Security Advisory

This Week's Top 4: A SonicWall VPN Bypass Under Active Attack, a WordPress Deadline Already Past, and a Nine-Hour OpenSSH Exploit

Published November 8, 2026 · Cyber One Solutions

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog this week, and a fourth, a fast-moving OpenSSH flaw that has not reached the KEV catalog yet, earns inclusion on the strength of how quickly it was weaponized: a SonicWall SSL VPN flaw that bypasses SAML authentication with no workaround available, a WordPress Core upgrade-process flaw whose federal deadline already passed, a password bypass that hit Alpine Linux servers within nine hours of disclosure, and a two-year-old Apple WebKit flaw newly confirmed under active exploitation. Here are the four verified developments for small and mid-size businesses this week, ranked by relevance, exploitation evidence, and urgency.

This brief covers verified security and compliance developments from Sunday, November 1 through Saturday, November 7, 2026, with a research cutoff of Sunday, November 8, 2026 at 5:00 a.m. Central. It is the edition for the regular Sunday, November 8 slot. CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog this week, and a fourth development, a fast-moving OpenSSH flaw that has not reached the KEV catalog yet, earns inclusion on the strength of how quickly it was weaponized and how common the affected server configuration is.

Executive Summary and Priorities

Four verified developments met our bar for inclusion this week:

A SAML authentication bypass in SonicWall's SonicOS SSL VPN service, CVE-2026-19868, that SonicWall itself confirmed is being exploited, with no workaround available.
A time-of-check to time-of-use race condition in WordPress Core's own upgrade process, CVE-2026-119977, that CISA says is being actively exploited and that already carried a federal remediation deadline earlier this week.
A password-authentication bypass in OpenSSH's sshd, nicknamed "sshhole," that attackers began exploiting within roughly nine hours of public disclosure on servers built with musl libc, the C library behind Alpine Linux and many of the container images built on it.
A two-year-old Apple WebKit flaw, CVE-2024-27834, that CISA added to its KEV catalog this week, meaning the agency now has evidence of real exploitation against devices that never received the 2024 fix.

How We Ranked This Week's Developments

We ranked these four by how directly the affected technology sits in a commercial business's infrastructure, the strength and source of the exploitation evidence, whether a federal remediation deadline falls inside or near this window, and whether patching is the only real fix or an interim mitigation exists. SonicWall ranks first because a VPN gateway is the front door for remote access at many of the businesses we serve, the bypass works against a layered authentication setup specifically meant to be harder to beat, and SonicWall says no workaround exists. WordPress ranks second: the exploitation is confirmed and the federal deadline for this one has already passed, but the affected window is a short, predictable moment during an upgrade rather than a standing door left open. OpenSSH ranks third on the speed and reliability of the exploitation, tempered by a real scoping limit on who is affected, covered in detail below. Apple ranks fourth because exploiting it requires an attacker to already have a foothold through some other bug, so it functions as one link in a larger chain rather than an opening move; most of the businesses we serve keep their Apple devices on supported, automatically updated operating systems, which closes this gap on its own. These rankings are editorial judgments, not a measured risk score.

1. A SAML Authentication Bypass in SonicWall's SonicOS SSL VPN, Actively Exploited With No Workaround

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a remediation due date of November 20. CISA's own catalog entry describes the flaw plainly: it "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls" in SonicOS's SSL VPN service. In practice, that means an attacker who already holds a valid username and password for some other login method on the firewall can use that foothold to get past SAML-based sign-in, including setups where SAML is the path a business uses to enforce multi-factor authentication on VPN logins. SonicWall published its own advisory, SNWLID-2026-0014, confirming it had investigated a report of exploitation; third-party trackers citing that advisory describe the affected range as SonicOS 7.3.3-7015 and earlier on Gen 7 firewalls and 8.2.2-8015 and earlier on Gen 8 firewalls, with fixes in 7.3.4-7013 and 8.2.3-8015. SonicWall's own advisory page did not render for us directly to quote verbatim, so we are relying on CISA's catalog entry as the primary confirmation of the flaw and its exploitation, and we recommend verifying the exact firmware version against SonicWall's own MySonicWall advisory listing (SNWLID-2026-0014) before treating any specific version number as final.

Who is affected: any business running a SonicWall Gen 7 or Gen 8 firewall with SSL VPN enabled and SAML configured as an authentication method, on firmware at or below the ranges above. A device already upgraded past the fixed versions, or one that does not use SAML for VPN authentication at all, is not exposed to this specific bypass.

If your business's remote access runs through a SonicWall firewall, this week's action is to confirm with whoever manages it, in-house staff or a managed provider, what firmware version it is running and whether SAML is configured for SSL VPN logins, then apply SonicWall's update. There is no configuration workaround here: the fix is the update itself.

2. CISA Confirms Active Exploitation of a WordPress Core Upgrade-Process Flaw, Deadline Already Past

CISA added CVE-2026-119977 to its KEV catalog on November 3, 2026, with a remediation due date of November 6, already behind us as this brief publishes. CISA's catalog entry says the flaw "could allow unauthenticated attackers to execute code on the server during the upgrade window." The underlying issue is a time-of-check to time-of-use race condition in how WordPress Core performs a full-package upgrade: during that process, the software briefly stages installation files in a predictable, web-accessible location, and an attacker who wins a narrow timing race during that window can get code running on the server. WordPress's own release announcement, dated October 28, 2026, describes the fix as "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window," credited to researcher Umut Bayram, and shipped it in WordPress 7.1.4, with backports to older branches, including 7.0.8, 6.9.11, and 6.8.12, still rolling out as they become ready. WordPress's own advisory rates the issue Low; the CVE Numbering Authority that assigned it rates it 8.1 (High). We are noting that disagreement rather than resolving it, since CISA's KEV addition is itself evidence that real-world exploitation outweighs WordPress's own severity rating in practice.

Who is affected: self-hosted WordPress sites on version 7.1.3 or earlier (or the equivalent point on an older branch) that perform a full-package Core upgrade while an attacker is actively targeting the exposed staging window. Sites already on 7.1.4, or on a hosting platform that applies Core updates on the provider's own schedule rather than the site owner's, are past this specific exposure once that update lands.

If your business runs its own WordPress site rather than a fully managed WordPress host, confirm this week that it is on 7.1.4 (or the current patched release for its branch) rather than assuming an automatic background update already caught it, since the flaw lives inside that very update process.

3. A Fast-Moving OpenSSH Password-Authentication Bypass Hits Alpine Linux and Container Images Within Hours

OpenSSH shipped version 10.6p2 on November 5, 2026, fixing CVE-2026-123158, a password-authentication bypass the CVE record rates 8.1 (High) under CWE-394. The flaw sits in how sshd handles password checking on Linux systems built with musl libc when PAM support is disabled, a combination Alpine Linux uses by default; for some account configurations, any password between 256 and 1,024 characters long is incorrectly accepted as valid, letting an attacker log in without knowing the real password. OpenSSH's own release notes credit the discovery to Özgün Kültekin of Wakefield, and Alpine Linux published its own advisory the same day confirming the issue and pointing users to the fix. Reporting on the flaw, which quickly picked up the nickname "sshhole," describes exploitation beginning within roughly nine hours of public disclosure, including a demonstrated full root compromise of a honeypot running an unmodified, up-to-date Alpine Linux install.

Who is affected: servers and container images running sshd built against musl libc with PAM disabled, which in practice means Alpine Linux hosts and the large number of Docker and Kubernetes container images built on the official Alpine base image, when SSH is exposed inside that container or host. It does not affect the mainstream server operating systems most businesses run day to day, including Ubuntu, Debian, Red Hat Enterprise Linux, Rocky Linux, or Windows Server, all of which use glibc and PAM by default.

If your business, developer, or managed provider runs Linux servers or containers, this week's question is specifically whether any of them are Alpine-based with SSH reachable, not whether "the servers" in general are patched; if so, update to OpenSSH 10.6p2 or the Alpine-provided equivalent now, since exploitation here has already proven to be fast. Alpine's own advisory is explicit that installing the updated package is not enough on its own: it does not restart the already-running sshd process, so the daemon stays vulnerable until it is restarted by hand (rc-service sshd restart on Alpine), or the container or host is otherwise recycled onto the patched build.

Also Added to the KEV Catalog This Week

CISA also added CVE-2024-27834, a WebKit flaw in Apple's Pointer Authentication protection, to its catalog on November 4, 2026, with a due date of November 18. Apple fixed the underlying issue more than two years ago, in Safari 17.5, iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5, all released in mid-2024. What is new this week is CISA's own KEV addition, which means the agency has evidence the flaw is being exploited now, almost certainly against devices that never received those 2024 updates rather than against current ones. Exploiting it requires an attacker who already has arbitrary memory read and write access through some other vulnerability, so it works as one link in a larger chain rather than a way in on its own. We are not ranking it among this week's top priorities because the fix has been broadly available for years and the chain requires a separate initial foothold, but it is a useful reminder on its own: a vulnerability being "old" and "already fixed" only protects a business if the specific device in question actually received that fix. Any business with Apple devices still running an operating system from before mid-2024, whether a forgotten office iPad or a personal phone used for work email, should confirm it is current.

Do Now

If your business's remote access runs through a SonicWall firewall, confirm its firmware version and whether SAML is configured for SSL VPN logins, then apply SonicWall's update; there is no workaround.
If your business runs a self-hosted WordPress site, confirm it is on version 7.1.4 (or the current patched release for its branch) rather than assuming an automatic update already caught it.
If your business, developer, or IT provider runs Alpine Linux servers or Alpine-based containers with SSH exposed, update to OpenSSH 10.6p2 or the Alpine-provided equivalent now, then restart sshd (rc-service sshd restart), since the package update alone does not replace the already-running daemon.

Plan Next

Ask whoever manages your firewall how they track vendor advisories tagged "no workaround," so an update like SonicWall's does not wait for a routine monthly patch cycle.
Confirm with your web developer or host whether any custom WordPress plugins or themes also need updates alongside Core, since a patched Core alone does not cover third-party code.
Check whether any company-owned or BYOD Apple device in daily use is still running an operating system version from before mid-2024.

Watch List

Whether CISA or SonicWall report confirmed intrusions tied to CVE-2026-19868 beyond the bypass itself.
Whether CVE-2026-123158 exploitation spreads beyond Alpine-based systems to other musl libc distributions.
Whether further detail emerges on how CVE-2024-27834 is being used in current attacks, and against which device population.

The Bottom Line

Three of this week's four priorities trace back to CISA's KEV catalog, and the fourth, OpenSSH's "sshhole" flaw, shows why that catalog is a floor rather than a ceiling: real-world exploitation can move faster than any single list can track. This brief is general security awareness, not a HIPAA, FTC Safeguards, or cyber-insurance compliance service. Cyber One Solutions keeps firewalls, VPN gateways, and Linux servers patched and monitored through managed cybersecurity, and builds and maintains business websites, including WordPress sites, through our website development and support services. If you are not sure where your business stands on any of this week's four items, our free cybersecurity risk score self-assessment is a quick way to find out.