This Week in Business IT: Harvard Breach, SonicWall Flaw

Harvard: 850,537 accounts exposed

Harvard University (harvard.edu) had a breach dated November 18, 2025 that was added to the Have I Been Pwned verified breach database on November 3, 2026, covering 850,537 accounts. This isn't just email and password data — the exposed fields include dates of birth, physical addresses, phone numbers, employers, job titles, marital statuses, ethnicities, places of birth, family members' names, and charitable donation history. That's the kind of profile a scammer needs to run a convincing business email compromise or a targeted phishing call, not just a generic spam blast.

Who it affects: anyone who donated to, applied to, worked for, or studied at Harvard, plus their listed family members. If you have employees, executives, or board members who went to Harvard, donated there, or have kids who attend, assume their personal details are now circulating somewhere. This kind of rich personal data gets packaged and resold, and it shows up in targeted phishing and vishing attempts months or years later — it doesn't expire.

What to do this week: check whether any company email addresses show up in this breach, and if you haven't already, get continuous visibility on where your domain and executives' personal information surfaces for sale. A dark web monitoring service flags this kind of exposure so you're not finding out from a fraud attempt six months from now. If your HR or finance team handles donor data, education records, or anything resembling this field set, now's a good time to double check your own data handling against FTC Safeguards Rule requirements — the fields exposed here are exactly the category regulators care about.

CVE-2026-19868 — SonicWall SonicOS SSLVPN

SonicWall's SonicOS SSLVPN has a single-factor authentication weakness that CISA added to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a federal remediation due date of November 20. Known ransomware use is listed as unknown, but "added to KEV" already means someone is actively using it in the wild right now.

Who it affects: any business running a SonicWall firewall or SSLVPN appliance for remote access — and that's a lot of Texas small and mid-size shops, since SonicWall gear is common in exactly that size bracket. If your remote workers, field techs, or contractors connect in through a SonicWall VPN, this is your problem, not someone else's. We've got the full breakdown at our CVE-2026-19868 guide, including what settings to check first.

What to do this week: don't wait for the federal deadline — that's a floor for agencies, not a target for you. Confirm multi-factor authentication is actually enforced on your SSLVPN logins, apply SonicWall's patch, and if you can't patch immediately, restrict SSLVPN access to known IP ranges as a stopgap. This is exactly the kind of gap a vulnerability assessment catches before it becomes a 2 a.m. phone call.

CVE-2024-27834 — Apple Multiple Products

Apple has an improper authentication vulnerability across multiple products, added to CISA's KEV catalog on November 4, 2026, with a federal due date of November 18. Known ransomware use is unknown.

Who it affects: businesses running Apple devices — Macs, iPhones, iPads — that haven't kept up with OS updates. If your office runs a mixed Windows/Mac environment, this is one more reason patching can't stop at the Windows laptops. We keep a full rated list of current Windows and macOS vulnerabilities at LayerLogix Academy so you can see severity at a glance instead of chasing every CVE number individually.

What to do this week: push pending Apple updates across company-owned and BYOD devices that touch work email or files. If you don't have enforced update policies on Apple hardware, that's a gap worth closing through your managed IT services provider rather than hoping employees click "update later" eventually.

CVE-2026-119977 — WordPress Core

A time-of-check time-of-use race condition in WordPress Core was added to CISA's KEV list on November 3, 2026 — and its federal due date was November 6, meaning that deadline has already passed. Known ransomware use is unknown.

Who it affects: anyone running a WordPress site, which is a huge share of small business websites in Texas — your marketing site, your client portal, maybe your whole e-commerce storefront. A race condition bug like this can let an attacker slip malicious code or permissions changes in during a narrow window, and once your site's compromised it becomes a launchpad for phishing pages or malware distribution under your own domain's reputation.

What to do this week: if you haven't verified your WordPress core and plugin versions are current, do it today — this one's already past its patch window and sitting exposed. For most small businesses this isn't optional cleanup, it's active risk; if your site handles customer logins, payments, or any regulated data, treat it with the same urgency as a network vulnerability, not a website housekeeping chore.

Put together, this week's items point at the same lesson: remote access tools, endpoint operating systems, and public-facing websites all need the same patching discipline, and none of them can run on autopilot. Research this year has shown the median time businesses take to fully remediate a known-exploited vulnerability sitting at 43 days from Verizon's 2026 DBIR — and attackers don't wait that long once something's on the KEV list. If your current setup relies on someone remembering to check for updates, that gap is where ransomware and data theft get their foothold. A proper cybersecurity program with continuous monitoring catches these the week they're announced, not the quarter after.

For the deeper dive into any CVE mentioned here, browse our growing library at /cve, and for the fundamentals — patching cadence, MFA, least-privilege access — start with the basics covered in LayerLogix Academy. If you want a straight answer on where your business actually stands against this week's threats, request a free IT assessment and we'll walk through it with you.