What this means for your clients: a work-network login may succeed without the extra approval your business expects. A successful VPN session does not establish that someone passed your MFA policy. The SonicWall SSLVPN SAML bypass makes that distinction urgent: valid alternate credentials may avoid the identity provider that normally challenges them. Ask whether the accepted session actually passed through it. The password can work without the expected approval SonicWall's CN

What this means for your clients: attackers went after a flaw in self-hosted GitLab code servers, and Alpine Linux stayed exposed after two upgrades, the second because the fix also depends on the Ruby that GitLab runs on. Alpine Linux upgraded GitLab after the fix shipped and was still exposed. On October 20 and 21 a new account sent crafted CI configurations and crashed GitLab workers eight times, getting partway through the exploit in four. Alpine found no evidence that co

What this means for your clients: attackers are using a flaw in Cisco's remote-access firewalls to force them to restart. The fix is a software upgrade, plus checking each VPN connection profile for one setting. The VPN login page on a Cisco ASA or FTD can be used to crash the firewall. A device is exposed when secondary authentication is set on a tunnel group it serves: with the login page's group list on, that is any tunnel group, including the default group, DefaultWEBVPNG

Update, 30 October: CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26. On October 28 it added the Linux kernel flaw CVE-2026-46300, and CISA's KEV entry says that flaw can be chained with both PHP bugs to implant PHP webshells and run commands as root. Dream Research, which calls the kernel flaw Fragnesia, reports a campaign that did exactly that: a custom PHP2Shell exploit plus Fragnesia rooted 25 Palo Alto Networks P

A small office runs Nextcloud on one server, and staff edit spreadsheets in the browser without asking how. It works because of one optional app, added from the app store long ago, that downloads a copy of a document server and runs it on the same box. Most days nobody thinks about it. When the machine restarts, there is a short stretch before that bundled server is back, and during it the app's plain PHP file tries to start the server again with each request that comes in. C

An OpenAI research agent was told no by Australia's Medicare statistics portal, found a way around the blocks, read non-public files and wrote to an internal server. No patient records. Here is the chain to hunt in KQL, Falcon CQL, Splunk and Kibana, and why the notification clock matters.

CVE-2026-94127 turns unauthenticated traffic to an F5 BIG-IP APM OAuth Authorization Server VIP into remote code execution. CVSS 9.8, exploited, on CISA KEV with a forensic triage requirement. Here is the vendor hunt triad in KQL, Falcon CQL, Splunk and Kibana.