SonicWall has released security updates addressing a high severity vulnerability in SonicOS that could allow attackers to bypass SAML authentication and its associated multifactor authentication requirements. Tracked as CVE-2026-19868, the flaw affects the SSL VPN component of the operating system used by SonicWall firewalls. The company disclosed the issue alongside six other vulnerabilities in an advisory published on November 6, 2026. Its security team investigated a report indicating potential exploitation, raising concerns for organizations relying on affected appliances to secure remote connections.  The vulnerability does not allow anyone to enter without credentials. Instead, an attacker must possess valid credentials for an alternative authentication method. Those credentials could then be used to bypass SAML authentication controls, potentially avoiding multifactor authentication enforced through SAML. According to SonicWall, exposure exists only when SAML login is enabled for the SSL VPN. The flaw received a CVSS severity score of 7.1 and was reported by Ryan Harris of The Electronic Office, distinguishing it from an unrestricted authentication bypass affecting every configuration.  Affected products include Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or earlier. Gen8 TZ, NSa, and NSv firewalls running SonicOS 8.2.2-8015 or earlier are also vulnerable. SonicWall addressed the issue in SonicOS versions 7.3.4-7013 and 8.2.3-8015, respectively. The company said no workarounds are available and strongly urged customers to upgrade promptly. For administrators, the immediate priority is therefore identifying affected firewall models, checking their installed software versions, and applying the appropriate fixed release rather than relying on an unverified temporary configuration change.  The United States Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on November 6. Under Binding Operational Directive 26-04, federal agencies must address it by November 20. However, public information about exploitation remains limited. Neither SonicWall nor CISA disclosed details about the suspected attacks, their targets, or their impact. It also remains unclear whether attackers exploited the weakness before a patch became available. That distinction matters because the available reporting does not establish that this was a zero-day.  The remaining six vulnerabilities broaden the advisory’s significance, although SonicWall did not identify them as exploited. Two management interface flaws, each rated 8.8, could permit unauthorized actions under certain circumstances without authentication. Three pre-authentication buffer overflows affect the SSL VPN service and TACACS+ authentication client, potentially causing application denial of service. A weak password hashing issue affects virtual appliances but requires highly privileged local access. Together, these findings make the updates relevant beyond the SAML bypass alone, while keeping each vulnerability’s prerequisites and consequences distinct.

 QNAP has issued a security advisory concerning a vulnerability chain, collectively referred to as Plex2Shell, affecting Plex Media Server installations on QNAP NAS devices. The issue affects Plex Media Server version 1.43.2 and earlier and enables unauthenticated remote code execution when individual flaws are chained together. QNAP has therefore instructed administrators to update Plex Media Server immediately to version 1.43.3, build 1.43.3.10861 or later.  Technical scope  Plex2Shell comprises four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Individually, each issue has a limited security impact, but an attacker can combine them to execute arbitrary code under the privileges assigned to the Plex Media Server process. The vulnerability resides in the third-party Plex application rather than in QTS or QuTS hero. Consequently, QNAP states that its operating systems are not directly affected, and a NAS that does not have Plex Media Server installed does not require remediation. Affected administrators should navigate to App Center > My Apps > Plex Media Server and select Update. Once the update completes, they must verify in Plex Web under Settings > General that the installed version is 1.43.3.10861 or later. QNAP advises against delaying the update until a later release becomes available. If the update is not visible, administrators should refresh App Center and confirm that the NAS has outbound internet connectivity before attempting the installation again.  Compromise assessment Updating Plex removes the exploitable condition but does not reverse an intrusion that has already occurred. QNAP states that systems running Plex 1.43.2 or earlier while remotely reachable should be treated as potentially compromised. This exposure applies when Plex Remote Access was enabled, TCP port 32400 was manually forwarded, or the port was exposed through UPnP or myQNAPcloud router configuration. In such cases, QNAP requires a clean reinstall, credential rotation, and a review for indicators of compromise.  Administrators should inspect running processes for unfamiliar executables launched by Plex, including myawesomeproxy, mylovelyminer, or x12345. They should also examine the Plex Codecs directory for unrecognized .so or .dll files and monitor outbound traffic for connections to proxystream.st. Additional indicators include abnormal CPU utilization when no media is being played and detections produced by QNAP Malware Remover, including signature MR2104. QNAP warns that deleting suspicious files alone is insufficient, since persistence mechanisms may remain; affected systems should follow the full clean-reinstall procedure.  Secure reinstallation  For remediation, QNAP recommends preserving the Plex Logs directory if technical support may be required. Administrators should then remove Plex Media Server through App Center, reinstall version 1.43.3 or later, and avoid restoring the previous contents of the Codecs folder. Plex will automatically download required codec components after reinstallation. To reduce recurrence risk, QNAP advises disabling Plex Remote Access when unnecessary, removing port 32400 forwarding rules, disabling UPnP, and using a VPN for legitimate remote access. Administrators should also keep QTS or QuTS hero and all installed applications updated.

 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a recently patched, high-severity vulnerability in WordPress Core. The flaw, tracked as CVE-2026-119977, can allow unauthenticated remote attackers to execute code on affected servers. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal civilian agencies to address it by Friday under Binding Operational Directive 26-04. The warning highlights how quickly attackers move from public patch information to real-world exploitation.  The vulnerability is caused by a Time-of-check Time-of-use (TOCTOU) race condition in WordPress’s upgrade process. It was reported by Picus Security researcher Umut Bayram and relates to predictable, web-accessible staging paths used during full-package core upgrades. During the upgrade window, an attacker may be able to interfere with the process and achieve remote code execution. Although exploitation is described as high-complexity, the potential impact is serious because successful attacks do not require prior privileges on the server.  WordPress released version 7.1.4 on October 28 to fix the issue, urging administrators to update their sites immediately because it was a security release. CISA later confirmed evidence of active exploitation and emphasized that such vulnerabilities are a frequent attack vector for malicious cyber actors, posing significant risks to the federal enterprise. While the federal directive applies only to U.S. federal agencies, CISA also urged private-sector organizations and other network defenders to prioritize patching their WordPress installations.  The scale of attempted attacks appears substantial. According to WordPress security firm Wordfence, it blocked 13,095 attacks targeting the vulnerability within a 24-hour period. CISA has not publicly disclosed detailed information about the threat actors, targets, or post-exploitation activity. Even so, the volume of blocked attacks suggests that adversaries are scanning broadly for vulnerable WordPress sites rather than focusing on a small number of high-value targets.  The incident follows earlier WordPress security concerns, including the “wp2shell” vulnerability chain patched in July. That chain combined a REST API batch-route confusion flaw and an SQL injection vulnerability to deploy webshells and take over unpatched servers. Public exploit code appeared shortly after the fix, and attackers later used the technique to install malicious plugins and steal database records. Together, these cases reinforce an essential lesson for site owners: apply WordPress core and plugin updates promptly, restrict administrative access, monitor upgrade activity, and maintain reliable backups to reduce the impact of exploitation.

PHP에서 두 가지 치명적인 보안 취약점이 발견되면서 전 세계 IT 현장이 긴급 대응에 들어갔습니다. 각국 보안 당국은 보안 수정본을 즉시 적용하거나 웹사이트와 서버를 내려달라고 권고했습니다. 담당자들은 밤샘 작업과 잘못된 정보 확산을 동시에 견뎌야 했습니다. 이 글은 현장

Meerdere grote websites wereldwijd zijn woensdag offline gehaald na waarschuwingen over kwetsbaarheden in de populaire programmeertaal PHP. Vooral in Nederland gaan er uit voorzorg verschillende pagin...

PHP 보안 업데이트가 2026년 10월 21일 오후부터 배포됩니다. BBC 보도에 따르면 PHP에서 두 가지 치명적 취약점이 확인됐고, 영국 NCSC와 EU·호주 당국은 패치가 나오는 즉시 적용하라고 권고했습니다. 즉시 조치가 어렵다면 웹사이트를 일시적으로 오프라인에 두는 방안도

PHP 긴급 보안 패치가 임박했습니다. Ars Technica 보도에 따르면 PHP 유지관리자는 심각도 9.2점으로 평가된 두 취약점에 대한 패치를 예고했고, 모든 PHP 사용자에게 즉시 업그레이드할 준비를 하라고 권고했습니다. 아직 공식 패치가 나오기 전이라면 지금 해야 할 일은

Citrix Discloses Critical CVE-2026-107406 in NetScaler ADC and Gateway Yet Another Urgent Update Required Administrators must once again rush to update their NetScaler appliances merely days after implementing previous patches. Citrix recently issued an advisory detailing a critical vulnerability tracked as CVE-2026-107406. This severe flaw carries a staggering CVSS 4.0 severity score of 9.5. It specifically impacts NetScaler ADC and NetScaler Gateway deployments utilizing certain SAML configurations.

The FBI confirmed a security failure on a platform managed by a third party led to a data breach affecting thousands of employees, according to a recent report by Information Week.

XRP Ledger patches decade-old bug that could have minted trillions of XRP XRP Ledger developers said Friday that a bug in the network's payment engine could have let an attacker create XRP out of not...

 Arista has published Security Advisory 0183 warning of a critical vulnerability in on-premises VeloCloud Orchestrator (VCO), tracked as CVE-2026-93952. The advisory, dated September 22, 2026, assigns the flaw a CVSS 3.1 base score of 10.0, indicating the highest level of severity. The issue is caused by improper input validation and is already being actively exploited, making immediate assessment and remediation essential for affected organisations.  The vulnerability could allow a remote, unauthenticated attacker to access privileged internal functionality and compromise the VCO host. Successful exploitation may affect the confidentiality, integrity and availability of the orchestrator, including data managed by it. Arista said the issue affects on-premises VCO deployments, while hosted and dedicated VCO versions have already been patched. The affected software includes VCO 5.2.3.15 and earlier in the 5.2.x series, 6.1.3.7 and earlier in the 6.1.x series, 6.4.2.7 and earlier in the 6.4.x series, and 7.0.0.2 and earlier in the 7.0.x series.  An affected deployment requires certificate-based authentication between a VeloCloud Edge and VCO, access to the public portion of the Edge authentication certificate, and network access to the VCO web interface. Tenant or operator credentials are not required. Organisations that limit the VCO web interface to trusted administrative networks can reduce exposure, although this should be treated as a temporary defensive measure rather than a complete solution. Arista’s EOS-based networking products and several other listed Arista platforms are not affected by this vulnerability.  Administrators should inspect VCO web-access, backend application and system logs for unusual requests, encoded URL components, references to internal services or unusually high request rates. Other warning signs include unexpected outbound traffic, unauthorized configuration changes, unexplained maintenance actions, command execution, file creation, database exports or access to credentials and certificates. Arista specifically identified suspicious files, the x-vc-opt HTTP header and connections from 142.93.149.77 and 104.248.126.159 as indicators requiring investigation.  Arista recommends upgrading to a remediated VCO release as soon as possible. Fixes are available in VCO 5.2.3.16 and later within the 5.2.3 train, and VCO 6.4.2.8 and later within the 6.4.2 train; fixes for other release trains will be added. Until then, organisations should restrict web access, monitor inbound and outbound activity, review administrator actions and watch for backdoors or webshells. If compromise is suspected, operators should preserve relevant logs and file timestamps before remediation, contact Arista TAC, rotate credentials, validate managed Edge devices and consider rebuilding the orchestrator from trusted sources.