SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA). The flaw has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication. In a security advisory published Friday, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack and urged customers to install the latest security updates. "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks," the company warned.
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company.
Unit 42 examines recent cyberattacks targeting European refrigeration systems and outlines defense and mitigation strategies. The post Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System appeared first on Unit 42.
OpenAI has revealed GPT-6 Cyber, a new artificial intelligence model that has discovered 81 previously unknown high-severity Firefox vulnerabilities and developed working exploits for 948 distinct Linux kernel flaws. The company announced the model on Thursday, saying it significantly improves on earlier AI models in finding software vulnerabilities, validating their impact, and helping developers create fixes. During security testing, GPT-6 Cyber discovered 81 previously unknown high-severity vulnerabilities in Firefox and helped develop patches, many of which Mozilla has already released. In separate Linux kernel research, the model identified 2,308 potential security flaws, successfully reproduced 1,724 vulnerabilities, and developed local privilege escalation exploits for 948 distinct vulnerabilities that could allow an unprivileged user to gain root access.
Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. The campaign started about two years ago and initially targeted crypto wallet users, but recently the threat actor switched focus and published malicious repositories for automating scans, security testing, and log analysis. Researchers at cybersecurity company Dr. Web found that more than 2,000 Windows systems have been compromised so far. One malicious repository they found is a fake script advertised as a lightweight solution to parse, clean, and format output from the Fscan network scanner. Previous lures included blockchain games, bots, and cheat tools, typically targeting blockchain and game enthusiasts. Dr. Web's investigation found malicious code embedded in Visual Studio project files, Python scripts, and Go source files, hidden behind long stretches of whitespace, an old technique that still proves effective.
Veeam warned customers about boot failures affecting Software Appliance virtual machines (VMs) on hosts with AMD EPYC processors. The company's Software Appliance VMs are pre-configured, Linux-based virtual machines that let admins run the Veeam Backup & Replication backup software suite on Linux devices without manually installing dependencies or configuring the software. To comply with corporate and government security frameworks, the underlying Linux kernel runs integrated health and cryptographic checks (such as jitterentropy health tests) in FIPS mode during early boot. However, as the company explained in a Wednesday advisory, these VMs will fail to boot and will crash with a kernel panic after failing an early-boot FIPS-mode jitterentropy check on some AMD EPYC processors. "A Veeam Software Appliance (Linux-based Veeam Backup & Replication) virtual machine running on a host with an AMD EPYC processor intermittently fails to boot after a reboot, including a reboot that follows an update that installs a new kernel," it said.
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment. The new model is "more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set," OpenAI said. It has classified the model as
Blockchain intelligence firm Chainalysis says a recent attack on its systems and internal tools has exposed credentials and live tokens for all customers. Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering. Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide. This follows the company's disclosure last Friday that attackers using AI tools accessed customers' names, email addresses, user IDs, and organizational role labels using what it described as "offensive agentic techniques." While it initially said the impact was limited and the breach affected only non-sensitive identity metadata, later updates revealed that usernames and password hashes for all customers were exposed in an "on-path attack" (more commonly known as a Man-in-the-Middle or MITM attack).
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates
Confirm this action.
Leaving now will discard your changes.