Posts

Training and CyberInsights Today

F5 ASM

17 lessons · Beginner to advanced

Policies, staging, learning, signatures, tuning, API security, logs and recovery.

F5 ASM training →

FortiWeb

17 lessons · Beginner to advanced

Server policies, profiles, ML, signatures, APIs, troubleshooting and HA.

FortiWeb training →

How to use the WAF training hub

CyberInsights Today

Daily cybersecurity analysis and practical bulletins

Understand recent vulnerabilities, threats, their impact and mitigation. When there is no worthwhile new issue, learn a security concept or defensive practice through clear explanations, illustrations and evidence.

Read CyberInsights Today →

SonicWall SSL VPN MFA Bypass (CVE-2026-19868): Exposure, Patch and Verification

CyberInsights Today · Vulnerability analysis · By Harpreet Singh Public CVE disclosure November 6, 2026. Evidence checked November 9, 2026. Summary. If you run SonicWall SSL VPN with SAML, check the firewall firmware and which login methods the gateway accepts. On an affected gateway, valid credentials for an alternate authentication method can let a user bypass the SAML checks and potentially the multifactor authentication (MFA) that SAML enforces. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6. CVE record · CISA KEV entry How the login control fails SSL VPN is a remote access service. SAML lets an identity provider tell the VPN that a user has signed in and satisfied the configured policy. In a deployment that requires MFA through that provider, a login accepted through an alternate method can avoid the policy if SonicOS fails to enforce the intended authentication path. SonicWall’s CVE description specifies valid credentials for the alternate me...
Post a Comment
Read more

Broken Object-Level Authorization (BOLA) in APIs: How to Find and Fix IDOR

CyberInsights Today · Educational bulletin · By Harpreet Singh Sources checked November 8, 2026. OWASP documents BOLA in its 2023 API Security Top 10. This bulletin covers a vulnerability class. A disclosure date, affected or fixed versions, CVE, CVSS score and exploitation status apply to a specific incident or product advisory. Summary. A user can be allowed to open an invoice screen and still be forbidden from opening a particular invoice. If your API checks the login but skips that second decision, another customer's records could be exposed or changed. What goes wrong Authentication establishes who is calling. Authorization decides what that caller can do. An object is a record or resource such as an invoice, file, or support ticket. Broken object-level authorization (BOLA) happens when the API accepts a reference to an object and fails to check the caller's permission for the requested action on that exact object. Insecure direct object reference (IDOR) is a common w...
Post a Comment
Read more

WordPress CVE-2026-119977: Protect the Site During Its Core Update

CyberInsights Today · Vulnerability analysis By Harpreet Singh Virdi, CISSP, CCSP Vendor disclosure and security release October 28, 2026. Evidence last checked November 7, 2026. Check how your WordPress site applies a core update before you start one. CVE-2026-119977 can expose a temporary installer while affected WordPress code unpacks a full update package. If you can quickly restrict public access to the staging directory, put that protection in place before upgrading. Then verify the fixed version on every instance that serves traffic. What the upgrade exposes Think of a WordPress upgrade as a delivery. The updater unpacks the replacement files in a staging area before moving them into place. Affected versions can unpack a full core package into a predictable directory within the web server’s reach. The package includes installer files that can respond directly to HTTP requests. A remote visitor who reaches the installer while the staging area exists may gain code execution und...
Post a Comment
Read more

Zyxel GS1900 CVE-2026-107441: Impact, Exposure and Mitigation

CyberInsights Today · Vulnerability analysis By Harpreet Singh Virdi, CISSP, CCSP Published and evidence checked: November 6, 2026. Vendor disclosure: November 3, 2026. A switch can keep forwarding traffic while its management interface remains vulnerable. Start with the exact model and complete firmware identifier. A version that simply says “2.90” is not enough to close this issue. What happened Zyxel identifies CVE-2026-107441 as an out-of-bounds write in the GS1900 web interface’s CGI program. CGI is the component that processes web requests. An unauthenticated attacker with LAN access can send a crafted HTTP request that may lead to operating-system command execution. Zyxel advisory, November 3 . In plain English, software writes beyond the memory area intended for that operation. The advisory does not publish the exact request field or memory layout. This article therefore explains the trust boundary and prerequisites without inventing an exploit sequence. Conceptual threat path ...
Post a Comment
Read more

SSRF Explained: How URL Fetching Exposes Internal Services

CyberInsights Today · Educational bulletin By Harpreet Singh Virdi, CISSP, CCSP · November 5, 2026 References checked on November 5, 2026. Your application can fetch an image, preview a link or send a webhook. Each feature lets data from a user influence a request made by your server. The security question is which destinations that server is permitted to reach.
Post a Comment
Read more

Google Brotli CVE-2026-111497 Explained: Exploitation, Impact and Mitigation

CyberInsights Today · Additional threat analysis By Harpreet Singh Virdi, CISSP, CCSP Published and evidence checked on November 5, 2026. Start with a simple question. Where does your organisation turn Brotli-compressed data back into readable content? That may happen in a public API, a background worker, an outbound HTTP client or a proxy. Each decoding point needs an owner and a patch decision. CVE-2026-111497 is a memory-corruption vulnerability in Google's Brotli decoder. Google published a fixed release on October 21, 2026. Its release notes describe an out-of-bounds write with potential remote code execution. Google Brotli release notes .
Post a Comment
Read more

Patch Verification: How to Prove the Fix Is Running in Production

CyberInsights Today · Educational bulletin · November 4, 2026 The patch dashboard says “installed.” Your application still has an old worker serving requests. Both can be true. Before you close a vulnerability ticket, check the software that actually handles traffic and account for every instance that can return to service.
Post a Comment
Read more