SANS Stormcast Monday, November 9th, 2026: sshole Scans (CVE-2026-123158); SonicWall SonicOS MFA Bypass (CVE-2026-19868); Entra Device Registration (CVE-2026-109469); Claude Code Secrets Leak

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10170.mp3

previous

sshole Scans (CVE-2026-123158); SonicWall SonicOS MFA Bypass (CVE-2026-19868); Entra Device Registration (CVE-2026-109469); Claude Code Secrets Leak

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Monday, November 9, 2026
 edition of the SANS Inline Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Washington, D.C. And this episode is brought to you by
 the SANS.edu Graduate Certificate Program in Cloud
 Security. Today I spent a little bit time looking at our
 honeypot data to see if we are detecting any evidence of the
 sshole vulnerability being exploited. And yes, indeed, it
 is being exploited. Now, this investigation had a couple of
 hiccups. First of all, in order to exploit sshole, you
 must use a password that's larger than 256 characters.
 Well, we only record passwords up to 256 characters because,
 well, that's usually for brute forcing and so all that
 matters. On the other hand, there are sometimes passwords
 that are longer than 256 characters that are being
 recorded by our honeypots that are not related to sshole.
 What usually happens here is that simple scripts that are
 doing brute forcing are actually not checking if the
 login succeeded or not. So what they're doing then is
 they end up entering whatever bash command they would like
 to execute in the password field of the login. Sometimes
 also the username, that's where we also see them often
 showing up. But here, of course, the password field was
 what matters. And if you're looking at the data that I
 published as part of the diary, we saw a number of long
 passwords like this on November 1st. So what I'm
 calling here is the actual sort of exploitation of
 passwords that I would associate with sshole started
 on November 5th in our honeypots. Now, what I'm
 calling here an sshole password is one that basically
 is just letters, no recognizable bash commands or
 anything like this, and fills the entire 255 bytes that we
 are recording. The only ones that I've seen so far being
 used is either all uppercase letter A or all lowercase
 letter A. Of course, the actual content of the password
 shouldn't really matter when it comes to exploiting this
 vulnerability. I hope to follow this up maybe later
 this week with a look at what commands are being executed by
 these attacks after they're logged in. These attacks
 should actually work as far as our honeypot is concerned.
 They should sort of randomly allow some of these login
 attempts to log in. And on Friday, SonicWall released
 patches for seven vulnerabilities in SonicOS.
 This is significant because one of these vulnerabilities
 is already being exploited. The already exploited
 vulnerability does allow attackers to bypass multi
 -factor authentication for SSL VPN logins. Apparently, the
 problem here is if you have multiple authentication
 methods defined, and one of these authentication methods
 does not require multi-factor authentication, then an
 attacker essentially can use that to bypass the multi
 -factor authentication requirements that you may have
 set up for SSL VPN access. So this should be patched now.
 And again, it's already being exploited, which should tell
 you to please expedite release rolling out this particular
 update. In particular, of course, with SSL VPNs, we
 often had issues where people didn't use multi-factor
 authentication because, well, we all know passwords don't
 work. And Microsoft this weekend patched an
 authorization bypass vulnerability in Entra. This
 vulnerability would allow a user to essentially gain
 elevated privileges. The attacker in this case doesn't
 even have to be authorized. Now nothing you have to do.
 Microsoft already took care of it for you since this is an
 Entra vulnerability. So it really only affected
 Microsoft's cloud services and they released the advisory as
 they state to be more transparent about these
 vulnerabilities. They also say there was no exploitation
 happening at the time when they patched this
 vulnerability. Now they say exploitation is less likely,
 so more complex vulnerability. And hopefully now after the
 patch supplied, exploitation should be impossible. And a
 agentic coding security company, Apiiro, found that
 Anthropic's Claude Code under certain circumstances will add
 secrets to a hidden file in GitHub. The way this works is
 if you're requesting Claude Code to connect to an API or
 such, it may need credentials. And there is an option when
 you provide credentials to Claude Code where it basically
 asks, well, do you want me to ask you again about these
 credentials, about accessing this API? If you say no, then
 of course it has to remember those credentials somewhere.
 And the way it does so is by saving them to a .claude folder
 and inside there a file settings.local.json. We've
 actually seen in our web honeypots this weekend an
 increase in actually for the first time requests for this
 .claude directory. So attackers are definitely looking for it
 and Apiiro as part of their blog states that they found
 sort of around 1500 or so of these credential files on
 GitHub. There's still work in progress into how to exactly
 fix this. Essentially what they're proposing is to check
 automatically for secrets before anything is being sent
 to GitHub. But of course that may still keep those
 credentials in any other Git repositories. So not quite
 clear how this will be fixed. Definitely be aware of this
 and check with Anthropic and as a Claude Code user with any
 updates that you may be receiving that will fix this
 problem for you. Well, and that's it for today. Thanks
 for listening. Thanks for liking. Thanks for
 recommending and subscribing to this podcast. And talk to
 you again tomorrow. Bye.