SonicWall's SSL-VPN MFA bypass is live; ChatGPT's Lockdown Mode had a hole; AI agents minted 948 kernel exploits

Ccisa.gov · 2 days ago

SonicOS CVE-2026-19868

Takeaway: CVE-2026-19868

SonicWall's latest SonicOS update closes seven firewall bugs, and the urgent one is CVE-2026-19868: on SSL-VPN services configured with SAML login, an attacker who already holds valid credentials for a different authentication method can slip past the SAML controls — SAML-enforced MFA included. CISA has added it to its Known Exploited Vulnerabilities catalog (KEV, the US list of bugs confirmed used in the wild), so treat it as under attack. Affected are Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier; the fixes are 7.3.4-7013 and 8.2.3-8015, and SonicWall offers no workaround.

Only SAML-configured SSL-VPNs are hit, so check those settings first: with SSO on, a leaked password becomes a full login and the second factor stops mattering. The same advisory also closes two 8.8-severity management-interface flaws that let unauthenticated attackers perform operations, so the upgrade earns its keep either way. CISA has ordered US federal agencies to secure affected systems by November 20; check your current SonicOS release before anything else on the firewall this week.

Read it at cisa.gov

Affected: Gen7 7.3.3-7015 and earlier; Gen8 8.2.2-8015 and earlier · Fixed in: 7.3.4-7013 and 8.2.3-8015 · We had it 7 Nov, 03:31 UTC

Check Point Research · 4 days ago

ChatGPT Lockdown Mode

Takeaway: needed no click

Check Point found a way around Lockdown Mode, ChatGPT's opt-in defence against prompt injection (instructions hidden in content that make the AI act on them) leaking your data. The HTML-preview feature renders pages in a sandboxed iframe, but that sandbox still granted popup rights: a page could open one more iframe inside the preview, grab its window.open, and pop a window that escapes both the sandbox and Lockdown Mode. In the Electron-based ChatGPT Classic desktop app this needed no click at all, so a malicious prompt, custom GPT or shared chat could silently post your whole chat history to an attacker's server, or show a convincing fake ChatGPT window pushing a malware download or a credential-stealing login.

OpenAI's fix removed the two popup permissions from the preview iframe's sandbox, and Check Point retested and confirmed the route is closed. If you sold Lockdown Mode internally as the control that makes sensitive chats safe, the lesson is that each convenience feature re-opens a channel the mode was built to shut: keep genuinely sensitive material out of shared chats and custom GPTs. The zero-click variant was specific to the desktop client; in a browser the attacker needs one click on the previewed page.

Read it at Check Point Research

Disclosed 5 Nov · We had it 6 Nov, 03:33 UTC

Microsoft Security Blog · 3 days ago

ARTEX secret hunting

Takeaway: five minutes

Microsoft Threat Intelligence documents criminal agents sweeping GitHub for leaked credentials and AI keys, then signing into Entra ID tenants, Azure and Microsoft 365 with them to read Key Vault secrets, mail and files. One observed agent needed just five minutes between spotting a leaked client secret and pulling data out of a Key Vault.

Block 199.19.77.84 for workload identities, hunt service-principal sign-ins from that address, rotate anything ever committed publicly, and move OAuth apps off client secrets onto managed identities. Microsoft watched the agent retry failed Azure API calls with corrected versions 28-80 seconds later — troubleshooting at machine speed.

Read it at Microsoft Security Blog

Check Point Research · 4 days ago

ARTEX campaigns

Check Point counted more than 1,800 exposed ARTEX instances and, from ten consoles that leaked their databases, watched financially motivated campaigns run almost entirely on their own once the operator set a goal. Chinese models dominated, with Deepseek Flash the most common; the only guardrails that pushed back were Anthropic's.

Expect broad, opportunistic attacks that no longer need a skilled operator behind them, and treat odd traffic patterns as agent noise rather than a bespoke intrusion. One operator burned 36 billion tokens over two weeks stealing iOS code-signing certificates from grey-market shops; 300-plus taken, three passed validation.

Read it at Check Point Research

“These tools allow cybercriminals to execute operations at an unprecedented speed and with capabilities beyond the actors actual technical proficiency.”

GitHub (anthropics/claude-code) · 4 days ago

Claude Code

Takeaway: no fix is out yet

A bug report on the CLI claims it puts the user's email address in the User-Agent header on web-search requests, visible to every site the agent visits; the reporter says it brought dozens of scam emails a day. The issue is open and no fix is out yet.

If your teams run Claude Code's web search under accounts tied to real people, that identifier now sits in third-party logs — worth checking your own proxy logs before assuming the tool is private. Reported on version 2.1.318, macOS, and labelled area:security by the maintainers' automation.

Read it at GitHub (anthropics/claude-code)

oss-security mailing list · 2 days ago

Open WebUI

Takeaway: about 2.1 seconds

From any ordinary user's token, the master key falls blind in about 2.1 seconds across a plus-or-minus-one-day window, and an administrator token can then be minted.

No fix exists: the vendor disputed the report and the CVE was rejected in June, with guidance of no action required. On Windows installs, set WEBUI_SECRET_KEY yourself from a real secret and restart the service. Every one of the 178 release tags ships this construction; releases from v0.12.0 onward add a per-account check so one account's token can't be minted for another, but the master key still falls on all of them, and 171 tags carry no check at all.

Read it at oss-security mailing list

Socket Threat Research · 3 days ago

strutil-core (RubyGems)

Takeaway: 70 seconds after publication

The gem strutil-core 1.0.1 ran a 5.48 MB credential-stealing worm at install time: it harvests cloud, CI, SSH and AI-tool credentials (including Claude and Codex auth files), injects MCP servers and hooks into AI tool configurations, and installs a backdoor steered by signed GitHub commit messages. If a stolen GitHub token starts returning 401 or 403, a background monitor deletes the home directory.

RubyGems pulled both versions about five hours after publication and no victims are confirmed, but if it ever touched a machine, rotate every credential — and snapshot before revoking GitHub tokens, since revocation is the wiper's trigger. Socket's AI scanner flagged the payload as known malware 70 seconds after publication.

Read it at Socket Threat Research

Knostic · 2 days ago

doomsday-escrow skill

A skill listed in two large public agent catalogs tells agents to download and run bounty.py from doomsday.network to check that GitHub bounties have escrowed funds — but the operator issuing the bounties also runs the verification, and a separate sponsor command ships the wallet's private key to the backend.

No victims or key misuse are established (the analysis was static only), and a revised catalog copy dropped the download-and-run step a day later. The pattern is the lesson: an agent that fetches and executes remote code on a stranger's say-so is a supply-chain risk, whatever the verification label claims. AgentMesh scored the original catalog copy Dangerous; all ten open escrows on the board share a single lock transaction ID.

Read it at Knostic