Quiet Weekend: TUM Password Breach and Brenner Base Tunnel Intrusion Confirmed; SonicWall SSL-VPN MFA Bypass (CVE-2026-19868) and OpenSSH “SSHole” Still Active

Posted on by

This brief covers the trailing ~48 hours (November 7–9, 2026). It was a quiet weekend window: no new CISA KEV additions and no new vendor zero-day advisories landed in it. Two incidents were confirmed by the affected organizations during the window, and several active items from late last week continued to develop. Every item below is traced to its primary source (vendor advisory, CISA entry, or the organization’s own statement).

Technical University of Munich restores TUMonline after attackers stole central login passwords for every myTUM user

Technical University of Munich · November 9, 2026

TUM first disclosed the incident on November 6 and posted a status update on the morning of November 9. Unknown attackers compromised the myTUM portal and obtained the central login passwords of everyone registered there, then used a TUMonline system administrator’s credentials to attack TUMonline, the campus management system, which TUM took offline. Exposed data for all affected users includes the TUM account password, name, home address, and date of birth; employees additionally had work address and work phone number exposed, and students their student ID, degree program, and completed-semester count. TUM says attacker activity inside TUMonline was largely logged and it currently assumes grades and applications were not accessed. TUMonline access and password changes were restored on November 9; TUM has reported the incident to the Bavarian data protection authority and filed a criminal complaint. The number of affected accounts has not been disclosed, and the initial access vector has not been explained.

“User accounts with MFA were protected from this attack.” — TUM press release “IT Security Incident at TUM,” signed by Dr.-Ing. Alexander Braun, Executive Vice President for IT Systems & Services and CIO

Source: TUM press release · The Register

Brenner Base Tunnel operator BBT SE confirms targeted intrusion as Everest claims 812 GB of stolen data

BBT SE (via ANSA) · November 7, 2026

BBT SE, the Italian-Austrian company building the Brenner Base Tunnel, confirmed to ANSA on November 7 that it was the target of a cyberattack in which unauthorized parties accessed data reachable from the internet. The company says it isolated the affected systems, engaged external forensic specialists, and notified the competent authorities; based on current information, tunnel operations are not affected and there is no evidence that industrial or control systems were reached. The Everest extortion group has claimed the attack and says it exfiltrated 812 GB of files; that figure is unverified, and BBT SE has not confirmed any encryption of systems. The intrusion reportedly dates to mid-October and was first reported by Austrian press on November 6.

“Non appena rilevato l’incidente, la società ha attivato i protocolli di sicurezza informatica” (“As soon as the incident was detected, the company activated its cybersecurity protocols”) — BBT SE statement to ANSA

Source: ANSA · Security Affairs

Still developing

SonicWall SonicOS SSL-VPN authentication-enforcement flaw bypasses SAML-enforced MFA; exploited and in CISA KEV

SonicWall PSIRT / CISA · November 6, 2026

CVE-2026-19868 (CWE-308; CVSS 7.1 per SonicWall, 7.5 per the CISA ADP score on the CVE record) is an authentication-enforcement weakness in the SonicOS SSL-VPN service. When SAML is enabled for SSL-VPN logins, an attacker holding valid credentials for an alternate authentication method can bypass SAML and any MFA enforced through it. Affected: Gen7 TZ/NSa/NSsp/NSv firewalls on SonicOS 7.3.3-7015 and older, and Gen8 TZ/NSa/NSv on 8.2.2-8015 and older. Fixed in 7.3.4-7013 and 8.2.3-8015; no workaround is offered. SonicWall says it investigated a report of potential exploitation, and CISA added the CVE to the KEV catalog on November 6 with a federal remediation deadline of November 20. It is the only one of seven CVEs in advisory SNWLID-2026-0014 flagged as exploited. Review SSL-VPN logins that lack a matching identity-provider sign-in.

“Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” — SonicWall advisory SNWLID-2026-0014, as reproduced by SecurityWeek

Source: SonicWall PSIRT SNWLID-2026-0014 · CISA KEV alert · SecurityWeek · Help Net Security

OpenSSH “SSHole” password-authentication bypass on musl-based Linux (Alpine, OpenWrt) exploited within hours of disclosure

OpenSSH / Alpine Linux · November 5, 2026

CVE-2026-123158 affects OpenSSH before 10.6p2 on musl-based systems that verify passwords without PAM. musl’s crypt() returns * for passwords longer than 256 bytes, and * is also the stored value for accounts with no password, so a long password matches those accounts and permits login without knowing any credential. Alpine’s default openssh-server package is affected (fixed in 10.6_p2-r0 on edge, with backported fixes for 3.16–3.24; sshd must be restarted after upgrading); OpenWrt, Buildroot, Yocto, and Alpine-based container images should be checked. No CVSS score was given in the OpenSSH or Alpine advisories. Threat-intelligence firm Previdian reported the first exploitation attempt less than nine hours after CVE publication and confirmed root access on an Alpine honeypot; as of November 6 the flaw was not in CISA KEV.

“An attacker who can reach your SSH port can log in without knowing any password.” — Alpine Linux security advisory

Source: OpenSSH 10.6p2 release notes · Alpine Linux advisory · Help Net Security · The Hacker News

Claude Code “don’t ask again” approval file leaks 1,379 secrets across 1,122 public GitHub repos; Anthropic says it is prototyping fixes

Apiiro · November 5, 2026

Apiiro researchers found 104,185 copies of .claude/settings.local.json in public GitHub repositories; 1,122 of them contained at least one secret (1,379 distinct secrets across 63 organizations), including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens, and 23 AWS keys. When a user approves a shell command with “Yes, and don’t ask again,” Claude Code writes the full command, including any inline password or token, into that file; it is added to the user’s global git excludes rather than the project’s .gitignore, so the protection does not travel with the repo. Counting settings.json, older versions, and saved chat logs, the total rises to 2,539 secrets in 1,994 repositories. Coverage on November 7 reported no response from Anthropic; on November 9 Anthropic’s head of Claude Code, Boris Cherny, said the team will prototype secret scanning and auto-mode detection. Rotate any exposed credential first, then untrack and gitignore the file.

“Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this” — Boris Cherny, Anthropic, as quoted by iTnews

Source: Apiiro research · The Hacker News · iTnews

Crédit Mutuel Arkéa confirms ~€118M ($133M) in fraudulent transfers initiated through a service provider’s platform

Crédit Mutuel Arkéa · November 4, 2026

The French banking group disclosed on November 4 that it had been the victim of an attack allowing fraudulent transactions to be carried out from the bank’s own accounts to other banks, with funds then reportedly converted to stablecoins. Blockchain investigator ZachXBT traced roughly $106 million withdrawn from exchange accounts on November 1 and a further $27 million on November 3. Arkéa says attackers did not go through customer accounts but reached the bank directly via the platform of an unnamed service provider, that part of the funds has been blocked, and that it can only “validate the order of magnitude” of the €118 million figure. The bank disputes reporting that the entry point was its online subsidiary Fortuneo. Authorities and supervisors have been notified and some transactions were temporarily suspended.

“This incident has no consequences for their assets and has only caused a delay in the execution of certain transfers.” — Crédit Mutuel Arkéa statement to customers, as translated by Help Net Security

Source: Crédit Mutuel Arkéa statement (PDF) · Help Net Security · BleepingComputer

This brief covers the trailing ~48 hours (November 7–9, 2026).

Primary sources:

Leave a Reply