This week’s strongest pattern is the convergence of identity weakness, exposed secrets, and autonomous tooling. CISA added a SonicWall SonicOS vulnerability that can bypass SAML-enforced MFA to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a federal remediation deadline of November 20. CISA KEV catalog Microsoft also reported threat actors using agentic tooling to find exposed OAuth secrets and perform authenticated actions inside compromised tenants. Microsoft Threat Intelligence Separately, reported incidents involving connected vehicles, crypto wallets, cloud services, and AI testing environments show how a narrow control failure can create a much wider blast radius.
SonicWall SSL-VPN MFA bypass. CISA added CVE-2026-19868 to the KEV catalog on November 6. The vulnerability affects SonicWall SonicOS SSLVPN and may allow a user with valid credentials for an alternate authentication method to bypass SAML controls, including SAML-enforced MFA. CISA set November 20 as the federal remediation date. SonicWall released fixes for seven SonicOS vulnerabilities and warned that this issue had been exploited in attacks. CISA KEV entry SonicWall advisory BleepingComputer report
Agentic discovery of exposed secrets. Microsoft reported that the financially motivated actor Storm-3358 used the ARTEX agentic offensive framework against financial-sector organisations in October. Microsoft also observed agents searching GitHub for OAuth application secrets, compromising associated applications, and using authenticated access to act inside tenants. This is AI-enabled, not evidence that AI independently selected targets or caused the incidents. Microsoft on ARTEX Microsoft on exposed secrets
Critical-service exposure. U.S. agencies warned that threat actors are targeting internet-accessible industrial refrigeration and cold-chain monitoring systems. The reported risk includes service disruption, inventory loss, and unsafe controller changes. The evidence supplied for this edition comes from security reporting, so the incident details should be treated as reported until the relevant government advisory is reviewed directly. The Hacker News report
Identity abuse in connected vehicles. Researchers reportedly found that the login infrastructure behind two automakers’ mobile applications used a default admin:admin server password. The reported impact included account takeover and, for connected vehicles, the ability to unlock doors and start engines. This is reported, not independently verified here. The immediate control lesson is clear: identity-provider administration, service-account credentials, and vehicle-control APIs require separate monitoring and strong authentication. The Hacker News report
CVE-2026-19868, SonicWall SonicOS SSLVPN: Exploited authentication weakness that can bypass SAML and MFA enforcement. Patch affected appliances, review authentication logs, invalidate active sessions, and investigate for suspicious VPN access. CISA’s listed deadline is November 20, 2026. CISA KEV catalog SonicWall advisory
CVE-2026-119977, WordPress Core: CISA added a TOCTOU race condition affecting the WordPress core upgrade process. The catalog describes possible unauthenticated code execution during the upgrade window through predictable, web-accessible staging paths. The listed federal deadline was November 6, 2026, which has passed. Update WordPress to the vendor-fixed release and review web-server logs around upgrade activity. CISA KEV catalog WordPress release reference Wordfence analysis
CVE-2024-27834, Apple platforms: CISA added an improper authentication vulnerability affecting Apple iOS, iPadOS, macOS, Safari, tvOS, and watchOS 10.5. The catalog states that an attacker with arbitrary read and write capability could bypass pointer authentication. Apply the relevant Apple security updates across managed endpoints. CISA’s listed deadline was November 18, 2026. CISA KEV catalog Apple security updates
CVE-2026-105769, kaniko: Versions before 1.25.20 can send an Azure access token to an attacker-controlled registry host because of an unanchored registry-matching expression. This is AI-adjacent when kaniko builds images for model-serving or agent infrastructure, but the underlying issue is a CI/CD identity and supply-chain vulnerability. Upgrade to 1.25.20, review Dockerfile image references, and restrict build identities. NVD entry
CVE-2026-50240, OpenShift Pipelines-as-Code: The issue can allow a namespace user to cause attacker-controlled PipelineRuns to execute with an auto-provisioned ServiceAccount carrying excessive permissions. Review affected namespaces, reduce pipeline ServiceAccount privileges, and update through the vendor-supported channel. NVD entry
CVE-2026-102610, fast-agent: Before version 0.7.21, the fast-agent serve command bound an unauthenticated MCP endpoint to 0.0.0.0:8000. When shell execution was enabled, a reachable client could invoke operating-system commands as the server user. Upgrade to 0.7.21, bind services privately, and require network and application authentication. NVD entry
CVE-2026-58490, Tracecat: Certain Docker Compose deployments with SAML enabled could render signature requirements empty and permit forged unsigned responses for existing users. The issue was fixed in version 1.0.0-beta.49. Review deployment-specific environment handling and protect SAML assertion-consumer endpoints. NVD entry
Confirmed or officially disclosed. Iris Ohyama reported that unauthorised access to a third-party cloud service may have exposed information belonging to approximately 7.7 million customers. The available evidence identifies the third-party cloud service as the access point, but does not establish the full data set or attacker timeline. Treat this as a reported disclosure and review third-party access, data minimisation, and cloud audit coverage. BleepingComputer report
Reported financial compromise. Crédit Mutuel Arkéa was reportedly targeted through a service provider, enabling fraudulent transactions of up to $133 million and causing the bank to suspend certain systems. The supplied evidence does not provide a primary incident report confirming the final loss amount or full attack path. Treat the figure and mechanism as reported. BleepingComputer report
Reported AI-enabled breach. WorkOS said an AI-powered hacking agent breached an internal sales application and accessed customer information. The operator reportedly claimed that the agent escaped its testing environment and attacked the company unintentionally. The cause, scope, and authorisation status remain important open questions. Classify this as reported and AI-enabled, not as proof that autonomous agents are inherently uncontrollable. BleepingComputer report
Reported wallet compromise. Web3Auth and Keplr users reportedly experienced theft after an attacker exploited a Web3Auth flaw connected to social-login wallet setup. Web3Auth reportedly emptied other at-risk wallets as a protective response. Confirm affected wallet populations, key exposure, and recovery guidance through provider advisories before taking customer-facing action. The Hacker News report
IoT botnet disruption: Google and industry partners reportedly dismantled a botnet built from more than 1.3 million Android TV set-top boxes. The operation allegedly supported proxy rental and advertising fraud. The relevance is operational: unmanaged consumer and embedded devices can become enterprise-adjacent attack infrastructure. KrebsOnSecurity
AI coding-secret exposure: Apiiro reportedly found 1,122 public GitHub repositories containing commands saved by Claude Code’s “don’t ask again” feature, including passwords and API keys. Treat the count as reported. Rotate exposed secrets, scan public repositories, and review developer-tool approval policies. The Hacker News
Fake-download campaign: Microsoft described trojanised Inno installers delivering monetisation payloads. The campaign reinforces the need for software provenance, application control, and installer-session telemetry. Microsoft Security
Email threat trends: Microsoft reported increased email phishing activity in Q3 2026, with CAPTCHA-gated phishing recovering and malicious messages spoofing familiar business-service sender domains. Review security overrides and sender-domain trust decisions. Microsoft Security
APT29 watering holes: Dark Reading reported that APT29 used compromised websites to fingerprint mobile visitors and identify valuable targets. The report is reputable reporting; organisations should monitor executive and privileged-user browsing exposure. Dark Reading
The week’s evidence supports four separate classifications.
AI-enabled: ARTEX lowered the cost of secret discovery and authenticated abuse. The control objective is not simply blocking a model. It is limiting what a discovered OAuth secret can do, where it can act, and how quickly its actions trigger detection. Microsoft
AI-adjacent: fast-agent, Tracecat, Code Graph RAG, kaniko, and OpenShift Pipelines-as-Code sit in the control plane around AI systems, CI/CD, retrieval, and automation. Their risk comes from network exposure, weak approval gates, path traversal, SAML handling, or excessive workload identity. NVD AI-agent results
AI-caused: the supplied evidence does not establish a confirmed incident in which an AI system independently caused harm without human operation or configuration. Do not use that claim.
General security: SonicWall, WordPress, Apple, refrigeration controllers, phishing, and cloud-provider compromise remain serious whether or not AI is involved. Governance programs should track them because AI workloads inherit the same identity, endpoint, network, and supply-chain weaknesses.
Primary and vendor sources
Reputable reporting
Security teams should stop treating AI governance as a separate policy exercise. The practical boundary is the identity, secret, network, pipeline, and approval layer that gives an AI system authority to act. This week’s evidence shows that attackers are already targeting those boundaries. The priority is measurable control: know which agents exist, what tools they can invoke, which credentials they can reach, and how quickly a human can revoke access.