# Today's Top Stories

SonicWall patched CVE-2026-19868 in SonicOS, an actively exploited SSL-VPN authentication bypass that allows attackers with credentials for one login method to circumvent SAML-enforced MFA checks. The fix is part of a seven-vulnerability update batch, and the active exploitation status makes immediate patching critical for organizations using SonicWall VPN appliances.

CVE-2026-123158 (CVSS 8.1), dubbed 'SSHole,' targets OpenSSH on Linux systems running the musl C library with PAM disabled, allowing unauthenticated root login to accounts with no password set. Threat actors began exploitation attempts within hours of disclosure, with Previdian researchers confirming root access achieved on a honeypot, underscoring the urgency of patching affected systems.

OpenAI launched GPT-6 Cyber, a security-focused AI model that reportedly identified 81 vulnerabilities in Firefox and 948 exploitable conditions in the Linux kernel during internal testing. The model is rated 'Critical' for cybersecurity capability and is designed to stay within researcher-defined scope boundaries more reliably than its predecessor GPT-5.6 Cyber.

Blockchain intelligence firm Chainalysis confirmed a 'multifront cyberattack' exposed credentials and live session tokens for its entire customer base, with attackers deploying AI agents and conducting on-path data interception. The breach is particularly significant given Chainalysis's role supporting law enforcement and financial institutions in cryptocurrency investigations.

French cooperative bank Crédit Mutuel Arkéa suffered a cyberattack via a third-party service provider that enabled fraudulent transactions totaling up to $133 million, forcing the bank to suspend certain systems. The attack illustrates continued risk from supply chain and third-party provider compromises targeting financial institutions.

Three suspects face charges for using AI-generated deepfakes to impersonate CEOs and lawyers, defrauding businesses of $129 million by tricking accounting staff into authorizing large wire transfers. US authorities are pursuing extradition from Europe in what represents one of the larger AI-assisted business email compromise cases prosecuted to date.

QNAP is warning users of active exploitation of the 'Plex2Shell' vulnerability chain, which allows attackers to compromise NAS devices running Plex Media Server; users are urged to update immediately via the QNAP App Center. NAS devices are high-value targets for ransomware operators, and Synology also issued concurrent warnings about NAS ransomware attacks.

Certificate authority DigiCert disclosed a data breach in which an unauthorized account was created on an inadvertently externally accessible internal business system, exposing customer names, email addresses, phone numbers, and business addresses. The breach raises supply-chain trust concerns given DigiCert's role in issuing TLS certificates relied upon across the internet.

Apiiro researchers identified 1,122 public GitHub repositories containing passwords and API keys inadvertently stored by Claude Code's 'Yes, and don't ask again' feature, which saves approved commands verbatim—including embedded secrets—to a project settings file. Developers using Anthropic's Claude Code should audit their repositories for exposed credentials in CLAUDE.md or similar settings files.

Grocery giant Ahold Delhaize quantified the financial damage from its October cyberattack at up to €250 million in lost Q4 sales, prompting a downward revision of its full-year 2026 outlook. The incident is part of a broader wave of attacks on European supermarket refrigeration and IT systems, with US agencies separately issuing guidance to harden refrigeration controllers against similar threats.