Weekly Cut · Week 46

Period 3–9 November 2026 · Published on 10 November 2026

Weekly Cut – Katana Sec, calendar week 46

On SonicWall VPNs, multi-factor login can be bypassed – according to CISA this is already being exploited.

/ SonicWall VPN – multi-factor login can be bypassed

On SonicWall firewalls using central login (SAML) for the VPN, attackers with valid credentials can bypass the multi-factor check; the US agency CISA lists the flaw as already exploited.

→ Organisations using SonicWall for remote access should have the update installed promptly.

Our assessment

The flaw hits precisely those organisations that introduced multi-factor login properly through a central identity provider. The question for the service provider is: which other login methods are still active on the firewall, such as local accounts left over from the initial setup?

For IT teams

CVE-2026-19868, CVSS 7.5 (CISA-ADP rating), in the KEV catalog since 2026-11-06. Only the SSL VPN service with SAML login is affected; anyone holding credentials for another login method gets past the SAML check including MFA. SonicWall itself speaks of potential exploitation. Affected models and fixed versions in advisory SNWLID-2026-0014.

/ QNAP and Synology – attacks on network storage

Attackers are taking over QNAP devices via the Plex media server app and encrypting Synology devices running outdated software; Plex and Synology confirm the attacks.

→ Organisations using such a NAS should have updates installed and its internet exposure checked.

Our assessment

A NAS is often both file storage and backup. If encryption hits the device, both are gone – what matters is whether there is a copy the NAS itself cannot reach.

For IT teams

QNAP: attacks via a chain of flaws in Plex Media Server ("Plex2Shell"), not in QTS/QuTS hero itself. According to QNAP, update to Plex Media Server 1.43.3.10861 or later (App Center). The update does not remove malware already planted: if Plex was reachable from the internet (remote access, port forwarding, UPnP), check the device using the QNAP FAQ and reset passwords. Synology: ransomware on devices with outdated DSM via a flaw the vendor says was fixed in December 2024; update DSM and enable automatic updates.

/ Sabotage of refrigeration systems in food retail

Unknown actors in several European countries, according to the German BSI also in Germany, have remotely tampered with supermarket refrigeration controls; how they got in is still unclear.

→ Anyone operating refrigeration or building technology should have the controllers checked for internet exposure.

Our assessment

Refrigeration and building technology is usually run by an external contractor, not IT – so it rarely appears in any risk assessment. The key question this week is who manages remote access.

For IT teams

According to Unit 42, a first wave in October mainly in France and a second in early November in at least ten more countries; controllers were switched to defrost mode, in some cases causing fires. Access vector not confirmed; pro-Russian groups have claimed responsibility, unverified. CISA and partner agencies cite authentication bypass, code injection and weak configuration. Recommended (BSI, CISA): no direct internet access to controllers, remote maintenance only via VPN with multi-factor login, change default passwords, updates, review setpoint limits. See BSI cyber security recommendation 154.

/ AI tools find exposed credentials

Microsoft observes attackers using an AI-driven tool to search public code repositories for credentials and using them to get into cloud environments, files and mailboxes.

→ Organisations that have software developed should check whether credentials were ever public – including long-deleted ones.

Our assessment

The problem here is not a product but a process: credentials end up in code because things have to move fast. The question for development contractors is whether code is automatically checked for credentials before upload – and who gets told if something slips through anyway.

For IT teams

Microsoft Threat Intelligence: the agent framework ARTEX has been searching public GitHub repositories for OAuth app client secrets and AI API keys since August 2026; in one case five minutes passed from search to exfiltration of Key Vault contents. Followed by service principal sign-ins and access to storage keys, SharePoint/OneDrive and mailboxes. Recommended: treat publicly exposed secrets as compromised even if they were deleted; rotate the secrets and everything the app could read in Key Vault; move OAuth apps to managed identities.

/ OpenSSH – login with any password on Alpine Linux

On systems running the lightweight Linux distribution Alpine, SSH remote access accepts any overlong password for accounts without a password of their own; first attacks are already under way.

→ Anyone using Alpine should have the update installed.

Our assessment

The flaw hits precisely the accounts considered especially safe because they have no password at all. The question for device vendors and service providers is whether Alpine with password login runs inside their appliances – no software list shows that by itself.

For IT teams

CVE-2026-123158 ("sshole"), CVSS 8.1 (MITRE rating), in the KEV catalog since 2026-11-09. Affected: sshd on musl libc without PAM (Alpine default) with PasswordAuthentication; accounts with "*" in the password field (key-only users, directory service users, root with PermitRootLogin yes) accept very long passwords. According to Horizon3 also OpenWrt and other embedded devices. Fixed in OpenSSH 10.6p2 and the Alpine packages for 3.16 to edge (list in the Alpine advisory); the update does not restart sshd. Workaround: PasswordAuthentication no. Horizon3 reports confirmed exploitation, SANS sees attack attempts in honeypots.

More news

  • / WordPress: CISA lists a flaw in the WordPress core as actively exploited; site owners should check that their website has the update. (CISA)
  • / Cisco Secure Email Gateway: a crafted email can lead to takeover of the device without login; Cisco has released updates, there is no workaround. (Cisco)

← All issues