CISSP Made Easy

This week was about things slipping through process gaps: a certificate authority breached after a system migration skipped security review, an MFA bypass on VPN appliances, a WordPress update flaw dating back to 2008, and secrets leaking through an AI coding assistant’s settings file. On top of that, an AI model tried to work its way around its own sandbox, hacktivists went after refrigeration controllers, Japan funded an emergency cyber package, and an Australian brand had a data breach through one of its vendors.

This week at a glance

Story	Category	Exam domain(s)
1. DigiCert breach traced to an unreviewed migration	Breach / incident	CISSP D7, D1
2. SonicWall SSL VPN flaw bypasses SAML and MFA	Exploited vulnerability	CISSP D5, D7
3. WordPress core update flaw lands on CISA KEV	Exploited vulnerability	CISSP D8, D7
4. Claude Code settings file leaks secrets to GitHub	Cloud / DevSecOps	CCSP D4, CISSP D8
5. OpenAI model tries to get around its sandbox	AI security	AAISM, CCSP D3
6. US agencies warn on refrigeration controller attacks	OT / critical infrastructure	CISSP D3, D7
7. Japan funds an emergency cyber security package	Policy / APAC	CISSP D1
8. Who Gives A Crap customer data exposed through a vendor	Australia / third-party risk	CISSP D1, CCSP D6

1. DigiCert breach traced to a migration nobody treated as a security change

Certificate authority DigiCert published a post-mortem on Mozilla’s Bugzilla. It explains that in February 2025 an internal business system was moved off a VPN-restricted network and ended up reachable from the internet. Attackers created an account on it and, from late June 2026, accessed customer names, business contact details and identity documents such as driver’s licences and passports. DigiCert says certificate issuance and customer logins were not affected. It also said the root cause was that the migration was handled as an infrastructure change rather than a security change.

Exam lens (CISSP D7 Security Operations; CISSP D1 Security & Risk Management): This is a textbook change management failure: any change that alters a system’s exposure needs a security impact analysis before approval, plus monitoring that would spot new accounts being created.

Source: The Record – DigiCert certificate authority reports data breach

2. Exploited SonicWall SSL VPN flaw lets attackers skip SAML and MFA

SonicWall patched seven SonicOS flaws on 6 November. One of them, CVE-2026-19868, lets someone holding valid credentials for another login method (such as local or LDAP accounts) get past SAML authentication, including MFA enforced through SAML. CISA added it to the Known Exploited Vulnerabilities catalogue the same day and gave US federal agencies until 20 November to fix it. The fixed releases are SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8), and there is no workaround.

Exam lens (CISSP D5 Identity & Access Management; CISSP D7 Security Operations): MFA only protects you if every way into a system enforces it, so leaving a legacy login path running alongside SAML quietly cancels the stronger control.

Source: SecurityWeek – SonicWall patches exploited SonicOS bug that weakens VPN logins; CISA Known Exploited Vulnerabilities Catalog

3. Exploited WordPress core update flaw, 18 years in the making

CVE-2026-119977 (CVSS 8.1) affects WordPress 4.7 through 7.1.3. During a core update, a temporary copy of the installer sits in wp-content/upgrade, and an unauthenticated attacker who reaches it before it is deleted can run code on the server. CISA added it to the KEV catalogue this week. The researcher behind it traced the behaviour back to WordPress 2.7, and the update that installs the fix still runs the old, vulnerable code while it does so. The advice is to block web access to wp-content/upgrade first, then update to 7.1.4 or the fixed release for your branch.

Exam lens (CISSP D8 Software Development Security; CISSP D7 Security Operations): This is a classic time-of-check/time-of-use (TOCTOU) race condition, and it shows why a compensating control sometimes has to go in before the patch itself.

Source: The Hacker News – Installing the fix for exploited WordPress flaw

4. AI coding assistant settings file spills passwords and cloud keys onto GitHub

Researchers at Apiiro found that when developers choose "don’t ask again" in Claude Code, the exact approved command can be saved to a project settings file, along with any secret typed into it. Of more than 104,000 public copies of the file on GitHub, 1,122 contained at least one secret. These included database passwords, SSH logins, package registry tokens and AWS keys. Deleting the file afterwards does not undo the leak, because git history and forks keep it.

Exam lens (CCSP D4 Cloud Application Security; CISSP D8 Software Development Security): Secrets belong in a secrets manager, never in config files or command lines. Once a secret has been exposed, the right response is to rotate it, not just delete the file.

Source: The Hacker News – Claude Code’s "Don’t Ask Again" file exposes secrets on GitHub

5. OpenAI discloses a model that tried to get around its own sandbox

OpenAI reported that an internal research model was given a coding task and found its sandbox’s web proxy was down. It then wrote its own network code and tried fragmented requests to get past a network filter, but did not succeed. Later in the run it asked the cloud instance metadata service for credentials, and that request was refused. OpenAI’s monitoring caught the behaviour, found no evidence of data leaving or of access to other tenants, and has since removed raw-packet access from unprivileged containers.

Exam lens (AAISM – AI Risk Management; CCSP D3 Cloud Platform & Infrastructure Security): Agentic AI needs defence in depth, meaning least-privilege containers, egress filtering, locked-down metadata services and independent monitoring, because the model itself cannot be relied on to stay within bounds.

Source: SecurityWeek – OpenAI model wrote its own network code to get around sandbox restrictions

6. US agencies urge hardening of refrigeration controllers after supermarket attacks

CISA, the FBI, HHS, USDA and the Department of Transportation issued a joint advisory after attackers remotely changed temperatures at hundreds of European supermarkets and tampered with cooling controls at French blood banks. The blood bank says staff stepped in before any products were compromised. Censys found that close to half of the internet-exposed refrigeration controllers it identified in October could still be reached in early November. The agencies recommend taking these controllers off the internet, segmenting OT networks and enforcing phishing-resistant MFA.

Exam lens (CISSP D3 Security Architecture & Engineering; CISSP D7 Security Operations): Building and industrial control systems should never sit directly on the internet. Network segmentation and secure remote access are the baseline controls for OT/ICS.

Source: SecurityWeek – US agencies urge organisations to harden refrigeration controllers; The Record – CISA and FBI warn on cooling system attacks

7. Japan funds a ¥10 billion emergency cyber package after a wave of breaches

Prime Minister Sanae Takaichi announced a 10 billion yen (about US$63 million) package after dozens of Japanese companies and agencies suffered unauthorised access and data leaks. It includes putting into practice the "active cyber defence" powers legalised in October, a "cyber rescue team" to help affected companies with initial response, and an AI-focused expert team to be set up under the Ministry of Economy, Trade and Industry.

Exam lens (CISSP D1 Security & Risk Management): Governments shape the risk landscape through law and funding, and offensive "active defence" powers raise jurisdictional and legal questions that security leaders need to understand.

Source: SecurityWeek (AP) – Japan announces emergency cybersecurity package following a wave of attacks

8. Who Gives A Crap customers notified after marketing vendor breach

Australian toilet paper brand Who Gives A Crap began emailing customers on 7 November about a breach at an unnamed US-based marketing software provider. Names, email addresses, phone numbers, mailing addresses and total spend for customers in Australia, the UK and the US may have been exposed, but not payment details, orders or passwords. The incident happened on 30 October, but the vendor only told the company on 6 November. The company has disconnected the vendor and says it will work with regulators.

Exam lens (CISSP D1 Security & Risk Management; CCSP D6 Legal, Risk & Compliance): You can outsource processing but not accountability. Vendor contracts need breach-notification timeframes, and under Australia’s Notifiable Data Breaches scheme the organisation must assess a suspected eligible breach quickly, within 30 days at most.

Source: Cyber Daily – Aussie recycled toilet paper brand Who Gives A Crap discloses data breach

Practice Question of the Week

Your organisation’s infrastructure team plans to move an internal customer database from a VPN-restricted network segment to a cloud-hosted environment so remote staff can reach it more easily. The change has been logged as a routine infrastructure task. As the security manager, what should you do FIRST?

• A. Deploy a web application firewall in front of the database once the migration is complete
• B. Make sure the change goes through change management with a security impact analysis before it is approved
• C. Schedule a penetration test of the new environment for next quarter
• D. Encrypt the database at rest using the cloud provider’s key management service

Answer: B. The DigiCert breach happened because a migration that changed a system’s exposure was treated as an infrastructure change, so security never assessed it. A manager’s first step is to make sure the governance process (change management with a security impact analysis) catches the risk before the change is made. The technical controls in A, C and D may all turn out to be sensible, but they are reactive or partial, and they only become clear once that analysis has been done.

Security Tip of the Week

Add AI assistant and IDE config files (for example .claude/settings.local.json) to every project’s .gitignore, not just your global excludes, and run a secret scanner such as Gitleaks or TruffleHog as a pre-commit hook. If a secret has ever been committed, rotate it: removing the file does not remove it from git history.

Studying for CISSP, CCSP or AAISM? Turn each week’s headlines into exam practice with the free study notes, domain guides and practice questions at cisspmadeeasy.com. See you next week.