TYO Store Blog
Guides, product insights and announcements from the TYO Store team.
9/6/2026
HPE has patched 34 flaws in its AOS-CX switch software, led by CVE-2026-73749, an unauthenticated remote code execution bug rated CVSS 9.8. Not exploited so far, but a reminder that the switch behind your firewall runs software too.
9/5/2026
SonicWall has patched three flaws in its on-prem Network Security Manager, two rated CVSS 9.1. None can be used by a stranger on the internet, but chained together they turn an ordinary admin login into root on the console that runs every firewall it manages.
9/5/2026
MikroTik shipped a RouterOS update on 3 September saying "most configurations are not at risk" and withheld the details. Two days later CERT Polska confirmed attackers were already chaining two CVSS 9.2 SSH flaws to seize full control of routers with SSH open to the internet.
9/3/2026
Two SonicWall SMA1000 flaws — including a CVSS 10.0 unauthenticated SSRF — were exploited in the wild before fixes existed. Here's what happened, and why patching alone isn't the finish line for any internet-facing gateway.
8/29/2026
SonicWall has patched two flaws in its NetExtender Linux VPN client, one of which lets an attacker write files as root. Nobody's been hit, a fix is out — but it's a timely reminder that the VPN client on your laptops is part of your network too.
8/29/2026
WatchGuard has patched a critical pre-authentication flaw (CVE-2026-19313) in the VPN service of its Firebox firewalls. It isn't being exploited yet — which is exactly why now is the moment to update.
8/29/2026
Synology has disclosed details of three vulnerabilities in its Chat Server package for DSM NAS devices, including a CVSS 9.0 cross-site scripting flaw that can read or write files on the NAS itself. Here's what it really allows, who's affected, and the ten-minute fix.
8/26/2026
Ubiquiti's Security Advisory Bulletin 067 fixes 21 critical-severity flaws spanning UniFi Protect, Network, Access, Talk, Connect and OS — several exploitable with no login at all. Here's what's real, what's not, and what to do about it.
8/17/2026
A newly disclosed path traversal flaw in Zyxel's ZLD firewall firmware lets an already-logged-in administrator plant and run a malicious configuration file. It needs admin credentials first — which is exactly why admin account hygiene matters as much as patching.
8/13/2026
Attackers are actively exploiting an unauthenticated flaw (CVE-2026-20349) that lets them crash Cisco ASA and FTD firewalls through the Remote Access SSL VPN. Here's what it really means and the calm, no-upsell steps to take.
8/7/2026
Zyxel has patched two flaws in its business access points: an admin-only command injection in the WAX650S line (CVE-2026-6837, CVSS 7.2) and a guest Wi-Fi captive-portal bypass (CVE-2026-8508, CVSS 6.5). For many small businesses, the lower-scored one is the more relevant risk.
8/7/2026
Cisco's August 2026 hardening release patches seven IOS XE vulnerabilities — one rated CVSS 9.8 — found by its own engineers using internal testing and frontier AI models. None are being exploited, but there's no workaround: here's how to check whether your gear is affected and what to do about it.