Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification steps and affiliate networks to generate revenue without delivering the promised rewards.
U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS. “An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” reads the advisory. The flaw occurs when the system does not properly enforce SAML authentication controls. An attacker who already has valid credentials for an alternative authentication method may exploit this weakness to bypass SAML-based authentication. The impact is particularly serious when organisations rely on SAML to enforce multi-factor authentication (MFA). Successful exploitation may allow an attacker to access the SSL VPN without completing the expected SAML authentication process, potentially bypassing the additional MFA protection. In practical terms, the vulnerability could weaken an organisation’s remote access security by allowing users with alternative valid credentials to circumvent its intended authentication controls. It’s important to highlight that this is not an unauthenticated remote access vulnerability. The attacker needs valid credentials for an alternative authentication method, but may then bypass SAML-enforced security controls. SonicWall’s PSIRT team is investigating a report of possible exploitation of this flaw. The company strongly recommends that customers install the latest available update as soon as possible to reduce the risk of attacks. “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.” reads the advisory. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by November 20, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA). The flaw has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication. In a security advisory published Friday, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack and urged customers to install the latest security updates. "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks," the company warned.
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company.
Layer3 found residential proxy traffic using the White House network, raising concerns about potential exposure of internal systems. Layer3 Intel says it found residential proxy traffic leaving through the White House network. The researchers spotted it while browsing their new Residential Proxy Observatory, a tool that gives a global view of residential proxy and anonymized internet activity. “While our team was looking through it, we noticed residential proxy exit activity on AS2650. AS2650 is registered to the Executive Office of the President, the federal agency that hosts the White House network.” reads the report published by Layer3. A residential proxy service allows customers to use everyday devices to route their internet traffic. This makes their activity look as if it comes from the device’s normal home internet connection. Layer3 detected this activity on AS2650, a network registered to the Executive Office of the President, the agency responsible for the White House network. Layer3 has not accused anyone at the White House of wrongdoing and says its data cannot identify who or what caused the activity. Between October 5 and November 3, Layer3 detected 236 connections through this network. The traffic came from six IP addresses and was recorded on 26 of those 30 days. A total of 28 residential proxy services were able to use the network. To check their findings, researchers compared the IP addresses with data from other security services, including Spur and Synthient. Both services also identify these addresses as residential proxy exit points. Getting this data took no special skill. Anyone can sign up to a public residential proxy service, pay a few dollars and send requests through it. Layer3 says it didn’t target the network or try to steer its probes there, and it caught the activity by chance, simply by requesting global rotating access through these services. The timing suggests something more than a guest network. About half the activity falls between 5 p.m. and midnight Eastern time, and almost none happens in the early morning. Layer3 reads that as a person, not public guest Wi-Fi: someone regularly on the White House network late into the evening whose device carries a proxy SDK, a software kit that turns a device into an exit point. “Past research has shown that poorly secured proxy SDKs can allow internal network access and lateral movement. This is how past botnets have spread. In A Broken System Fueling Botnets, the researchers at Synthient documented how the Kimwolf botnet reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks.” continues the report. “If an SDK on this network has the same kind of flaw, anyone buying proxy access could use it to reach internal systems.” That matters because poorly secured proxy SDKs have let attackers into internal networks before. Synthient’s research, A Broken System Fueling Botnets, documented how the Kimwolf botnet reached at least 2 million devices, mostly Android devices with an exposed ADB service, through residential proxy networks. If an SDK on the White House network has the same kind of flaw, anyone buying proxy access could reach internal systems. Layer3 doesn’t claim that’s the case here, and it describes the risk as conditional. The White House isn’t the only surprise. The observatory also finds residential proxies in some of the most isolated places on the planet. Saint Helena, Ascension and Tristan da Cunha, a South Atlantic territory that includes the most remote inhabited island in the world, shows 413 addresses and more than 32,000 observations, split between Starlink and the local provider, Sure Saint Helena. Layer3 also detected three instances of proxy activity in Antarctica. All came from a Cloudflare WARP address linked to McMurdo Station. The researchers jokingly noted that penguins are not suspects. On Pitcairn Island, they found one Starlink address and one observation. Norfolk Island had one Norfolk Telecom address with four observations, while Svalbard had one Starlink address in Longyearbyen with three observations. The researchers also found 388 addresses in the Falkland Islands, 43 in the Chagos Islands, 21 in Tokelau and seven in South Georgia. These findings suggest that residential proxy networks now operate in almost every corner of the world. For security teams, the main concern is that devices connected to protected networks could unknowingly become proxy exit points, potentially exposing those networks to outside traffic. However, Layer3 says its data only shows where proxy traffic exits. It cannot identify the device being used or the person behind it. As the company explains, “Our data shows the exits, not the device or the person behind them.” “Residential proxies have infected every corner of the world, and it looks like there is no place they cannot reach. Layer3 Intel tracks residential proxy and anonymization infrastructure worldwide. Even when the proxies hide in networks on the farthest corners of the planet, we can still observe them, leaving threat actors no place to hide.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, proxy traffic)
Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies. The post Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System appeared first on Unit 42.
OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. The company announced the model on Thursday, saying it significantly improves on earlier AI models in finding software vulnerabilities, validating their impact, and helping developers create fixes. During security testing, GPT-6 Cyber discovered 81 previously unknown high-severity vulnerabilities in Firefox and helped develop patches, many of which Mozilla has already released. In separate Linux kernel research, the model identified 2,308 potential security flaws, successfully reproduced 1,724 vulnerabilities, and developed local privilege escalation exploits for 948 distinct vulnerabilities that could allow an unprivileged user to gain root access.
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. The campaign started about two years ago and initially targeted crypto wallet users, but recently the threat actor switched focus and published malicious repositories for automating scans, security testing, and log analysis. Researchers at cybersecurity company Dr. Web found that more than 2,000 Windows systems have been compromised so far. One malicious repository they found is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner. Previous lures included blockchain games, bots, and cheat tools, typically targeting blockchain and game enthusiasts. Dr. Web's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace, an old technique that still proves effective.
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. The vendor said it had received multiple reports of suspected compromises involving customers’ network-attached storage (NAS) devices. "QNAP has received reports from some users that Plex Media Server on their NAS appears to have been compromised through [Plex2Shell] vulnerabilities, and QNAP Technical Support is assisting the affected users,” the company says in an advisory today. Plex2Shell is a chain of four vulnerabilities in the Plex Media Server, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Security researcher Zach Main discovered and reported the flaws to Plex on July 27. Exploitation started shortly after the full technical details became public on October 16.
Confirm this action.
Leaving now will discard your changes.