SonicWall KEV Alert, Cold-Chain Warning, and OpenSSH Flaw Under Attack

On 2026-11-08, security leaders should prioritize CISA's addition of the actively exploited SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to its KEV catalog and the joint advisory from CISA, FBI, HHS, USDA and DOT warning that attackers are targeting industrial refrigeration and cold chain monitoring systems. A newly disclosed OpenSSH authentication bypass already under attack, a breach at Norway's aid agency, a fresh SEC filing from Astrana Health, and two new CISO appointments round out a busy stretch of incident and leadership news.

CISA Adds Actively Exploited SonicWall SSLVPN Flaw to KEV Catalog

CISA added CVE-2026-19868, a SonicWall SonicOS SSLVPN vulnerability, to its Known Exploited Vulnerabilities catalog on November 6 after confirming active exploitation. The flaw lets an attacker who holds valid credentials for an alternate authentication method bypass SAML authentication controls, and successful exploitation may also bypass SAML-enforced multi-factor authentication. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV Catalog vulnerabilities that grant total control of an asset post-exploitation, and CISA is urging all organizations to apply the same risk-based approach to this SonicWall flaw. (CISA)

Five US Agencies Warn of Attacks on Cold Chain Refrigeration Systems

CISA, the FBI, HHS, USDA and the Department of Transportation jointly warned that malicious actors are targeting electronic temperature controllers and commercial refrigeration controllers used in retail grocery and cold storage facilities worldwide. Attackers may exploit authentication bypass, arbitrary code injection or weak configurations to force units into continuous heating and defrost cycles, risking inventory loss, equipment damage and fire hazards. The agencies urge owners to remove controllers from the internet, isolate operational technology networks, enforce strong authentication and keep firmware patched, warning that healthcare, food, chemical and transportation sectors depend on these systems. (CISA)

OpenSSH Passwordless Login Flaw Exploited Within Hours of Disclosure

A newly patched OpenSSH flaw, CVE-2026-123158 and nicknamed sshole, lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems without any valid password. Threat intelligence firm Previdian reported exploitation attempts beginning less than nine hours after the CVE's publication, with confirmed root access achieved on a honeypot running real Alpine Linux and OpenSSH. The bug affects systems using the musl C library without PAM-based password checks, including some default Alpine cloud images; OpenSSH 10.6p2, released November 5, contains the fix, and administrators are urged to patch immediately. (Help Net Security)

Norwegian Aid Agency Discloses Breach Affecting All 20,614 Grants Portal Users

Norway's development aid agency Norad disclosed that attackers may have accessed the names and email addresses of all 20,614 registered users of its Grants Portal, which collects funding applications from 12,511 organizations worldwide. The intrusion, discovered October 30, involved 27 compromised user accounts, and attackers also stole application documents from three organizations outside Norway. Norad closed the portal, reported the incident to police, the Data Protection Authority and the National Security Authority, and brought in external cybersecurity experts while warning it cannot rule out exposure of applicants in conflict zones. (Help Net Security)

Astrana Health Discloses Social-Engineering Data Breach in Q3 SEC Filing

Astrana Health's third-quarter 10-Q filed with the SEC disclosed that the company identified social engineering attempts during the quarter that led to unauthorized access and acquisition of certain private or confidential information on its servers. The investigation into the scope of the access and required notifications remains ongoing, and the company reported multiple putative class action lawsuits tied to the incident, though it says the cases are too early to estimate any loss. Astrana reported Q3 net income of $13.0 million on revenue of $1,023.6 million. (StockTitan (SEC EDGAR filing))

Checkmarx Names Kobi Sivilya as CISO and CIO

Checkmarx named Kobi Sivilya as Chief Information Security Officer and Chief Information Officer, giving him oversight of the company's corporate security, IT and business applications as it scales agentic application security products. Sivilya previously served as CISO and VP of IT at Outbrain and as VP of Security Engineering at Fireblocks, where he worked on security for a blockchain platform used by major financial institutions. CEO Sandeep Johri said Sivilya's experience will help keep Checkmarx secure as AI changes how software is built and attacked. (GlobeNewswire via Yahoo Finance)