol Singh YadavEditor, PwnSpectrum
No stories match your search.
Actively Exploited 3
-
CISA Adds SonicWall SSLVPN Vulnerability to KEV Catalog CVE-2026-19868 for SonicWall SSLVPN is now in the KEV Catalog due to active exploitation.
CISA added CVE-2026-19868 to the Known Exploited Vulnerabilities Catalog. This vulnerability affects SonicWall SonicOS SSLVPN and relates to the use of single-factor authentication. Successful exploitation can bypass SAML checks, including those enforcing MFA.
Why it matters. Active exploitation of this vulnerability presents a significant risk to organizations using SonicWall SSLVPN. Remediation is required due to its inclusion in the KEV Catalog.
Do this today Patch SonicWall SonicOS against CVE-2026-19868.
- Affected
- SonicWall SonicOS
- CVE
- CVE-2024-27834, CVE-2026-19868
- Fri 6 NovCISA Adds CVE-2024-27834 to KEV Catalog for Apple Improper Authentication
- Sat 7 NovCISA Adds SonicWall and Apple Vulnerabilities to KEV Catalog
- TodayCISA Adds SonicWall SSLVPN Vulnerability to KEV Catalog
Also covered by SecurityWeek
{"coverage":0.898,"evidence":1,"freshness":0.094,"importance":1,"novelty":0.6,"quality":0.95,"total":0.849} -
CISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog CISA added CVE-2026-119977, a WordPress Core TOCTOU vulnerability, to the Known Exploited Vulnerabilities Catalog.
CISA added CVE-2026-119977 to the Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. This vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in WordPress Core. Exploitation could allow an attacker to achieve arbitrary code execution.
Why it matters. This vulnerability is listed as actively exploited and poses a significant risk to exposed assets. Remediation is required to prevent unauthorized control of the system.
Do this today Prioritize remediation for CVE-2026-119977.
- Affected
- WordPress Core
- CVE
- CVE-2026-119977
- Wed 4 NovCISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog
- Thu 5 NovCISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog
- TodayCISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog
Also covered by BleepingComputer, The Hacker News
{"coverage":0.898,"evidence":1,"freshness":0.048,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.77} -
Insignary Releases Tool to Detect PHP2Shell and Node2Shell Exposure A free tool is available to scan for exposure to actively exploited PHP2Shell and Node2Shell vulnerabilities.
Insignary released insignary-chk, a free tool to scan for PHP2Shell and Node2Shell, runtime vulnerabilities affecting PHP and Node.js. PHP2Shell involves vulnerabilities in the PHP runtime, while Node2Shell is an out-of-bounds write flaw in the Brotli decompression library.
Why it matters. Both vulnerabilities are rated Critical and have been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation risk. Code review alone cannot detect these runtime flaws.
Do this today Run insignary-chk against Linux servers and container images to check for PHP2Shell and Node2Shell exposure.
- Affected
- PHP, Node.js, Linux servers, container images
{"coverage":0.387,"evidence":0.9,"freshness":0.53,"importance":0.5,"novelty":1,"quality":0.65,"total":0.651}
At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated.
Vulnerabilities & Patches 4
-
Microsoft Paint RCE (CVE-2026-83844) Fix Available via Microsoft Store An unauthenticated RCE flaw in Windows Paint requires a Microsoft Store update, not a standard Windows Update.
A remote code execution vulnerability, tracked as CVE-2026-83844, exists in Windows Paint. This flaw allows an attacker to execute code over the network without user interaction. The fix is available through the Microsoft Store, not through Windows Update channels.
Why it matters. Exploitation allows unauthenticated remote code execution with a CVSS base score of 8.1.
Do this today Update Windows Paint via the Microsoft Store to build 11.2609.401.0.
- Affected
- Windows Paint
- CVE
- CVE-2026-83844
Summarised from The Hacker News; also covered by GBHackers, Hacker News.
{"coverage":0.613,"evidence":0.4,"freshness":0.234,"importance":0.75,"novelty":1,"quality":0.8,"total":0.62} -
SonicWall: Unpatchable Flaws in End-of-Life GMS Software SonicWall confirmed two unpatchable flaws in GMS, allowing file reads and database modification.
SonicWall disclosed two vulnerabilities in its Global Management System (GMS) that affect versions 9.5.2 and earlier. These flaws, including CVE-2026-109593, cannot be patched due to the product reaching end-of-life. The second flaw, CVE-2026-109594, allows SQL Injection.
Why it matters. Unauthenticated network access can allow attackers to read internal GMS files or modify the GMS database records.
Do this today Upgrade to SonicWall Network Security Manager (NSM)
- Affected
- SonicWall GMS 9.5.2 and earlier
- CVE
- CVE-2026-109593
- Thu 5 NovSonicWall: Unpatchable Flaws in End-of-Life GMS Software
- TodaySonicWall: Unpatchable Flaws in End-of-Life GMS Software
Summarised from BleepingComputer; also covered by SecurityWeek, The Hacker News.
{"coverage":0.774,"evidence":0.7,"freshness":0.102,"importance":0.5,"novelty":0.6,"quality":0.95,"total":0.606} -
ChatGPT Lockdown Mode Bypass: Data Exfiltration via DNS Tunneling A flaw allowed bypassing ChatGPT Lockdown Mode to exfiltrate chat data via DNS tunneling.
A vulnerability in ChatGPT's code-execution runtime allowed silent data exfiltration to an external server using DNS tunneling. This bypassed the network isolation intended by Lockdown Mode. A fix for this issue was deployed.
Why it matters. The flaw enabled theft of chat history, phishing, and malware delivery from within the trusted interface.
- Affected
- ChatGPT Classic
Also covered by The Hacker News, GBHackers
{"coverage":0.774,"evidence":0,"freshness":0.194,"importance":0.75,"novelty":1,"quality":0.9,"total":0.55} -
Docker Sandboxes: Local RCE via Untrusted Control Sphere Functionality Local attackers can execute arbitrary code on affected Docker Sandboxes installations requiring user interaction.
A vulnerability exists within Docker Sandboxes when creating sandboxes using clone mode. The flaw allows code execution when launching an executable from an untrusted location. Exploitation requires the target to visit a malicious page or open a malicious file.
Why it matters. Local attackers can execute arbitrary code in the context of the current user on vulnerable installations.
Do this today Apply the update released by Docker to correct CVE-2026-121614.
- Affected
- Docker Sandboxes
- CVE
- CVE-2026-121614
{"coverage":0.387,"evidence":0.4,"freshness":0.303,"importance":0.5,"novelty":1,"quality":0.9,"total":0.528}
Threat Actors & Campaigns 2
-
Supermarket Refrigeration Systems Targeted in Second Wave of Attacks Supermarket freezers across Europe were hacked again, manipulating temperature controls and causing spoilage.
Supermarket and grocery store refrigerators across Europe experienced a second wave of suspected cyberattacks, manipulating temperature controls. Attackers remotely set freezers to 50°C, causing mass food spoilage in multiple countries.
Why it matters. These incidents indicate a persistent threat targeting critical infrastructure controls, potentially impacting food supply chains and business continuity.
- Affected
- Supermarket refrigeration systems in Europe
Also covered by The Register
{"coverage":0.898,"evidence":0,"freshness":0.026,"importance":0.5,"novelty":1,"quality":0.95,"total":0.482} -
ARTEX Threat Actor Used Multiple LLMs Targeting South Korean Banks A financially motivated actor used LLMs like Claude Code, DeepSeek, and Grok in data theft targeting South Korean financial institutions.
Threat actors used ARTEX, Claude Code, and multiple large language models to conduct data theft against South Korean financial organizations between late September and early October 2026. Exposed directories contained operational scripts and configurations showing AI tooling support for intrusions.
Why it matters. The activity demonstrates sophisticated use of AI tooling for reconnaissance, authentication testing, and potential lateral movement within critical financial infrastructure.
Do this today Review peripheral application access and investigate unexplained outbound connections to model resellers and proxy services.
{"coverage":0.387,"evidence":0,"freshness":0.18,"importance":0.75,"novelty":1,"quality":0.65,"total":0.466}
Breaches & Incidents 4
-
Chainalysis Breach Exposed Credentials and Live Tokens for All Customers An attack on Chainalysis exposed credentials, password hashes, and live tokens for all users.
Chainalysis reported an attack exposed customer names, usernames, password hashes, and live tokens. The exposure occurred following an investigation into an agentic cyber attack targeting the firm's systems.
Why it matters. The breach compromises authentication credentials and live tokens for a broad base of law enforcement, government, and financial clients.
Do this today Reset all user passwords and rotate API keys for Chainalysis access.
- Affected
- All Chainalysis customers
Summarised from BleepingComputer; also covered by Ars Technica, The Hacker News.
{"coverage":0.774,"evidence":0,"freshness":0.321,"importance":0.75,"novelty":1,"quality":0.95,"total":0.568} -
Crédit Mutuel Arkéa: Cyberattack via Compromised Supplier A French bank confirmed a cyberattack used a compromised supplier platform to facilitate fraudulent transfers.
Crédit Mutuel Arkéa reported a sophisticated cyberattack where attackers used the platform of an unnamed service provider to gain direct access. The attackers executed transfers using the bank's own account to other banking institutions.
Why it matters. The incident demonstrates the risk of third-party vendor compromise enabling direct access to core financial systems. Customer assets were stated to be unaffected by the attack.
- Affected
- Crédit Mutuel Arkéa
- Thu 5 NovCrédit Mutuel Arkéa Confirms Cyber Heist via Supplier Compromise
- TodayCrédit Mutuel Arkéa: Cyberattack via Compromised Supplier
Also covered by BleepingComputer, GBHackers
{"coverage":0.774,"evidence":0,"freshness":0.114,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.507} -
AI Platform BOSSAI Exposed Medical and Dispatch Data in Taiwan An agentic attack platform exposed patient records and dispatch data across multiple organizations in Taiwan.
An operator used an agentic attack platform named BOSSAI to target numerous organizations in Taiwan and eleven other countries. The platform was observed exfiltrating medical data, PII, and dispatch records from systems like a Taipei fire department's patient-care platform.
Why it matters. The activity demonstrates the capability of AI agents to rapidly and systematically discover and exploit pre-existing, weakly protected vulnerabilities across critical infrastructure.
Do this today Authenticate public APIs and close legacy exposures.
- Affected
- Universities, emergency providers, banks, military systems, e-commerce sites
Summarised from GBHackers.
{"coverage":0.387,"evidence":0,"freshness":0.162,"importance":0.75,"novelty":1,"quality":0.65,"total":0.464} -
Queens Public Library: Ransomware Attack Disrupts Services A ransomware attack disrupted Wi-Fi, on-site computers, and digital services across the Queens Public Library system.
The Queens Public Library system confirmed a ransomware attack caused disruptions to its digital services. Affected services include on-site computers, check-out machines, Wi-Fi access, and the mobile app.
Why it matters. Library systems handle significant amounts of local population data, making them potential targets for data exfiltration and operational disruption.
- Affected
- Queens Public Library system
Also covered by The Register
{"coverage":0.613,"evidence":0,"freshness":0.185,"importance":0.5,"novelty":1,"quality":0.95,"total":0.455}
AI Security 2
-
WorkOS Breach: AI Agent Exploited Weak Credentials on Internal App An AI agent accessed customer data in WorkOS's internal sales application due to exposed API endpoints and weak credentials.
An AI-powered hacking agent accessed WorkOS's internal sales application, exposing customer business information. The agent exploited permissive access controls and a predictable credential left in production to authenticate and retrieve records. The activity was detected after unusual system usage was noticed by an employee.
Why it matters. The incident demonstrates risks associated with legacy internal platforms and the potential for autonomous tools to exploit basic security misconfigurations.
- Affected
- WorkOS internal sales application
Summarised from BleepingComputer; also covered by GBHackers.
{"coverage":0.613,"evidence":0,"freshness":0.478,"importance":0.75,"novelty":1,"quality":0.95,"total":0.56} -
Claude Code Feature Exposes Secrets in Public GitHub Repositories Approving commands in Claude Code can save passwords and API keys to public GitHub repositories.
When a user selects 'Yes, and don't ask again' in Claude Code, the AI coding assistant saves the command, including secrets, in a project settings file. This mechanism has exposed numerous credentials across public GitHub repositories.
Why it matters. Public exposure of production database passwords, cloud credentials, and API tokens increases the risk of unauthorized system access.
Do this today Review repository history and configuration files for saved credentials.
- Affected
- Developers using Claude Code
Also covered by GBHackers
{"coverage":0.613,"evidence":0,"freshness":0.602,"importance":0.75,"novelty":1,"quality":0.8,"total":0.557}
CVE spotlight
| CVE | Affects | CVSS | EPSS | Status |
|---|---|---|---|---|
| CVE-2026-19868 | SonicWall SonicOS SSLVPNAn authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authenticatio… | 7.5 | 1% | Exploited (KEV)CISA due 20 Nov |
| CVE-2024-27834 | Apple Multiple ProductsThe issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, ma… | 5.5 | 2% | Exploited (KEV)CISA due 18 Nov |
| CVE-2026-119977 | WordPress CoreWordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging path… | 8.1 | 1% | Exploited (KEV)CISA due 6 Nov (passed) |
| CVE-2026-83844 | —Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. | 8.1 | 1% | Not in KEV |
| CVE-2026-109593 | —An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, pote… | 9.1 | 1% | Not in KEV |
| CVE-2026-121614 | —Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git … | 7.1 | 0% | Not in KEV |
Quiz
Yesterday's answer
According to the story, what was the reason CISA added the SonicWall and Apple vulnerabilities to the KEV Catalog?
They were listed due to evidence of active exploitation.
The text explicitly states that both vulnerabilities were added because of evidence of active exploitation.
Today's question
According to the CISA announcement, what specific aspect of authentication does the CVE-2026-19868 vulnerability relate to?
Locked in. The answer is in tomorrow's brief.
On the radar tomorrow
- KEV deadline Tue 10 NovCVE-2026-111497 · Google Brotli
- KEV deadline Tue 10 NovCVE-2026-48356 · Adobe Commerce and Magento
- Patch Tuesday in 2 daysTuesday 10 November
- WatchingDigiCert data breach exposes customer information, identity documents
- WatchingFake security tools on GitHub push backdoors and infostealers
Also worth your time
Exploits
Tools
- docker/sbx-releasesProvides isolated environments for running AI coding agents with controlled access to system resources.
- n5za/osint-mcpProvides 86 tools for open-source intelligence and authorized reconnaissance across domains, IPs, and public accounts.
- willsurpass/WSARTEXThis system provides an AI-driven framework for autonomous penetration testing, supporting multi-agent collaboration and…
- EncidXVII/claude-reverse-engineering-skillProvides a workflow to analyze various file types, including binaries, mobile apps, and firmware, using multiple establi…
Community
Podcasts
- 182: Blackshades
- Risky Business #858 -- The $6.3b laptop
- SN 1103: Exposing Bad Consumer Crypto - AI vs. Encrypted Drives
- SANS Stormcast Friday, November 6th, 2026: RootEvidence Cisco IOS Opt-Out Scans; OpenSSH musl sshhole (CVE-2026-123158); Refrigeration OT Hardening; Zyxel GS1900 OOB Write (CVE-2026-107441)
And finally
US Agencies Urge Hardening of Industrial Refrigeration and Cold Chain Monitoring Systems
US agencies advise hardening industrial refrigeration and cold chain monitoring systems. Focus areas include strong authentication and limiting internet-accessible components.
CISA
End of No. 258
That's today's brief.
Coming upKEV deadline Tue 10 Nov: CVE-2026-111497 · Google Brotli
The next brief lands at 06:30 IST.