SonicWall has released security updates addressing seven SonicOS vulnerabilities, including CVE-2026-19868, an SSL-VPN authentication bypass that lets attackers with valid alternate credentials evade SAML authentication, including SAML-enforced MFA. SonicWall confirmed it is investigating a report of active exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, directing federal agencies to patch by November 20, 2026. The fix also covers two 8.8-severity management interface bugs, pre-authentication buffer overflows in SSL-VPN and TACACS+ services, and a weak password hashing issue on virtual appliances.
bleepingcomputer.com
· 2026-11-06
QNAP has confirmed that attackers are exploiting a chain of four Plex Media Server vulnerabilities, dubbed Plex2Shell, to compromise customers' NAS devices. The company says its technical support team is assisting affected users and is urging everyone to update Plex Media Server to version 1.43.3.10861 via the QNAP App Center. QNAP clarified that the flaws affect only Plex Media Server, not its QTS, QuTS hero, or other NAS operating systems.
bleepingcomputer.com
· 2026-11-06
Shadowserver reports more than 1,000 internet-facing GitLab servers remain vulnerable to CVE-2026-97229, a critical integer overflow bug in GitLab's CI/CD Regular Expression Compiler that lets unauthenticated attackers run arbitrary code via crafted regex in pipeline configs. GitLab shipped fixes on October 12 in versions 19.4.2, 19.3.5 and 19.2.8, but CISA has now confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until Sunday to patch.
bleepingcomputer.com
· 2026-11-02
Eclypsium's October InfraTrust Pulse report tracked 133 new security advisories across 18 vendors between September 18 and October 14, covering 2,813 vulnerabilities, with 37 rated critical and 58 exploitable remotely without authentication. The report highlights so-called PHP2Shell flaws affecting PHP code embedded in the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances, noting that 16 advisories involved vulnerabilities already listed in CISA's Known Exploited Vulnerabilities catalog.
bleepingcomputer.com
· 2026-10-28
Check Point disclosed that hackers are actively exploiting CVE-2026-85102, a pre-authentication remote code execution flaw in its Security Gateway VPN certificate handling, and CVE-2026-93616, a path traversal bug in its Management web service. The company says the path traversal flaw has been exploited as a zero-day since July 23, while exploitation of the gateway flaw began September 12 using VPNs and proxies to mask attacker origin. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 25, 2026 to patch.
bleepingcomputer.com
· 2026-09-23
Cisco disclosed and fixed several critical vulnerabilities in its Identity Services Engine and ISE-PIC products, including CVE-2026-76460, a maximum-severity authentication bypass that attackers are already exploiting in the wild. The flaw lets an attacker send a crafted request to an unguarded API endpoint and slip past ISE's web management interface entirely. CISA added the bug to its Known Exploited Vulnerabilities catalog the same day the patch shipped.
darkreading.com
· 2026-09-18
GoKawiil