SANS Stormcast Monday, November 9th, 2026: sshole Scans (CVE-2026-123158); SonicWall SonicOS MFA Bypass (CVE-2026-19868); Entra Device Regis

From SANS Stormcast: Daily Cyber Security News · 7:01

Show by Johannes Ullrich

ISC honeypots seeing sshole (CVE-2026-123158) exploitation attempts; SonicWall patches seven SonicOS flaws including an already-exploited SSL VPN MFA bypass; Microsoft cloud-fixed an Entra Device Registration elevation-of-privilege bug; Apiiro found Claude Code saving secrets into .claude/settings.local.json on GitHub.Scans for sshole Vulnerability (CVE-2026-123158)ISC honeypots are seeing long letter-A passwords that look like sshole exploitation, with clear attempts starting November 5th after earlier long passwords that were mostly buggy brute-force scripts dumping shell commands into the password field. Honeypots only keep the first 255 characters of each password, which limits what can be measured.https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498SonicWall SonicOS Multiple Vulnerabilities (SNWLID-2026-0014)On Friday SonicWall released patches for seven SonicOS vulnerabilities; one already-exploited flaw lets attackers bypass multi-factor authentication for SSL VPN logins when an alternate authentication method without MFA is also defined. Patch promptly press and CISA associate the exploited issue with CVE-2026-19868.https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/Entra Device Registration Elevation of Privilege (CVE-2026-109469)Microsoft patched an authorization bypass in Entra Device Registration over the weekend that could let an unauthorized attacker elevate privileges. No customer action is required: it is a Microsoft-hosted cloud service, and Microsoft says there was no exploitation at the time of the fix and rates future exploitation less likely.https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469Claude Code Leaking Secrets on GitHubApiiro reports that Anthropic's Claude Code can store credentials in .claude/settings.local.json when you tell it not to ask again about an API or command, and that on the order of a thousand-plus of those credential files have shown up on GitHub. ISC web honeypots also saw new requests for the .claude directory this weekend; rotate exposed secrets and watch for Anthropic updates.https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-againhttps://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.htmlSANS Difference Makers Votehttps://www.sans.org/go/difference-makers-awards-2026My Upcoming Classeshttps://www.sans.org/profiles/dr-johannes-ullrich

More episodes of SANS Stormcast: Daily Cyber Security News

More episodes

PodSearch is a free, independent podcast search engine. Read about PodSearch, the privacy policy or contact us.