This brief covers the trailing ~48 hours (November 7–9, 2026). It was a quiet weekend window: no new CISA KEV additions and no new vendor zero-day advisories landed in it. Two incidents were confirmed by the affected organizations during the window, and several active items from late last week continued to develop. Every item below is traced to its primary source (vendor advisory, CISA entry, or the organization’s own statement).

Technical University of Munich restores TUMonline after attackers stole central login passwords for every myTUM user

Technical University of Munich · November 9, 2026

TUM first disclosed the incident on November 6 and posted a status update on the morning of November 9. Unknown attackers compromised the myTUM portal and obtained the central login passwords of everyone registered there, then used a TUMonline system administrator’s credentials to attack TUMonline, the campus management system, which TUM took offline. Exposed data for all affected users includes the TUM account password, name, home address, and date of birth; employees additionally had work address and work phone number exposed, and students their student ID, degree program, and completed-semester count. TUM says attacker activity inside TUMonline was largely logged and it currently assumes grades and applications were not accessed. TUMonline access and password changes were restored on November 9; TUM has reported the incident to the Bavarian data protection authority and filed a criminal complaint. The number of affected accounts has not been disclosed, and the initial access vector has not been explained.

“User accounts with MFA were protected from this attack.” — TUM press release “IT Security Incident at TUM,” signed by Dr.-Ing. Alexander Braun, Executive Vice President for IT Systems & Services and CIO

Source: TUM press release · The Register

Brenner Base Tunnel operator BBT SE confirms targeted intrusion as Everest claims 812 GB of stolen data

BBT SE (via ANSA) · November 7, 2026

BBT SE, the Italian-Austrian company building the Brenner Base Tunnel, confirmed to ANSA on November 7 that it was the target of a cyberattack in which unauthorized parties accessed data reachable from the internet. The company says it isolated the affected systems, engaged external forensic specialists, and notified the competent authorities; based on current information, tunnel operations are not affected and there is no evidence that industrial or control systems were reached. The Everest extortion group has claimed the attack and says it exfiltrated 812 GB of files; that figure is unverified, and BBT SE has not confirmed any encryption of systems. The intrusion reportedly dates to mid-October and was first reported by Austrian press on November 6.

“Non appena rilevato l’incidente, la società ha attivato i protocolli di sicurezza informatica” (“As soon as the incident was detected, the company activated its cybersecurity protocols”) — BBT SE statement to ANSA

Source: ANSA · Security Affairs

Still developing

SonicWall SonicOS SSL-VPN authentication-enforcement flaw bypasses SAML-enforced MFA; exploited and in CISA KEV

SonicWall PSIRT / CISA · November 6, 2026

CVE-2026-19868 (CWE-308; CVSS 7.1 per SonicWall, 7.5 per the CISA ADP score on the CVE record) is an authentication-enforcement weakness in the SonicOS SSL-VPN service. When SAML is enabled for SSL-VPN logins, an attacker holding valid credentials for an alternate authentication method can bypass SAML and any MFA enforced through it. Affected: Gen7 TZ/NSa/NSsp/NSv firewalls on SonicOS 7.3.3-7015 and older, and Gen8 TZ/NSa/NSv on 8.2.2-8015 and older. Fixed in 7.3.4-7013 and 8.2.3-8015; no workaround is offered. SonicWall says it investigated a report of potential exploitation, and CISA added the CVE to the KEV catalog on November 6 with a federal remediation deadline of November 20. It is the only one of seven CVEs in advisory SNWLID-2026-0014 flagged as exploited. Review SSL-VPN logins that lack a matching identity-provider sign-in.

“Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” — SonicWall advisory SNWLID-2026-0014, as reproduced by SecurityWeek

Source: SonicWall PSIRT SNWLID-2026-0014 · CISA KEV alert · SecurityWeek · Help Net Security

OpenSSH “SSHole” password-authentication bypass on musl-based Linux (Alpine, OpenWrt) exploited within hours of disclosure

OpenSSH / Alpine Linux · November 5, 2026

CVE-2026-123158 affects OpenSSH before 10.6p2 on musl-based systems that verify passwords without PAM. musl’s crypt() returns * for passwords longer than 256 bytes, and * is also the stored value for accounts with no password, so a long password matches those accounts and permits login without knowing any credential. Alpine’s default openssh-server package is affected (fixed in 10.6_p2-r0 on edge, with backported fixes for 3.16–3.24; sshd must be restarted after upgrading); OpenWrt, Buildroot, Yocto, and Alpine-based container images should be checked. No CVSS score was given in the OpenSSH or Alpine advisories. Threat-intelligence firm Previdian reported the first exploitation attempt less than nine hours after CVE publication and confirmed root access on an Alpine honeypot; as of November 6 the flaw was not in CISA KEV.

“An attacker who can reach your SSH port can log in without knowing any password.” — Alpine Linux security advisory

Source: OpenSSH 10.6p2 release notes · Alpine Linux advisory · Help Net Security · The Hacker News

Claude Code “don’t ask again” approval file leaks 1,379 secrets across 1,122 public GitHub repos; Anthropic says it is prototyping fixes

Apiiro · November 5, 2026

Apiiro researchers found 104,185 copies of .claude/settings.local.json in public GitHub repositories; 1,122 of them contained at least one secret (1,379 distinct secrets across 63 organizations), including 379 database passwords, 43 SSH logins, 42 GitHub/GitLab/npm tokens, and 23 AWS keys. When a user approves a shell command with “Yes, and don’t ask again,” Claude Code writes the full command, including any inline password or token, into that file; it is added to the user’s global git excludes rather than the project’s .gitignore, so the protection does not travel with the repo. Counting settings.json, older versions, and saved chat logs, the total rises to 2,539 secrets in 1,994 repositories. Coverage on November 7 reported no response from Anthropic; on November 9 Anthropic’s head of Claude Code, Boris Cherny, said the team will prototype secret scanning and auto-mode detection. Rotate any exposed credential first, then untrack and gitignore the file.

“Historically Claude Code has not done secret scrubbing (there are many good tools for that), but we are looking into what we can do to prevent this” — Boris Cherny, Anthropic, as quoted by iTnews

Source: Apiiro research · The Hacker News · iTnews

Crédit Mutuel Arkéa confirms ~€118M ($133M) in fraudulent transfers initiated through a service provider’s platform

Crédit Mutuel Arkéa · November 4, 2026

The French banking group disclosed on November 4 that it had been the victim of an attack allowing fraudulent transactions to be carried out from the bank’s own accounts to other banks, with funds then reportedly converted to stablecoins. Blockchain investigator ZachXBT traced roughly $106 million withdrawn from exchange accounts on November 1 and a further $27 million on November 3. Arkéa says attackers did not go through customer accounts but reached the bank directly via the platform of an unnamed service provider, that part of the funds has been blocked, and that it can only “validate the order of magnitude” of the €118 million figure. The bank disputes reporting that the entry point was its online subsidiary Fortuneo. Authorities and supervisors have been notified and some transactions were temporarily suspended.

“This incident has no consequences for their assets and has only caused a delay in the execution of certain transfers.” — Crédit Mutuel Arkéa statement to customers, as translated by Help Net Security

Source: Crédit Mutuel Arkéa statement (PDF) · Help Net Security · BleepingComputer

This brief covers the trailing ~48 hours (November 7–9, 2026).

Primary sources:

• TUM — IT Security Incident at TUM
• ANSA — BBT SE statement on the Brenner Base Tunnel cyberattack
• SonicWall PSIRT — SNWLID-2026-0014
• CISA — Adds One Known Exploited Vulnerability to Catalog (Nov 6, 2026)
• OpenSSH — 10.6p2 release notes
• Alpine Linux — OpenSSH password authentication bypass
• Apiiro — Coding agents leaking secrets on GitHub
• Crédit Mutuel Arkéa — Communiqué of November 4, 2026

This brief covers the trailing ~48 hours (November 6–7, 2026). Every item below was traced to a primary source — a vendor advisory, the CVE record, the NVD/CISA KEV entry, or the original research — and the dates shown are the dates those primary sources carry.

SonicWall SonicOS SSLVPN SAML/MFA bypass (CVE-2026-19868) exploited in the wild, added to CISA KEV

SonicWall PSIRT / CISA · November 6, 2026

SonicWall published advisory SNWLID-2026-0014 for CVE-2026-19868, an authentication-enforcement flaw in the SonicOS SSLVPN service. A user holding valid credentials for an alternate authentication method can bypass SAML authentication controls, and SonicWall says successful exploitation may also bypass SAML-enforced multi-factor authentication. The bug is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) and affects Gen7 SonicOS 7.3.3-7015 and older and Gen8 SonicOS 8.2.2-8015 and older; SonicWall urges upgrading to the latest release, with outlets citing the advisory listing SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8) as the fixed builds. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day as “SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability,” with a federal remediation deadline of November 20, 2026. Admins running SAML on SSLVPN should patch and review logins that skipped MFA.

“An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” — CVE-2026-19868 record, SonicWall (CNA)

Source: SonicWall PSIRT SNWLID-2026-0014 · NVD CVE-2026-19868 (KEV: added 2026-11-06) · CISA alert · Security Affairs

OpenSSH “SSHole” password-authentication bypass (CVE-2026-123158) sees exploitation attempts within hours of disclosure

OpenSSH / Alpine Linux / Previdian · November 5–6, 2026

OpenSSH released 10.6p2 on November 5 to close CVE-2026-123158 (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), a password-authentication bypass affecting sshd on Linux systems built with musl libc and PAM disabled — Alpine Linux’s default, with OpenWrt, Buildroot and Yocto also named. Per the CVE record, for some account configurations “any password between 256 and 1024 characters succeeds,” including on accounts whose password field is set to “*”. Reported by Özgün Kültekin of Wakefield, the root cause traces to a 2016 username-enumeration fix (CVE-2016-6210). Threat-intel firm Previdian’s honeypot sensors recorded the first exploitation attempt at 00:05 UTC on November 6, roughly eight hours after the CVE was published, and had logged 17 attempts from 11 IPs by November 7, confirming root access on an Alpine honeypot. Not yet in CISA KEV. Alpine notes that upgrading the package alone does not replace the running daemon — sshd must be restarted.

“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.” — Alpine Linux security advisory, November 5, 2026

Source: OpenSSH 10.6p2 release notes · Alpine Linux advisory · NVD CVE-2026-123158 · Previdian telemetry · SecurityWeek · The Hacker News

QNAP confirms NAS compromises via “Plex2Shell” Plex Media Server chain (CVE-2026-96652/96654/96655/96656)

QNAP PSIRT · November 6, 2026

QNAP issued a security notice saying it has received reports from users that Plex Media Server running on their NAS devices appears to have been compromised through the Plex2Shell vulnerability chain — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 — which affects Plex Media Server 1.43.2 and earlier and is fixed in 1.43.3.10861. The four CVEs were added to CISA KEV on October 20, 2026, after exploitation began following public disclosure of technical details on October 16; QTS, QuTS hero and other QNAP operating systems are not themselves affected. QNAP’s guidance is blunt: if a vulnerable Plex instance was reachable from the internet (Remote Access, forwarded port 32400, or UPnP), updating alone will not remove an attacker’s changes — users should check for indicators of compromise, perform a clean reinstall, and reset Plex and NAS credentials.

“Plex has confirmed that these vulnerabilities are being actively and widely exploited.” — QNAP Security Notice, November 6, 2026

Source: QNAP security notice · QNAP remediation FAQ · Plex2Shell research (Zach Main) · BleepingComputer

WordPress core RCE (CVE-2026-119977): installing the fix can expose a site one last time; federal KEV deadline passes

Picus Security / The Hacker News · November 5–6, 2026

CVE-2026-119977 is an unauthenticated remote-code-execution flaw in WordPress core 4.7 through 7.1.3 (CVSS 3.1 8.1 per Wordfence, the CNA), caused by predictable, web-accessible staging paths under wp-content/upgrade/ during full-package core updates; it was fixed in 7.1.4 and added to CISA KEV on November 3 with a November 6 remediation deadline that has now passed. New analysis from Picus Security’s Umut Bayram, reported November 6, shows the update that installs the fix still unpacks files with the site’s old, unpatched updater, so a site on 5.9 or later is exposed one final time during that upgrade, and wp core update uses the same code path. Wordfence has observed attack attempts beginning minutes after its firewall rule shipped. Recommended mitigation: block web access to wp-content/upgrade/ (confirm a 403) before updating, or update manually outside the web-served root.

“WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.” — CVE-2026-119977 record, Wordfence (CNA)

Source: Picus Security analysis · WordPress security advisory GHSA-4w3m-c66w-69mg · NVD CVE-2026-119977 (KEV: added 2026-11-03) · The Hacker News

Still developing

Zyxel GS1900 switch zero-day (CVE-2026-107441) behind ~1,000 device compromises

Zyxel / Binarly · November 3, 2026

Zyxel’s November 3 advisory and a same-day Binarly write-up disclosed CVE-2026-107441 (CVSS 3.1 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated out-of-bounds write in the CGI program of GS1900-series switch firmware through 2.90(xxxx.2)C0 that can lead to OS command execution via a crafted HTTP request; fixes are in the 2.90(xxxx.3)C0 “patch 3” firmware for ten models. Binarly determined that the intrusions earlier blamed on the June-patched CVE-2026-7273 — which SecurityWeek reports compromised almost 1,000 switches and deployed Jitterly and Sixzut malware — were in fact exploiting this previously unknown flaw, so the earlier patch did not stop the attackers. Not currently in CISA KEV.

Source: Zyxel advisory · Binarly research · SecurityWeek

APT29 watering holes deliver n-day iOS and Android exploit chains; Apple PAC bypass (CVE-2024-27834) lands in KEV

Sekoia / CISA · November 4, 2026

Sekoia attributes, with moderate-to-high confidence, a watering-hole campaign to APT29 (Midnight Blizzard) that served packaged exploit chains to iOS and Android visitors of compromised or cloned sites — including a Ukrainian gas producer, a Bulgarian military-related site, lookalikes of america250.org and a London hotel, and a supply-chain compromise of analytics provider Plerdy. The chains use only already-patched bugs, among them Apple’s CVE-2024-27834 (CVSS 5.5, Pointer Authentication bypass, fixed in iOS/iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, Safari 17.5), Chrome’s CVE-2026-3910 and Qualcomm’s CVE-2025-27038. CISA added CVE-2024-27834 to KEV on November 4 as “Apple Multiple Products Improper Authentication Vulnerability,” with a federal deadline of November 18, 2026.

“All three exploit chains rely entirely on known, already-patched vulnerabilities. None of them contain zero-days or work against fully updated devices.” — Sekoia, “Poisoned source,” November 4, 2026

Source: Sekoia research · NVD CVE-2024-27834 (KEV: added 2026-11-04) · SecurityWeek

This brief covers the trailing ~48 hours (November 6–7, 2026).

Primary sources: SonicWall SNWLID-2026-0014 · NVD CVE-2026-19868 · CISA KEV catalog · OpenSSH 10.6p2 release notes · Alpine Linux advisory · NVD CVE-2026-123158 · Previdian CVE-2026-123158 · QNAP security notice · Picus Security · WordPress GHSA-4w3m-c66w-69mg · NVD CVE-2026-119977 · Zyxel advisory · Binarly · Sekoia · NVD CVE-2024-27834

This brief covers the trailing ~48 hours (October 30 – November 1, 2026). Every item below was traced to a primary source — the vendor’s own disclosure, the CVE record, or the original research — and confirmed to fall inside the window.

Binance confirms ~$6.3 billion hot-wallet theft; TRM Labs points to North Korea’s TraderTraitor

Binance · October 30, 2026

Binance published a “Security Incident Update (2026-10-30)” stating that an attacker reached a service container via a compromised DevOps engineer’s laptop and submitted unauthorized withdrawals, with an estimated impact of about $6.3 billion. The exchange says it found no evidence of a wallet private-key leak, has suspended deposits and withdrawals, revoked the affected authorizations, and reports roughly $3 billion frozen on-chain by Tether, Circle, Ripple and others. TRM Labs and Chainalysis attribute the theft to DPRK’s TraderTraitor with high confidence; Elliptic urges caution because the laundering pattern differs from past DPRK cases and no root cause has been published. No CVE is involved.

“Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop.” — Binance, Security Incident Update

Source: Binance announcement · The Hacker News · SecurityWeek

Northflank breach: customer environment variables decrypted, stored AI API keys abused

Northflank · October 30, 2026

Developer-platform Northflank opened a security incident at 13:40 UTC on October 30 after a Wiz threat alert, and within twenty minutes told customers to assume every environment variable had been decrypted and to disable or rotate all keys. By 23:38 UTC, customers were reporting unauthorized use of AI provider API keys that had been stored on the platform; Northflank linked the overlapping source IPs to the “Black October” wave of LLM-credential theft documented by Wiz. Mitigations so far include network-policy patches, one-click secret rotation for Postgres, MongoDB, MySQL and Redis add-ons, and audit logs enabled for all tiers. The incident remains in “Identified” status with no root cause published.

“Assume all environment variables have been decrypted. Disable/rotate all keys.” — Northflank status page, October 30, 13:58 UTC

Source: Northflank incident page · BleepingComputer

Chainalysis discloses intrusion into internal tools via “offensive agentic techniques”; customer identity data exposed

Chainalysis · October 30, 2026

Chainalysis published a disclosure at 21:14 UTC saying an external actor used AI-driven attack techniques to gain unauthorized access to its systems and internal tools, activity it detected in October. Accessed data is limited to user IDs, full names, email addresses and organization role labels for provisioned platform users; the company says investigation content (graphs, notes, cases), query results, cleartext passwords, MFA secrets, session tokens and authentication credentials were not touched. It is patching the exploited vulnerabilities, hardening with outside experts, has notified all customers, and states explicitly that the incident is unrelated to the Binance theft.

“Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access.” — Chainalysis security disclosure

Source: Chainalysis disclosure · The Hacker News

Trojanized “Claude Code” extension on Cursor Marketplace planted a persistent SSH backdoor

OpenSourceMalware · October 30, 2026

OpenSourceMalware (Jenn Gile and Paul McCarty) reported that version 2.1.313 of the anthropic.claude-code extension was published to Cursor’s marketplace on October 29 with a 66-line loader prepended to extension.js. The loader adds an Ed25519 key labeled “svc-telemetry” to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse SSH tunnel to 134.209.82.225 that reconnects every 60 seconds, installs persistence (LaunchAgent, crontab, or scheduled task), and beacons host reconnaissance over plain HTTP. Cursor says the malicious build was live for roughly 11 hours, affected at most 5,000 users, and later flagged 2.1.312 as malicious too; it rotated keys and is rebuilding the marketplace. Anthropic states its own systems were not compromised and that the VS Code Marketplace and Open VSX builds are unaffected. Users who installed from Cursor should treat the host as compromised and remove the rogue key and persistence.

“Malicious code is prepended to the normal extension bundle and executes before legitimate initialization.” — OpenSourceMalware

Source: OpenSourceMalware analysis · The Hacker News

CISA adds two more Ivanti Connect Secure flaws to KEV, completing the UTA0576 root-access chain

CISA / CVE.org · October 30, 2026

CISA added CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog on October 30, with federal remediation deadlines of November 2 and November 13 respectively. CVE-2026-111357 is a privilege-escalation bug in which the dsinvoked broker trusts DSCache configuration data, yielding root; the CVE record carries CVSS 7.0 (AV:L/AC:H), while outlets citing Ivanti’s advisory report 8.8. CVE-2026-118527 is a lower-severity predictable-identifier flaw that lets an authenticated attacker upload files to a known location (reported CVSS 4.3). Volexity observed both chained with the already-listed authentication-bypass/RCE CVE-2026-104935 (KEV October 13) by the actor it tracks as UTA0576, who then harvested Active Directory credentials, LAPS passwords and BitLocker recovery keys. Ivanti’s fixed builds are 25.1.1.3 and 22.8R2.6; Volexity recommends forensic review of any appliance showing lateral movement.

“We made the decision to not delay getting a fix to customers that resolved the primary exploitation path.” — Ivanti advisory, as quoted by The Hacker News

Source: CISA alert · CVE-2026-111357 record · Ivanti advisory · Volexity · The Hacker News

WordPress core upgrade-staging RCE draws ~63,000 attack attempts in 24 hours

Wordfence / The Hacker News · October 30, 2026

Wordfence reported blocking 62,969 attempts in a single day to reach the web-accessible staging directory used during full-package WordPress core upgrades, the path behind GHSA-4w3m-c66w-69mg. The flaw, a race condition during core updates in which an unauthenticated attacker who wins the race against package extraction can achieve remote code execution, affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4 with backports to every branch back to 4.7.39. No CVE has been assigned; Wordfence scores it CVSS 8.1 while the GitHub advisory labels it “Low”. Attackers are probing paths such as setup-config.php; no confirmed compromises have been reported. Not in KEV.

“An unauthenticated attacker who wins a race against that extraction could reach remote code execution.” — WordPress security advisory GHSA-4w3m-c66w-69mg

Source: WordPress advisory · Wordfence · The Hacker News

Still developing

GitLab CVE-2026-97229 exploited against Alpine Linux infrastructure — GitLab / CISA · October 12 (patch), October 29 (KEV), 2026
The CVSS 10.0 regex-compiler RCE in GitLab CE/EE (fixed in 19.2.8, 19.3.5 and 19.4.2) entered KEV on October 29 with a November 1 federal deadline. Alpine Linux maintainers disclosed that an attacker hit their unpatched GitLab instance on October 20–21 with crafted CI configurations, crashing workers eight times and pulling the container image; later attempts on October 25–26 were blocked. Alpine found no evidence of success but rebuilt the instance from scratch and verified aports, packages and the October 21 releases were untampered. Source: GitLab patch release · CISA KEV · The Hacker News

Cisco ASA/FTD SSL VPN zero-day CVE-2026-76418 under active exploitation — Cisco / CISA · October 28–29, 2026
Cisco’s advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 describes a CVSS 8.6 unauthenticated denial-of-service (device reload) in the Remote Access SSL VPN service when secondary authentication is configured on a tunnel group; Cisco says it became aware of exploitation in October. CISA added it to KEV on October 29 with a November 1 due date. Fixed releases span ASA 9.16.4.104 through 9.24.1.27 and FTD 7.0.11 through 10.1.1. Source: Cisco advisory · CISA KEV

Drupal Commerce Core access bypass CVE-2026-118539 exploited against online stores — Drupal Security Team · October 28, 2026
SA-CONTRIB-2026-254 (rated Highly critical, 21/25) says the module “doesn’t sufficiently protect certain routes and entity fields,” allowing an access bypass that can financially impact the vendor, and states the vulnerability “is being actively exploited in the wild.” Affected: Commerce Core before 2.41 and 3.0.0 through 3.3.12; fixed in 8.x-2.41 and 3.3.13. Not in KEV. Source: Drupal advisory · SecurityWeek

This brief covers the trailing ~48 hours (October 30 – November 1, 2026).

Primary sources: Binance Security Incident Update · Northflank incident page · Chainalysis disclosure · OpenSourceMalware · CISA KEV alert (Oct 30) · CVE-2026-111357 · Volexity · WordPress GHSA-4w3m-c66w-69mg · GitLab 19.4.2 patch release · Cisco cisco-sa-asaftd-tunnel-dos-s6mgkb75 · Drupal SA-CONTRIB-2026-254