SonicWall has released security updates addressing seven SonicOS vulnerabilities, including CVE-2026-19868, an SSL-VPN authentication bypass that lets attackers with valid alternate credentials evade SAML authentication, including SAML-enforced MFA. SonicWall confirmed it is investigating a report of active exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, directing federal agencies to patch by November 20, 2026. The fix also covers two 8.8-severity management interface bugs, pre-authentication buffer overflows in SSL-VPN and TACACS+ services, and a weak password hashing issue on virtual appliances.
bleepingcomputer.com
· 2026-11-06
Microsoft has resolved an Always On VPN bug that caused connection failures after the September 2026 Windows 11 security update, confirming the fix is included in this month's KB5127936 preview update. The company had earlier mistakenly claimed the issue was resolved in October's cumulative update. Affected users saw VPN connections stuck in a 'Connecting' state or fail with a 'port already in use' error when automatic protocol selection or fallback was configured.
bleepingcomputer.com
· 2026-10-30
Cisco has issued security updates for CVE-2026-76418, a high-severity flaw in ASA and FTD software that lets unauthenticated attackers remotely crash firewalls configured with webvpn and SSL VPN enabled. Cisco's PSIRT confirmed active exploitation in October 2026 but has not disclosed indicators of compromise or details on targeted organizations or attackers. Admins unable to patch immediately can mitigate by disabling secondary authentication on affected tunnel groups.
bleepingcomputer.com
· 2026-10-29
Surfshark reports that a counterfeit TikTok Shop site generated over 320,000 phishing blocks between May and September 2026, accounting for 19% of all global phishing domain blocks tracked by its web content blocker. The VPN provider says the fake site remained the most-blocked phishing domain into October and is still active, with overall monthly phishing blocks rising 524% from April to September.
zdnet.com
· 2026-10-27
Security researchers at Cyberdione Labs identified 11 vulnerabilities, collectively dubbed Tailworm, in Tailscale 1.104.2 and self-hosted headscale v0.29.5 that remain unpatched. The most severe flaw lies in Tailscale's embedded SSH server, where unix-socket forwarding bugs could let an authorized device gain root-level code execution, steal enrollment keys, or delete arbitrary root files on a target machine. Founder Erica Windisch said the issues were confirmed in a lab using unmodified released software and were disclosed publicly to speed up fixes.
bleepingcomputer.com
· 2026-10-27
A guide details split tunneling, a VPN feature that lets users choose which apps or sites route through the encrypted VPN connection and which connect directly to the internet. The feature is included in many VPN packages and helps users avoid the speed loss or location-masking issues that can come with routing all traffic through a VPN.
wired.com
· 2026-10-23
Microsoft told IT admins it wrongly marked an Always On VPN connection bug as resolved in October 2026 Windows 11 cumulative updates, reverting the status to 'Mitigated.' The bug, first acknowledged in September, can leave VPN connections stuck or failing with a 'port already in use' error on Windows 11 24H2 systems using automatic protocol selection.
it.slashdot.org
· 2026-10-22
Microsoft says it incorrectly marked an Always On VPN connection bug as resolved in its October 2026 Windows 11 cumulative update. The company has reverted the issue's status from 'Resolved' to 'Mitigated' and says a real fix will arrive in a future update. In the meantime, it recommends IT admins work around the problem by manually selecting a single VPN tunneling protocol instead of automatic protocol selection.
bleepingcomputer.com
· 2026-10-21
CISA, the FBI, the US Secret Service, and law enforcement agencies in Germany and the UK issued a joint advisory stating the SafePay ransomware gang has compromised more than 600 critical infrastructure organizations across North America, South America, Europe and Australia since August 2024. The agencies said SafePay actors gain access through credential theft, brute-force attacks, and VPN exploitation, particularly targeting Mullvad VPN IP addresses, and often delete shadow copies and reset network-attached storage to hinder recovery.
bleepingcomputer.com
· 2026-10-21
Rouler is a new Windows utility that allows users to assign individual applications, or specific IP addresses, to separate network interfaces at the same time. For example, a browser could use a privacy VPN, a work app could use a corporate tunnel, and other traffic could go through the normal connection simultaneously. The developer describes it as working purely at the network layer, distinct from a VPN or firewall.
rouler.io
· 2026-10-20
A developer has released RawLink, an open-source tool written in Rust that creates an encrypted TCP tunnel using AES-256-GCM. It routes traffic from a local SOCKS5 proxy through the tunnel to a remote server, supports multiple simultaneous streams and tunnels, and offers optional obfuscation and SSH traffic mimicry to disguise connections. The author notes the code was written with AI assistance and has not yet undergone a formal security audit.
github.com
· 2026-10-19
A tech opinion piece examines whether paid antivirus subscriptions remain worthwhile now that threats have shifted from classic viruses toward phishing pages, scam emails and fake tech-support pop-ups. It notes that vendors like Malwarebytes and Norton bundle extras such as VPNs, password managers and cloud backup into paid tiers, while Microsoft Defender plus free scanners and browser protections like Edge's SmartScreen already cover most core needs.
engadget.com
· 2026-10-19
GoKawiil