Briefing · Saturday 7 November 2026 · 07:00 UTC
CISA adds exploited SonicWall SSLVPN flaw to KEV
By CyberSIXT Briefing · from 52 reports by 16 outlets · Editorial policy
Since this morning3
Technical University of Munich says portal passwords were stolen
TUM says attackers stole the central login passwords of everyone registered with its myTUM portal and used an administrator's to attack its campus system, TUMonline, which it has taken offline.CyberSIXT
Keplr says Web3Auth incident hit a fifth of social-login wallets
Keplr's founder says about 20% of its Google and Apple login wallets were affected by a security incident at Web3Auth, that only some were drained, and that the rest may be recoverable.CyberSIXT
QNAP warns Plex2Shell attacks may have hit NAS devices
QNAP says some customers' NAS devices appear compromised through the Plex2Shell flaws in Plex Media Server, and that updating will not remove what attackers installed on servers exposed to the internet.CyberSIXT
CISA added SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalogue on 6 November, confirming active exploitation.CISA The flaw can allow a user with valid credentials for an alternate authentication method to bypass SAML controls, including SAML-enforced multi-factor authentication; CISA set 20 November 2026 as the remediation deadline for affected federal agencies.CISA The day also brought reports of unauthorised transactions involving some Keplr wallets made with social logins, while the cause and number of affected accounts remain unknown.CyberSIXT
CISA adds exploited SonicWall SSLVPN flaw to KEV#
CISA added CVE-2026-19868 to its KEV catalogue on 6 November 2026, confirming that the SonicWall SonicOS SSLVPN flaw is being actively exploited.CISA The vulnerability may let a user with valid credentials for an alternate authentication method bypass SAML authentication controls, including multi-factor authentication when enforced through SAML.CISA CISA set 20 November 2026 as the remediation deadline for affected federal agencies and said a SonicWall patch and advisory are available.CISA SecurityOnline said the issue applies when SAML is enabled for SSLVPN logins, and reported that Gen7 devices on SonicOS 7.3.3-7015 and older and Gen8 devices on 8.2.2-8015 and older are affected.SecurityOnline It listed fixed versions as SonicOS 7.3.4-7013+ for Gen7 and 8.2.3-8015+ for Gen8; CISA’s entry gives no information on use in ransomware campaigns.SecurityOnlineCISA
Keplr reports unauthorised transactions after Web3Auth pauses wallet service#
Web3Auth paused its embedded wallet service on Friday, describing a security issue affecting services used by some third parties, CyberSIXT reported.CyberSIXT About seven hours later, Keplr said it had received reports of unauthorised transactions on some accounts created with Google or Apple login and was investigating with Web3Auth.CyberSIXT Web3Auth’s status page showed its Login Service in maintenance mode from 18:30 UTC on Friday, with the maintenance window set to run for a day.CyberSIXT Keplr’s initial assessment said wallets created with a recovery phrase or hardware wallet were not affected, while accounts created through Google or Apple login may be affected.CyberSIXT Neither company has said how many accounts lost funds, how much was taken, or what the underlying security issue was; Web3Auth said it found no evidence that MetaMask users were affected.CyberSIXT
PolinRider loader appears in 12 releases across 10 npm packages#
SecurityOnline reported that Sonatype Research Labs found a concealed PolinRider loader in 12 releases across 10 hijacked npm packages.SecurityOnline The packages include six @adminide-stack modules, server-hemera-mongo, cdeops, @cdmbase/wiki-browser and @pubngo-stack/help-browser.SecurityOnline The loader runs when an application imports an affected module or starts a bundled service, rather than through install-time or postinstall scripts.SecurityOnline The researchers said the releases use two concealment methods and that the loader queries public Ethereum RPC nodes or a Blockscout API fallback to locate command servers.SecurityOnline Total victim numbers have not been disclosed; the research linked the releases to earlier PolinRider activity, while saying a single shared operator remains unconfirmed.SecurityOnline
OpenSSH fixes password bypass with exploitation claims disputed#
OpenSSH 10.6p2 fixes CVE-2026-123158, an authentication bypass affecting OpenSSH on musl-based Linux systems when PAM is disabled, including Alpine Linux configurations.SecurityWeek The Hacker News reported that Previdian observed exploitation attempts within hours of the CVE publication, while SOCRadar said no in-the-wild attacks had been reported by 6 November.The Hacker NewsSOCRadar The accounts therefore differ on observed exploitation; SOCRadar also said CISA’s CVE enrichment listed the status as proof of concept.The Hacker NewsSOCRadar The Hacker News said an attacker can use an oversized password to access an account whose password field contains an asterisk, provided another local account has a qualifying password hash.The Hacker News Alpine published patched packages for all branches on 5 November 2026, and OpenSSH 10.6p2 contains the upstream fix.StepSecuritySOCRadar
Also
- Refrigeration systems. CISA, the FBI, HHS, the USDA and the Department of Transportation warned that attackers have targeted refrigeration controllers in Europe, and SecurityWeek reported that 3,124 of 6,695 controllers found exposed on 9 October remained web-accessible on 5 November.SecurityWeek
- DigiCert. DigiCert said an unauthorised read-only account accessed archived business-customer contact information, including names, email addresses, phone numbers and business addresses, but did not specify how many customers were affected.SecurityWeek
- Microsoft Paint. The Hacker News reported that Microsoft’s fix for Paint vulnerability CVE-2026-83844 is available through the Microsoft Store, with fixed build 11.2609.401.0.The Hacker News
Watching
Web3Auth said it would share confirmed details and any steps for users of affected services once it has them; the companies have not yet identified the underlying issue or the number of affected accounts.CyberSIXT