Today’s vibe: “trust me, it’s behind MFA” is aging badly. The perimeter is still the perimeter, and attackers keep finding the one alternate login path your diagrams forgot.

Today's Top 5

1. Pekin Insurance named by ransomware: The insurer just got listed by MetaEncryptor, and this is the part where partners discover how many workflows depend on one carrier portal. Source
2. Hoag files breach notice: The hospital system filed a California notice tied to an Oct 8 incident, and the letter is light on details but heavy on what could be in shared network files. Source
3. SonicWall SSL-VPN MFA bypass exploited: A SonicOS SSL-VPN flaw lets attackers sidestep SAML-enforced MFA under certain conditions, and exploitation is already being reported. Source
4. “SMS of Death” Android PoC: A crafted text can crash or disrupt unpatched Android devices, and a public PoC shifts this from theoretical to operational nuisance fast. Source
5. AI agents meet bank liability: One bank’s warning is blunt: if your AI helper mishandles credentials, the bank may treat it as a “you problem”, which will reshape how teams deploy agent tooling. Source

Why today matters: Two tracks are converging: perimeter auth bypasses (SonicWall) and high-velocity extortion naming (insurance, ad-tech, “Company #147”). That combo pressures defenders into rushed responses, which is exactly when credential reuse, alternate auth paths, and “temporary” VPN exposure turn into permanent incidents.

XERJ Corpus Hub: Working the SonicWall CVE-2026-19868 fire drill? An AI agent loading nuclei-templates could quickly draft and adapt a targeted SSL-VPN exposure check for your exact SonicOS versions, then hand your team a runnable validation plan in minutes. Browse more at hub.xerj.org.

Okay, now the receipts, the patches, and the uncomfortable questions.

Data Breaches

1. Hoag Memorial Hospital Presbyterian files California breach notice: Hoag disclosed a data security incident with an incident date listed as October 8, 2026, and filed the notice on November 4, 2026. The public letter focuses on potentially affected information in network files and offers credit monitoring. Source: California Attorney General
2. Pekin Insurance listed by MetaEncryptor: Leak-site monitoring sources show Pekin Insurance posted as a victim on November 7, 2026. Treat this as an extortion claim until the company confirms, but assume third-party risk conversations are about to get loud. Source: ATLAS/BrandeDefense
3. Chartboost extortion claim (N0n): Threat intel indexes track Chartboost LLC as listed by the N0n group on November 6, 2026. If you use mobile ad-tech SDKs, this is a reminder that “just marketing data” still includes identifiers attackers love. Source: SecureResearch
4. Infutor Data Solutions extortion claim (N0n): Monitoring reports show Infutor Data Solutions listed by N0n on November 7, 2026. Claims are unverified, but if you buy identity resolution or enrichment data, watch for downstream notification risk. Source: Apexward Pulse

Security Research

1. SonicWall patches exploited SSL-VPN SAML MFA bypass: SonicWall shipped fixes across a SonicOS bundle, and one issue stands out because it enables bypass of SAML controls in SSL-VPN under certain credential conditions. If you cannot patch immediately, reduce exposure of SSL-VPN and review alternate auth methods. Source: BleepingComputer
2. CISA KEV pressure arrives fast for SonicWall SSL-VPN: Tracking sources show CVE-2026-19868 added to KEV on November 6, 2026, which changes the internal conversation from “soon” to “deadline”. This is the kind of edge flaw that becomes mass-scanned overnight. Source: fc-vulns KEV index
3. Android “SMS of Death” PoC moves from bug to weaponized annoyance: Reporting highlights a critical Android issue where a crafted SMS can crash or disrupt devices, with a PoC available and uneven patch adoption expected. Mobile fleets should verify October 2026 patch levels, not assume them. Source: TechRadar
4. Bitdefender flags “hybrid AI” ransomware behavior in school attacks: Researchers describe a campaign where attackers leaned heavily on AI-assisted steps, suggesting faster iteration on phishing, negotiation, and internal recon. Plan for shorter dwell time between initial access and hands-on-keyboard impact. Source: ITPro
5. Daily threat context: CISA KEV additions continue to skew toward edge devices and management planes: Even when CVSS is not “10”, KEV status is the clue that exploitation is real, not hypothetical. If your patch process treats KEV as “just another feed”, you will keep getting surprised. Source: CISA GovDelivery bulletin

Top CVEs

1. CVE-2026-19868: SonicWall SonicOS SSL-VPN authentication enforcement weakness that can allow bypass of SAML authentication controls, potentially including SAML-enforced MFA, under certain credential scenarios. This is a perimeter-facing issue with exploitation reported, so treat as urgent. Source
2. CVE-2026-76504: Cisco Catalyst SD-WAN Manager hex encoding vulnerability added to CISA KEV based on evidence of active exploitation. If this is in your network management plane, assume it is already being probed. Source
3. CVE-2026-58882: Android “SMS of Death” style issue where a crafted message can crash or disrupt devices. Patch levels vary by OEM and carrier, so confirm October 2026 security updates across the fleet. Source

Podcasts & Talks

1. Smashing Security #491: How AI agents are spooking the banks: Useful for CISOs because it frames the coming fight over liability and acceptable use, especially when employees paste credentials into “helpful” agent tools. Listen: Smashing Security

Final Words

The through-line today is not “ransomware is bad” or “patch faster”. It’s that identity is now a collection of fallback paths. Attackers do not have to beat your best control, they just have to find the auth method you forgot to police, log, or deprecate.

This week, do three things:

• Patch SonicWall SonicOS for CVE-2026-19868 or disable exposed SSL-VPN until you can, and explicitly audit which alternate authentication methods are enabled.
• Inventory perimeter management planes touched by KEV, starting with Cisco Catalyst SD-WAN Manager (CVE-2026-76504), then verify external exposure and admin access paths.
• Verify Android fleet compliance with the October 2026 security updates and block unmanaged devices from accessing sensitive apps until they meet baseline patch levels.

Your turn: If a SonicWall SSL-VPN bypass headline hit your inbox tomorrow, do you know, in one query, which business-critical apps still depend on that VPN path? Hit reply with your answer, or drop a comment on the web version. I read every reply.

Know someone who still has SonicWall SSL-VPN exposed “because it’s behind MFA”? Forward them this issue. It costs 30 seconds, and the alternative costs weekends. If this was forwarded to you, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!