Daily Tech Insights — Tuesday, November 10, 2026

Daily Tech Insights — Nov 10: SonicWall MFA bypass patched while SAP webshells hunt continues; verify breach claims before acting.
Full credits and links in the show notes.

Daily Tech Insights — Tuesday, November 10, 2026

This episode investigates four critical security developments affecting SMB IT teams: a new SonicWall MFA bypass vulnerability added to Seesa's Known Exploited Vulnerabilities catalog, active hunting for SAP NetWeaver webshells via unauthenticated file uploads, and a clarification on recent breach reports involving Who Gives A Crap that highlight the difference between verified incidents and unverified rumors. The host provides actionable steps for patching firmware, monitoring logs for evasion techniques, and focusing on confirmed CVEs rather than speculative headlines.

In this episode

• Seesa has added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, allowing attackers to bypass MFA on SonicOS SSL-VPN services using alternate authentication methods.
• The vulnerability impacts specific firmware versions on Gen7 and Gen8 physical and virtual firewall appliances running Seesa OS 7.3.3 through 7.015 or older, as well as 8.2.2 through 8.015 or older.
• Attackers are actively searching for SAP NetWeaver webshells using CVE-2025-31324, a flaw with a perfect CVSS score that enables unauthenticated file uploads to create persistent backdoors.
• A single malicious IP address has been observed probing various SAP and third-party application paths, often using misspellings or URL variations to evade detection.
• Recent headlines suggesting multiple countries were hit by Who Gives A Crap involve confusion between general vulnerability advisories like CVE-2026-102255 and specific, unverified incidents.
• IT teams are advised to prioritize applying the latest SonicOS firmware updates, monitoring logs for unusual sign-ins, and focusing on verified technical details rather than panicking over unconfirmed breach reports.

News stories

• [Who Gives A Crap Data Breach: 3 Countries Hit [2026]](https://news.google.com/rss/articles/CBMimgFBVV95cUxPVzVCZXdhdGhmS3h6VWNTLTROTkF3Y1ZDZERFVEpwYUFRWWI1dER2ZmJBRWpidHUzZmNCUmpUZl96dHhNckE4ak4tcm1Fdkd6RmpTTzRYYnU2emlnWkNCa3hvRnpaSjQtSWFrMnFWZ0NwRC0wYzVWNDVNSno2Q1RyV19ZN18xOGVpYTVHc2RabkMzYTVsOVN1VHpn?oc=5) — https://tech-insider.org/
• Amazon Hacked Account: What to Do Right Now — 2-Spyware
• Indonesia faces 350,600 cyber threats as banks and government systems emerge as major targets — Indonesia Business Post
• Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th) — SANS Internet Storm Center
• CISA adds SonicWall SonicOS MFA bypass flaw to exploited vulnerabilities catalog — news.lavx.hu
• Vertech balances protection and access in its ICS networks — www.controlglobal.com

Sources

• Attackers Searching for SAP Netweaver Webshells - SANS ISC — SANS Internet Storm Center
• Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868) - Help Net Security — Help Net Security
• Hackers bypass SonicWall VPN MFA due to incomplete patching — BleepingComputer

Music credits

• Music: "Werq" by Kevin MacLeod (incompetech.com) (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/)

---

Voices in this episode were generated with AI text-to-speech from the hosts' script.
Research and drafting for this episode were assisted by AI tools. All content was reviewed and fact-checked by the host.
Views expressed are my own and do not represent my employer.