My Next Class

ISC honeypots seeing sshole (CVE-2026-123158) exploitation attempts; SonicWall patches seven SonicOS flaws including an already-exploited SSL VPN MFA bypass; Microsoft cloud-fixed an Entra Device Registration elevation-of-privilege bug; Apiiro found Claude Code saving secrets into .claude/settings.local.json on GitHub.

Scans for sshole Vulnerability (CVE-2026-123158)
ISC honeypots are seeing long letter-A passwords that look like sshole exploitation, with clear attempts starting November 5th after earlier long passwords that were mostly buggy brute-force scripts dumping shell commands into the password field. Honeypots only keep the first 255 characters of each password, which limits what can be measured.
https://isc.sans.edu/diary/Scans+for+Sshole+Vulnerability+CVE2026123158/33498

SonicWall SonicOS Multiple Vulnerabilities (SNWLID-2026-0014)
On Friday SonicWall released patches for seven SonicOS vulnerabilities; one already-exploited flaw lets attackers bypass multi-factor authentication for SSL VPN logins when an alternate authentication method without MFA is also defined. Patch promptly—press and CISA associate the exploited issue with CVE-2026-19868.
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/

Entra Device Registration Elevation of Privilege (CVE-2026-109469)
Microsoft patched an authorization bypass in Entra Device Registration over the weekend that could let an unauthorized attacker elevate privileges. No customer action is required: it is a Microsoft-hosted cloud service, and Microsoft says there was no exploitation at the time of the fix and rates future exploitation less likely.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109469

Claude Code Leaking Secrets on GitHub
Apiiro reports that Anthropic's Claude Code can store credentials in .claude/settings.local.json when you tell it not to ask again about an API or command, and that on the order of a thousand-plus of those credential files have shown up on GitHub. ISC web honeypots also saw new requests for the .claude directory this weekend; rotate exposed secrets and watch for Anthropic updates.
https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html

SANS Difference Makers Vote
https://www.sans.org/go/difference-makers-awards-2026

My Upcoming Classes
https://www.sans.org/profiles/dr-johannes-ullrich

Login here to join the discussion.