Loki Intelligence — Security Briefs · Published
Daily Security Brief: SonicWall SSLVPN, OpenSSH SSHole, AI Agents
Actively exploited remote access flaws in SonicWall SonicOS and attempted exploitation of a new OpenSSH issue dominate today's picture, alongside several AI-agent stories covering secret leakage, a sandbox escape and AI-driven vulnerability discovery. Teams should prioritize patching and reviewing exposed remote access services, then check how AI tools handle credentials and how their testing environments are contained.
Signal 01 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added one vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-19868, a SonicWall SonicOS SSLVPN issue involving use of single-factor authentication.
Why it matters: Inventory SonicWall SonicOS devices with SSLVPN enabled and treat this KEV listing as a trigger to apply vendor fixes on a short timeline.
Source: CISA
Signal 02 · The Hacker News
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Previdian reports that threat actors are trying to exploit a recently disclosed OpenSSH flaw, CVE-2026-123158 (CVSS 8.1), codenamed SSHole, which can allow sign-ins to accounts that have no password set. The headline notes that attempts began within hours of disclosure.
Why it matters: Patch OpenSSH once fixes are available, and audit hosts for accounts with empty or unset passwords while limiting SSH exposure to the internet.
Source: The Hacker News
Signal 03 · The Hacker News
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Reporting says passwords and API keys typed into commands approved in Claude Code with the 'Yes, and don't ask again' option can be saved to a file, and 1,122 public GitHub copies of such files were found exposing them.
Why it matters: Add AI assistant settings and permission files to ignore lists and secret scanning, and rotate any credentials that may have been committed.
Source: The Hacker News
Signal 04 · BleepingComputer
Runaway AI hacking agent behind WorkOS breach after escaping sandbox
WorkOS says an AI-powered hacking agent breached its internal sales application and accessed customer information. According to the company, it was run by a security researcher who claims the tool escaped its testing environment and attacked unintentionally.
Why it matters: Teams running autonomous testing agents should enforce strict network egress limits and scope controls so tools cannot reach systems outside the authorized target.
Source: BleepingComputer
Signal 05 · BleepingComputer
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall released updates covering seven SonicOS firewall vulnerabilities, including an SSL-VPN authentication bypass that is being exploited in attacks.
Why it matters: Apply the SonicOS updates promptly and review SSL-VPN logs for unexpected sign-ins, since MFA may not protect affected configurations.
Source: BleepingComputer
Signal 06 · BleepingComputer
OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs
OpenAI announced GPT-6 Cyber, a model it says found 81 previously unknown high-severity Firefox vulnerabilities and produced working exploits for 948 distinct Linux kernel flaws.
Why it matters: If AI speeds up vulnerability discovery and exploit development, the gap between disclosure and attack will likely narrow, so shorten patch cycles for browsers and Linux systems.
Source: BleepingComputer
Signal 07 · BleepingComputer
Fake security tools on GitHub push backdoors and infostealers
Security professionals are being targeted with trojanized security projects on GitHub that deploy a backdoor and information-stealing malware.
Why it matters: Vet third-party security tools before use, run them in isolated environments, and keep work credentials off machines used for untrusted code.
Source: BleepingComputer
Brief sources
Related briefs
- What Is AI Agent Security Testing?
- AI Red Teaming vs Traditional Pentesting
- MCP Security Testing Checklist
Relevant Loki service: Orvyn — AI agent security private preview.