VulnHub

SonicWall's SMA 1000 appliances are facing significant security challenges, with attackers actively exploiting five zero-day vulnerabilities since late 2025. These vulnerabilities have put SonicWall customers at risk, as they have been under attack for years. The ongoing exploitation means that organizations using these devices need to be particularly vigilant about their security posture. This situation raises concerns about the reliability of SonicWall products and highlights the importance of prompt patching and updates to mitigate such risks. As attackers continue to target these vulnerabilities, it is crucial for affected users to stay informed and take necessary precautions.

In this latest update on cybersecurity threats, attackers are increasingly using tactics that exploit user trust and familiarity. Phishing kits targeting CEOs are on the rise, alongside hacks affecting around 5,000 Dropbox accounts. These attacks often appear legitimate, with users receiving calls from IT, sharing files, or being prompted to click 'Allow' on trusted apps. Additionally, attackers are employing fake login pages and old account links to trick users into giving up their credentials. This highlights the need for heightened awareness and caution when interacting with seemingly innocuous requests, as one small mistake can lead to significant breaches.

A vulnerability in the Rockwell Automation 1756-ENBT module, identified as CVE-2025-10478, could allow attackers to crash the device by sending a specially crafted CIP packet. This denial-of-service issue affects all versions of the 1756-ENBT module, which is used for communication between Logix 5000 controllers and Ethernet devices. Once compromised, the module requires a restart to return to normal operation. This vulnerability poses risks to critical infrastructure sectors, including manufacturing, agriculture, and transportation. Rockwell Automation advises users to upgrade to the 1756-EN2T or 1756-EN4TR modules to mitigate this risk, while those unable to upgrade should follow security best practices.

A vulnerability in the OPC Foundation's OPC UA LocalDiscoveryServer (LDS) could allow attackers to gain control of high-privilege terminal sessions during installation. This affects versions of the software prior to 1.04.420 and has been assigned CVE-2026-77477. To exploit this vulnerability, an attacker needs elevated privileges and access to the system during installation, potentially allowing them to execute arbitrary commands. This issue is particularly concerning for sectors like energy, chemical, and critical manufacturing, where the software is widely used. Users are advised to upgrade to version 1.04.420 or later to mitigate the risk.

Schneider Electric has identified a serious vulnerability affecting several of its products, which could allow hackers to hijack user sessions. This flaw, cataloged as CVE-2026-4827, impacts a range of devices including the Easergy MiCOM series, EcoStruxure Power Automation products, and various PowerLogic and Saitel devices. If exploited, attackers could gain unauthorized access, potentially leading to disruptions in critical infrastructure sectors such as energy and water management. Users of the affected versions are urged to apply the necessary updates to mitigate this risk. The vulnerability is significant given the critical nature of the systems involved, necessitating prompt action from users worldwide to secure their operations.

A vulnerability in the IXON VPN Client, specifically versions earlier than 1.4.7, has been discovered that allows attackers to execute remote code with elevated privileges. This issue arises from improper handling of CRLF sequences, which can lead to command injection. The affected software is widely used across various critical sectors, including energy and information technology, and its exploitation could have severe implications for security. Users are urged to upgrade to version 1.4.7 or later to mitigate risks, as IXON has begun rejecting connections from older versions. Until the update is applied, users should consider uninstalling the VPN client if it is no longer needed.

Plex has alerted its users to update their desktop clients and media servers due to several identified security vulnerabilities. These flaws could potentially allow attackers to exploit the software, putting user data at risk. The company emphasizes the urgency of the update, as failure to patch could leave systems vulnerable to unauthorized access. Users of Plex should prioritize this update to ensure their media servers and clients are secure. It's a critical reminder of the importance of keeping software up to date to protect personal information and maintain security.

A member of Serbia's student protest movement has had their iPhone infected with Pegasus spyware, developed by the NSO Group. Researchers from the Citizen Lab, in partnership with the SHARE Foundation, discovered that a zero-click exploit via iMessage was used for the infection. This means the spyware could be installed without any interaction from the user, posing a significant risk to privacy and security. The incident raises concerns about surveillance tactics used against activists and highlights the ongoing issue of digital rights violations in regions with political unrest. Such spyware can gather sensitive information without the target's knowledge, making it a powerful tool for repression.

A security researcher known as Chaotic Eclipse has revealed a new zero-day vulnerability called FalconFlank that affects CrowdStrike Falcon, a popular endpoint protection solution. This privilege escalation flaw allows attackers to exploit the way CrowdStrike handles malicious macros, potentially giving them elevated access to systems protected by the software. This vulnerability poses a significant risk to organizations using CrowdStrike Falcon, as it could enable attackers to bypass security measures and gain unauthorized control. The researcher has provided a proof of concept (PoC) on GitHub, which demonstrates how the exploit can be executed. Companies using CrowdStrike Falcon should assess their security posture and stay alert for any signs of exploitation.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added seven vulnerabilities to its Known Exploited Vulnerabilities catalog, indicating that these flaws are being actively targeted by attackers. A significant vulnerability is CVE-2026-83548, which has a CVSS score of 10.0 and pertains to a server-side request forgery vulnerability in SonicWall SMA 1000 Appliances. This flaw could allow remote, unauthenticated attackers to exploit the system, potentially leading to unauthorized access or manipulation of data. Organizations using affected versions of SonicWall appliances should prioritize addressing this vulnerability to protect their systems from exploitation. The inclusion of these vulnerabilities in CISA's catalog serves as a warning for companies to review their security measures and ensure they are not vulnerable to these attacks.

SonicWall has issued security updates to fix two serious vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series VPN appliances. These flaws, identified as CVE-2026-83548 and another not specified in the article, have already been exploited in zero-day attacks. The first vulnerability, CVE-2026-83548, has a maximum severity score of 10.0 and allows attackers to execute server-side request forgery (SSRF) attacks before authentication. This means that unauthorized users could potentially access sensitive internal resources. Organizations using these VPN appliances are urged to apply the updates immediately to protect their systems from potential exploitation.

OpenAI's Astra has reached a significant milestone by demonstrating the ability to independently identify and exploit zero-day vulnerabilities in various well-protected systems. This capability raises serious concerns as it could enable attackers to breach security measures that are typically considered strong. The implications of this development are profound, as it suggests that advanced AI models can now autonomously discover weaknesses in critical software and systems, potentially leading to widespread security issues. Companies and organizations that rely on such defenses need to reassess their security protocols to guard against these newly identified risks. The situation emphasizes the need for continuous monitoring and updating of security systems to stay ahead of potential exploitation.

A federal grand jury in California has indicted a Russian national for his involvement in a phishing scheme that infected around 80,000 freelancers with two types of malware: TVRAT and DarkVNC. The malware was designed to give attackers remote access to victims' computers, compromising sensitive information and potentially leading to financial losses. This incident underscores the risks freelancers face, as they often work with sensitive data and may not have robust security measures in place. The indictment serves as a reminder of the ongoing threat posed by cybercriminals who exploit vulnerabilities in online communication and collaboration. Authorities are urging freelancers to remain vigilant and adopt better security practices to protect themselves against such attacks.