Multiple Critical Vulnerabilities Found in OpenAM Identity Platform
Open Identity Platform has disclosed 18 vulnerabilities affecting its OpenAM identity management platform, with three rated as Critical.
The issues were made public on October 22, 2026, alongside the release of the patched version OpenAM 16.1.4. All vulnerabilities have since received CVE identifiers.
Among the Critical flaws is CVE-2026-123551, which impacts the WebSocket service responsible for notifying clients about session creation and termination events. The vulnerability allows an attacker to connect without proper authentication checks, resulting in the leakage of user session tokens.
Successful exploitation enables complete session hijacking, including accounts belonging to administrators. VulnCheck rated the issue with the maximum CVSS v4.0 base score of 10.0.
The remaining vulnerabilities span a range of severity levels, but all were addressed in the October update.
Related articles
WordPress Core Update Flaw Draws Over 240,000 Attack Attempts Since Patch Release
Wordfence has blocked more than 240,000 attack attempts targeting a race condition vulnerability in the WordPress core update process, tracked as CVE-2026-119977 with a CVSS score of 8.1. The attempts began on October 28, the same day WordPress issued the fix, with a single-day peak exceeding 74,000 blocked requests. The flaw allows attackers to exploit predictable temporary upgrade files during the automatic core update, enabling them to complete an installation, create an administrator account, and upload malicious PHP code without any existing credentials. The vulnerability affects branches from version 4.7 through 7.1.3, with the fix available in 7.1.4 and backported releases for older lines. Because automatic updates are enabled by default on most sites, the exposure window opens silently during routine maintenance. Security researchers emphasize that the high volume of attempts does not confirm successful compromises, urging administrators to review user lists and modified files after any core update since late October.
Analysis of 284 Major Russian Sites Reveals Widespread DMARC Misconfigurations, Outdated Libraries and Subdomain Takeover Risks
An automated scan of 284 large Russian websites found that 24 percent allow easy email spoofing because DMARC records are either missing or set to p=none. Nearly one quarter of readable sites still load JavaScript libraries such as jQuery versions from 2013-2016 that carry publicly known CVEs. Half the sites transmit visitor IP addresses and cookies to foreign analytics services despite privacy policies claiming otherwise. Five abandoned subdomains point to AWS and DigitalOcean addresses that could be claimed for phishing. Government sites performed no better than commercial ones on most checks. The researcher released the open-source Suveren tool so any organization can run the same tests against its own domains.
Top Cybersecurity Articles of the Week: Linux Kernel TCP Flaw Leads Security NEXT Rankings
Security NEXT has published its weekly ranking of the most-read articles for the period of November 1 to November 7, 2026. The list is dominated by critical vulnerability disclosures and patches across widely used platforms. Leading the chart is a severe flaw in the Linux kernel's IPv4 TCP connection handling that has already attracted proof-of-concept reports. Other prominent entries include remote code execution issues in WordPress, hundreds of fixes in Chrome 157, and multiple critical vulnerabilities in pgAdmin 4. The ranking also highlights confirmed exploitation of Apple product vulnerabilities and a network intrusion at Japan's Ministry of Foreign Affairs that may have exposed personal data.
SonicWall SonicOS SSL VPN Authentication Bypass Vulnerability Under Active Exploitation
SonicWall disclosed seven vulnerabilities in its SonicOS operating system on November 6, 2026, including an authentication bypass flaw in the SSL VPN feature. The issue, tracked as CVE-2026-19868, affects environments where SAML authentication is enabled and allows attackers with valid credentials from another method to circumvent SAML controls. This bypass can also undermine multi-factor authentication enforced through SAML. The company has received reports indicating that the vulnerability is already being exploited in the wild. Both physical firewalls and virtual appliances are impacted, and SonicWall rates the flaw at CVSS 7.1. Users are urged to apply the available updates immediately.