VulnHub

This week saw multiple security incidents that exploited vulnerabilities in various systems. Notably, a remote code execution vulnerability in WordPress was identified, allowing attackers to run malicious code on affected sites. Additionally, SonicWall reported zero-day vulnerabilities that could lead to unauthorized access. AI services are also being targeted, with attackers using fake prompts to trick users. These incidents highlight the need for organizations to patch outdated systems and be vigilant against social engineering tactics. The situation is concerning as some of these vulnerabilities were already being exploited before they were disclosed, leaving many systems at risk.

Volexity has reported that unknown hackers exploited two zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances, gaining root access to these devices before any patches became available. This attack began on June 22, 2026, targeting organizations using the affected SonicWall devices. The incident was part of a broader campaign that allowed the attackers to infiltrate networks, raising significant security concerns for businesses relying on these VPN appliances for secure remote access. The discovery emphasizes the need for companies to stay vigilant and ensure their systems are updated to protect against such unforeseen exploits.

A new threat actor, identified as UTA0533, has been exploiting zero-day vulnerabilities in SonicWall's Secure Mobile Access (SMA) 1000 series VPN appliances before these issues were publicly disclosed. This activity has been tracked since June 22, 2026, and was uncovered during an incident response investigation by cybersecurity firm Volexity. The attackers gained root access to systems, raising serious concerns about the security of organizations using these VPN appliances. This incident is particularly alarming as it highlights the potential risks associated with undisclosed vulnerabilities, which can be exploited by malicious actors before users have a chance to protect themselves. Organizations using SonicWall SMA appliances should be vigilant and prepare for potential impacts from these vulnerabilities.

Recent reports indicate that the Inc ransomware has exploited two zero-day vulnerabilities found in SonicWall's mobile access appliances. When combined, these vulnerabilities grant attackers root-level access, potentially allowing them to take full control of affected systems. This situation is particularly concerning for organizations that rely on SonicWall for secure remote access, as it could lead to significant data breaches or system compromises. Users and companies using SonicWall's mobile access appliances need to be aware of this threat and take immediate action to protect their systems. The exploitation of these vulnerabilities underscores the necessity for timely software updates and security measures.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Microsoft SharePoint Server to its list of Known Exploited Vulnerabilities. This flaw, identified as CVE-2026-58644, has a high severity score of 9.8, indicating that it poses a significant risk. Federal Civilian Executive Branch agencies are mandated to implement necessary patches by July 19, 2026. The vulnerability involves a deserialization issue that could allow attackers to execute remote code on affected systems, making it crucial for organizations using SharePoint to take immediate action. By addressing this vulnerability, agencies can help prevent potential exploitation by malicious actors.

SonicWall customers are currently facing significant risks as attackers exploit two critical zero-day vulnerabilities. Researchers revealed that these flaws were actively targeted by hackers three weeks prior to SonicWall's disclosure and patching efforts. This means that many users may still be vulnerable to attacks if they haven't updated their systems. The exploitation of these vulnerabilities could lead to unauthorized access to sensitive information and compromise network security. It's crucial for organizations using SonicWall products to take immediate action to secure their systems against these threats.

The Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to quickly address three vulnerabilities in SharePoint that are currently being exploited by attackers. Among these, two have been identified as zero-days, meaning they are actively targeted before a patch was made available. This situation poses significant risks to users of SharePoint, as attackers could gain unauthorized access to sensitive data or disrupt operations. Organizations that use SharePoint are advised to prioritize patching these vulnerabilities to protect their systems and data from potential breaches. Immediate action is crucial to mitigate the risks associated with these exploits.

A new AI-powered system has been developed to automatically find complex software vulnerabilities, referred to as a 'vulnerability vending machine.' This system utilizes code slicing alongside large language models (LLMs) to discover previously unknown security flaws. Recently, it successfully identified and exploited a zero-day vulnerability in a WordPress plugin, which had not been publicly known before. The company behind this technology is also working on additional vulnerabilities that are currently under responsible disclosure, meaning they are notifying affected parties before making the details public. This development raises concerns about the ease of finding and exploiting software vulnerabilities, potentially putting many users and systems at risk if such tools become widely accessible.

Progress has confirmed that a zero-day vulnerability was behind the recent disruption of its ShareFile service. This issue specifically impacted customers using the Storage Zones Controller, who experienced access problems. To address the situation, Progress has rolled out a fix that these customers can apply to restore functionality. The existence of a zero-day exploit raises concerns about the security of the affected systems, as attackers could have potentially leveraged this vulnerability before it was patched. Users of ShareFile should prioritize applying the fix to mitigate any risks associated with this vulnerability.

SonicWall has issued a warning about active attacks targeting two zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 appliances. These vulnerabilities were identified by Adam Babis from SonicWall's Product Security Incident Response Team (PSIRT) and include a serious flaw that allows for arbitrary command execution. The company has confirmed that these vulnerabilities are being actively exploited in the wild, which poses a significant risk to organizations using these appliances. Users of the SMA 1000 series should be particularly vigilant, as the exploitation could lead to unauthorized access and control over their systems. It's crucial for affected organizations to take immediate action to protect their networks.

SonicWall has reported that two zero-day vulnerabilities affecting its Secure Mobile Access (SMA) 1000 series appliances are currently being exploited. One of these vulnerabilities, identified as CVE-2026-15409, has a critical CVSS score of 10.0 and allows remote attackers to execute arbitrary commands through a server-side request forgery (SSRF). This means that attackers can potentially gain unauthorized access to sensitive systems. The exploitation of these vulnerabilities poses a significant risk to organizations using these appliances, as it could lead to severe security breaches. SonicWall's warning emphasizes the urgency for users to address these issues to protect their networks.

SonicWall has issued a warning about two vulnerabilities in its SMA1000 series, identified as CVE-2026-15409 and CVE-2026-15410. These flaws are being actively exploited by attackers in zero-day attacks, meaning they are being targeted before a fix has been widely implemented. As such, SonicWall is urging all users of the SMA1000 series to apply the newly released security updates to protect against these threats. Failure to patch could leave systems vulnerable to unauthorized access and potential data breaches. Users should prioritize this update to maintain the security of their networks.

SonicWall has identified two vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances, known as CVE-2026-15409 and CVE-2026-15410, which are currently being exploited by attackers. The company is urging its customers to upgrade to a fixed firmware version immediately and to check for signs of compromise on their systems. If any indicators of compromise are found, SonicWall recommends that organizations re-image their hardware or redeploy their virtual appliances, change all user and administrator passwords, and reset any Time-based One-Time Password (TOTP) tokens. This situation raises concerns for organizations relying on these appliances for secure remote access, as attackers could exploit these vulnerabilities to gain unauthorized access to sensitive information. Swift action is essential to mitigate potential risks.

Progress Software has confirmed that a serious zero-day vulnerability led to the emergency shutdown of ShareFile Storage Zone Controllers last week. Users of ShareFile, a cloud-based file sharing and storage service, were affected as the company worked to address the flaw. Progress has since released security updates to patch this vulnerability, which could have potentially allowed unauthorized access or data breaches. This incident is significant because it underscores the risks associated with cloud storage services, highlighting the need for users to ensure their systems are updated promptly to protect sensitive data.