🔓 Your VPN's MFA Can Be Bypassed & Your Plex Server May Be Hacked

Two of today's biggest security stories hit the devices that quietly guard your network and your files — and attackers are already exploiting both. If your business uses a SonicWall VPN or you run Plex on a QNAP storage box, this one's for you.

🔐 SonicWall VPN Flaw Lets Attackers Skip the "Second Lock"

SonicWall is warning customers about a new flaw in its SSL-VPN devices — the gateways many companies use to let remote employees securely connect to the office network. An attacker who has the right login details can use the bug to slip past the extra sign-in checks, potentially including multi-factor authentication (MFA), the "second lock" most of us rely on to stop stolen passwords from being enough. The U.S. government's cybersecurity agency, CISA, has already added it to its list of vulnerabilities known to be exploited in real attacks, which is a strong signal to act now. SonicWall also patched six other bugs in the same update. If your organization uses SonicWall VPNs, apply the latest update immediately — a VPN break-in is often the front door to ransomware.

Read more →

🎬 "Plex2Shell": Hackers Are Breaking Into Home and Office Storage Boxes

QNAP, a popular maker of network storage devices (NAS) used by families and small businesses to store photos, backups, and files, says hackers are actively breaking in through four flaws in Plex, the media-streaming app many people run on those devices. QNAP's advice is blunt: if you're running a vulnerable Plex server that's reachable from the internet, treat the device and everything on it as compromised. That could mean personal photos, business documents, and backups in the hands of criminals. Update Plex right away, take it off the public internet if you don't need remote access, and contact QNAP support if you think you've been hit.

Read more →

Stay ahead of threats with GOCO Security at gocosecurity.com.