TYO Store Blog
Guides, product insights and announcements from the TYO Store team.
9/11/2026
Check Point has disclosed two CVSS 9.8 flaws in how its Quantum Security Gateways and Quantum Spark firewalls handle VPN certificates, exploitable with no login. Fixes shipped the same day, and for many customers they installed automatically. Whether yours did depends on one setting.
9/8/2026
An unauthenticated command-injection flaw in the parental-control feature of TP-Link's Archer BE800, BE3600 and AX75 lets anyone on the local network take root on the router. Fixes are out; here's why "LAN-only" isn't the comfort it sounds like.
9/6/2026
HPE has patched 34 flaws in its AOS-CX switch software, led by CVE-2026-73749, an unauthenticated remote code execution bug rated CVSS 9.8. Not exploited so far, but a reminder that the switch behind your firewall runs software too.
9/5/2026
SonicWall has patched three flaws in its on-prem Network Security Manager, two rated CVSS 9.1. None can be used by a stranger on the internet, but chained together they turn an ordinary admin login into root on the console that runs every firewall it manages.
9/5/2026
MikroTik shipped a RouterOS update on 3 September saying "most configurations are not at risk" and withheld the details. Two days later CERT Polska confirmed attackers were already chaining two CVSS 9.2 SSH flaws to seize full control of routers with SSH open to the internet.
9/3/2026
Two SonicWall SMA1000 flaws — including a CVSS 10.0 unauthenticated SSRF — were exploited in the wild before fixes existed. Here's what happened, and why patching alone isn't the finish line for any internet-facing gateway.
8/29/2026
SonicWall has patched two flaws in its NetExtender Linux VPN client, one of which lets an attacker write files as root. Nobody's been hit, a fix is out — but it's a timely reminder that the VPN client on your laptops is part of your network too.
8/29/2026
WatchGuard has patched a critical pre-authentication flaw (CVE-2026-19313) in the VPN service of its Firebox firewalls. It isn't being exploited yet — which is exactly why now is the moment to update.
8/29/2026
Synology has disclosed details of three vulnerabilities in its Chat Server package for DSM NAS devices, including a CVSS 9.0 cross-site scripting flaw that can read or write files on the NAS itself. Here's what it really allows, who's affected, and the ten-minute fix.
8/26/2026
Ubiquiti's Security Advisory Bulletin 067 fixes 21 critical-severity flaws spanning UniFi Protect, Network, Access, Talk, Connect and OS — several exploitable with no login at all. Here's what's real, what's not, and what to do about it.
8/17/2026
A newly disclosed path traversal flaw in Zyxel's ZLD firewall firmware lets an already-logged-in administrator plant and run a malicious configuration file. It needs admin credentials first — which is exactly why admin account hygiene matters as much as patching.
8/13/2026
Attackers are actively exploiting an unauthenticated flaw (CVE-2026-20349) that lets them crash Cisco ASA and FTD firewalls through the Remote Access SSL VPN. Here's what it really means and the calm, no-upsell steps to take.