CISA added a SonicWall SSL-VPN authentication bypass to its exploited vulnerabilities catalog, and the flaw can bypass SAML-enforced MFA. DigiCert confirmed a breach exposing customer business contact details and some passports and driver's licences after an internal system was exposed to the public internet. Researchers also found 1,122 public GitHub copies of Claude Code settings files holding 1,379 secrets.
Illustration
Illustration DigiCert confirmed a breach after an internal system exposed to the public internet during a 2025 migration allowed unauthorized accounts to read archived customer records. The data included names, business contact details and, in some cases, passports, driver's licences and utility bills. An unauthorized account accessed records between June 27 and July 2, 2026.
Illustration CISA added CVE-2026-19868, an authentication bypass in SonicWall SonicOS SSL-VPN, to its Known Exploited Vulnerabilities catalog. The flaw can let an attacker with valid credentials for another authentication method bypass SAML controls, including SAML-enforced MFA, when the system does not properly enforce SAML authentication.
Illustration Apiiro found 1,122 public copies of Claude Code's .claude/settings.local.json file on GitHub that hold at least one password, token or API key, together containing 1,379 different secrets. The file can save exact commands with secrets in plain text when users choose 'Yes, and don't ask again,' and older versions can remain in git history or forks. Researchers advised rotating credentials before removing the file.
Illustration SonicWall released updates for seven SonicOS flaws, including CVE-2026-19868, an SSL-VPN authentication bypass that can bypass SAML-enforced MFA. The company said it investigated a report of exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog, ordering federal civilian executive branch agencies to secure affected systems by November 20, 2026.
6 NovFridayChainalysis breach widens as DigiCert admits data leak→ 
5 NovThursdayZyxel zero day and French bank breach lead day as APT29 targets mobile users→ 
4 NovWednesdayBinance says fake job interview led to $6.3 billion theft as APT29 targets phones→ 
3 NovTuesdayFridge attacks hit 100 European stores as Google bans maker of 1.3M box botnet→ 