Verified status
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-19868 in SonicWall SonicOS SSLVPN is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-11-06; federal remediation due 2026-11-20). NVD rates it 7.5 (HIGH) on CVSS v3.1. (checked 2026-11-07)
- CVE-2026-123158 in OpenSSH: the source articles reported no exploitation. NVD rates it 8.1 (HIGH) on CVSS v3.1. (checked 2026-11-07)
- CVE-2026-83844 in Microsoft Paint: the source articles reported no exploitation. NVD rates it 8.1 (HIGH) on CVSS v3.1. (checked 2026-11-07)
- CVE-2026-109618 in PHP Group PHP is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-10-26; federal remediation due 2026-10-29). NVD rates it 9.8 (CRITICAL) on CVSS v3.1. NVD lists a vendor advisory. (checked 2026-11-06)
TL;DR
Claude Code's "Don't Ask Again" feature exposed passwords and API keys in 1,122 public GitHub repositories [1]. WordPress patch installation still vulnerable to attack during the update process [2]. SonicWall VPN authentication bypass actively exploited; patch available [8,26,31].
Executive Summary
- Anthropic's Claude Code assistant left developer secrets in publicly accessible GitHub repositories when users selected "Don't Ask Again" on command approvals.
- WordPress sites remain vulnerable during patch installation due to unpacking with legacy unpatched code; update window creates exploitable window.
- SonicWall SonicOS SSLVPN authentication bypass (CVE-2026-19868) is actively exploited in the wild; CISA added to Known Exploited Vulnerabilities catalog with federal remediation deadline.
- OpenAI's GPT-6 Cyber security model identified 81 previously unknown Firefox vulnerabilities and 948 Linux kernel exploits. ⚠
- Google and partners dismantled botnet comprising 1.3 million Android TV set-top boxes used for proxy rental and advertising fraud.
Top Threats Today
1. Claude Code Credential Exposure in Public Repositories
Severity: HIGH Affected: Technology
Passwords and API keys typed into commands approved in Anthropic's Claude Code AI assistant were saved in plaintext in 1,122 public GitHub repositories [1]. When a developer selected "Yes, and don't ask again" to authorize a command, the assistant cached the entire command including embedded secrets [1], making credentials trivially discoverable via public repository search.
Sources:[1] The Hacker News
Recommended Action
- Immediately rotate all API keys and passwords that may have been used in Claude Code sessions over the past 30 days
- Search your organization's GitHub repositories (including forks and archived repos) for exposed credentials using automated secret scanning tools
- Review Claude Code usage logs to identify which commands were approved with "don't ask again" option enabled
- Disable Claude Code's caching feature or require per-session approval until Anthropic releases a fix
2. WordPress Patch Installation Vulnerability Window
Severity: HIGH Affected: Technology
WordPress sites can be attacked during the installation of security patches because the update process unpacks new files using the site's old, unpatched code [1]. A researcher at Picus Security identified that attackers can strike during this vulnerability window before the fix is fully applied ⚠[1].
Sources:[1] The Hacker News
Recommended Action
- Schedule WordPress patch installation during maintenance windows with reduced traffic and active monitoring enabled
- Temporarily disable publicly-facing WordPress services during the patch process if operationally feasible
- Implement Web Application Firewall (WAF) rules to detect and block exploitation attempts against known WordPress CVEs during the update window
- Verify patch completion by checking WordPress version numbers and re-scanning for vulnerabilities post-update
3. SonicWall SSLVPN Authentication Bypass (CVE-2026-19868)
Severity: HIGH Affected: Technology
SonicWall SonicOS SSLVPN contains a single-factor authentication vulnerability (CVE-2026-19868, CVSS 8.1) that allows users with valid credentials for one authentication method to bypass SAML authentication controls, including SAML-enforced multi-factor authentication [1][2][3]. The vulnerability is actively exploited in attacks [1]. CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a federal remediation deadline of November 20, 2026 [3].
Sources:[1] BleepingComputer[2] SecurityWeek[3] CISA KEV
Recommended Action
- Apply SonicWall security updates immediately; verify patch deployment across all SonicOS instances [26]
- Review SSLVPN access logs for any suspicious authentication patterns or credential re-use across different methods
- Enable additional SSLVPN logging and alerting on successful logins using alternate authentication methods
- Conduct forced re-authentication for all active VPN sessions and require password reset for all SSLVPN users
4. Critical PHP Vulnerabilities Enabling Server Takeover (CVE-2026-109618, CVE-2026-109619)
Severity: HIGH Affected: Technology
A pair of PHP vulnerabilities allow attackers to seize full control over affected servers, with working exploits publicly available [1]. These flaws may impact nearly 70 percent of websites according to security experts [1]. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 [1].
Sources:[1] Krebs on Security
Recommended Action
- Prioritize PHP updates immediately; identify and catalog all systems running affected PHP versions
- Apply patches and test thoroughly in staging environments before production deployment
- Monitor web server error logs and access logs for signs of exploitation attempts or successful compromise
- Implement Web Application Firewall signatures to detect and block exploitation payloads
5. 1.3 Million Android TV Boxes Compromised in Botnet Operation
Severity: MEDIUM Affected: Technology
Google and industry partners dismantled a botnet comprising over 1.3 million Android TV set-top boxes that shipped with malicious software [1]. The malware secretly rented infected users' Internet connections to third parties and conducted advertising fraud [1]. Experts involved in the takedown attributed the botnet operation to illicit proxy rental services [1].
Sources:[1] Krebs on Security
Recommended Action
- Check IoT and set-top box inventory for devices that shipped pre-compromised; contact vendors for remediation guidance
- Segment IoT devices from critical networks using network access controls and zero-trust policies
- Monitor outbound connections from TV boxes and media devices for anomalous bandwidth usage patterns
- Enable automatic security updates on all consumer electronics and media devices where available
Ongoing Threat: Previously Reported Vulnerabilities
Earlier briefings covered OpenSSH SSHole (CVE-2026-123158), Microsoft Paint RCE (CVE-2026-83844), and additional SonicWall flaws (CVE-2026-102255). See earlier coverage for details. These threats remain active and should be included in ongoing patch management cycles.
Today’s Action Checklist
- ☐ URGENT: Identify and rotate all API keys and credentials that may have been exposed via Claude Code in GitHub repositories
- ☐ URGENT: Apply SonicWall SonicOS patches and verify deployment before November 20, 2026 deadline (CISA KEV)
- ☐ URGENT: Update PHP and test in staging; apply to production during maintenance window with active monitoring
- ☐ HIGH: Schedule WordPress security updates during maintenance windows with WAF protection enabled
- ☐ HIGH: Scan GitHub repositories (public and private) for exposed credentials using automated secret detection tools
- ☐ MEDIUM: Audit Android TV and IoT device inventory; segment from critical infrastructure