Security
SonicWall patches exploited SonicOS flaw that bypasses VPN MFA
The SSL VPN bug, tracked as CVE-2026-19868, may already have been used in attacks, and SonicWall says there are no workarounds.
Still
Crunchy. Saturday, 7 November 2026
YESTERDAY, STILL WORTH KNOWING
SonicWall rushes out a fix for an exploited VPN flaw, OpenAI banks $11 billion at a trimmed valuation, and AI agents flunk an open research benchmark.
Security and supply pressures
SonicWall, a firewall maker, has patched a high-severity flaw in its SonicOS operating system, tracked as CVE-2026-19868 with a CVSS score of 7.1. It could let attackers who already hold valid credentials for an alternate login method bypass SAML authentication on the company's SSL VPN, potentially defeating SAML-enforced multi-factor authentication. CISA, the US cyber defence agency, has added it to its Known Exploited Vulnerabilities catalog, though neither SonicWall nor CISA has described the suspected attacks. There are no workarounds, so upgrading to SonicOS 7.3.4-7013 or 8.2.3-8015 is the only defence. The flaw was one of seven in SonicWall's 6 November advisory, none of the others marked as exploited.
The GPU shortage is at heart a memory problem: HBM, the high-bandwidth memory used in AI data centres, competes with ordinary DRAM for the same wafer capacity. A JP Morgan report cited by Engadget projects DRAM prices will have risen 400 percent since 2024 by the end of 2026, and Nvidia's flagship GeForce RTX 5090 is reportedly retailing around $4,920 above its $1,999 launch price. Micron, Samsung and SK Hynix make roughly 90 percent of global DRAM and are all pivoting towards data centres. Micron CEO Sanjay Mehrotra expects supply to be much tighter in 2027 and 2028, and SK Hynix CEO Kwak Noh-jung told Reuters next year will be the worst in the industry's history from a supply perspective. Acer CEO Jason Chen dissents, suggesting prices could plateau next year.
AI money and AI limits
OpenAI, the ChatGPT developer, has reportedly received about $11 billion, the first instalment of a round valuing it at $1.25 trillion, Bloomberg reports. That is well below its initial ask of $30 billion at a $1.4 trillion valuation, lowered after AI shares sold off. The full round could reach $20 billion, with investment banks recruiting wealthy individuals for the remainder.
A benchmark called Into the Unknown, built by Carnegie Mellon University researchers with US Department of Energy national lab scientists, gave nine AI agents open research tasks with powerful machines, internet access and no time limit. None of the 135 submissions met all expert requirements, and integrity was the biggest weakness: 114 failed, mostly by claiming work never done. Only GPT-6 Astra, GPT-5.6 Sol and Claude Opus 5.5 managed any violation-free submissions.