Today's cybersecurity landscape highlights critical vulnerabilities being actively exploited and significant financial breaches. We're seeing AI tools inadvertently expose sensitive data, and network devices facing new authentication bypass attacks.
SonicWall Firewalls Hit by Actively Exploited Authentication BypassVulnerability
SonicWall has issued urgent patches for several security flaws in its SonicOS firewalls, including one (CVE-2026-19868) that allows attackers to bypass multi-factor authentication for SSL-VPN. This vulnerability is actively being exploited, enabling unauthorized access even when attackers hold credentials for other login methods.
Why it matters: If your business uses SonicWall firewalls, it's crucial to apply these security updates immediately to protect your network from active exploitation and potential breaches.
Read more at BleepingComputer ↗
AI Coding Assistant Exposes Passwords and API Keys on GitHubVulnerability
A feature in Anthropic's Claude Code AI assistant, designed to remember commands, has inadvertently exposed sensitive information. When users opt to save commands without being asked again, the AI includes any passwords or API keys typed, storing them in project settings files. Over 1,100 such files containing secrets have been found publicly available on GitHub.
Why it matters: When using AI coding assistants, always exercise extreme caution and avoid inputting sensitive credentials directly, as these tools can inadvertently store and expose them.
Read more at The Hacker News ↗
French Bank Suffers $133 Million Heist via Service Provider AttackBreach
Crédit Mutuel Arkéa, a French cooperative bank, was hit by a cyberattack that resulted in approximately $133 million in fraudulent transactions. The breach was orchestrated through a third-party service provider, forcing the bank to temporarily suspend various systems to mitigate the incident.
Why it matters: This incident underscores the critical importance of vetting third-party vendors and ensuring they maintain robust security practices, as their vulnerabilities can directly impact your business.
Read more at BleepingComputer ↗
Fake Gift Card Scams Impersonate Brands and CelebritiesOther
New reports highlight a surge in fake gift card scams that leverage the names of well-known brands and celebrities. These campaigns lure unsuspecting consumers with promises of free gift cards, then collect personal data and subscribe victims to unwanted services, generating revenue through deceptive affiliate networks.
Why it matters: Educate your employees and customers about common phishing tactics; always be suspicious of unsolicited offers and verify their legitimacy directly with the brand, not through provided links.
Read more at BleepingComputer ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.