SonicWall SMA1000: Max Severity SSRF Flaw (CVE-2026-102255)

Prioritize patching Citrix NetScaler ADC/Gateway for CVE-2026-107406 due to RCE risk. Address the unauthenticated SSRF flaw in SonicWall SMA1000 (CVE-2026-102255). Review GitHub Actions workflows for signs of credential theft.

Threat level high

Today in 60 seconds

Critical·Exploited·CVSS 10.0·3 outlets SonicWall SMA1000: Max Severity SSRF Flaw (CVE-2026-102255) An unauthenticated SSRF flaw exists in the SMA1000 Work Place interface, allowing internal function access. Do this today Upgrade SMA1000 appliances to the fixed release version.
High·CVSS 9.5·6 outlets Citrix: Patch NetScaler ADC/Gateway for CVE-2026-107406 RCE Patch NetScaler ADC and Gateway immediately due to a critical memory overflow vulnerability allowing RCE or DoS. Do this today Upgrade NetScaler ADC and NetScaler Gateway to recommended versions: ADC/Gateway 13.1-64.29+; ADC 14.1-FIPS 14.1-73.46+; ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283+.
High Credential Theft via Malicious GitHub Actions Workflows Malicious workflows were pushed to numerous repositories using compromised open-source maintainer accounts. Do this today Audit GitHub Actions workflows in critical repositories for unauthorized additions.

Actively Exploited 4

SonicWall SMA1000: Max Severity SSRF Flaw (CVE-2026-102255) Critical·Exploited·CVSS 10.0·3 outlets·BleepingComputerNewRead An unauthenticated SSRF flaw exists in the SMA1000 Work Place interface, allowing internal function access.
A maximum-severity, pre-authentication SSRF vulnerability (CVE-2026-102255) was found in the SMA1000 Appliance Work Place interface. This flaw could allow an unauthenticated attacker to direct the appliance to issue requests on its behalf. Exploitation attempts targeting the internal CouchDB service have been detected.

Why it matters. Successful exploitation could allow unauthorized actions by reaching internal functions without credentials. This vulnerability impacts gateways used by MSSPs, large corporations, and government agencies.

Do this today Upgrade SMA1000 appliances to the fixed release version.

Affected
SMA1000 6210, 7210, and 8200v models

CVE
CVE-2026-102255

Read on BleepingComputer Post on X LinkedIn

Also covered by The Hacker News, CSO Online
```
{"coverage":0.774,"evidence":0.9,"freshness":0.194,"importance":1,"novelty":1,"quality":0.95,"total":0.855}
```
Chinese Actors Combine Tools to Steal Data via Multiple Vulnerabilities Critical·KEV·Ransomware·CVSS 10.0·EPSS 100%·CISADay 2NewRead Chinese government-linked actors use automated tools and XSS to steal data from global organizations.
Chinese government-linked cyber threat actors are combining automated scanning tools, botnets, and hands-on exploitation. They target organizations by exploiting vulnerabilities via cross-site scripting and password spraying on Microsoft Exchange servers.

Why it matters. These actors are stealing sensitive data and credentials from global organizations, including US critical infrastructure sectors.

Do this today Implement multifactor authentication for all services and sanitize web application inputs.

Affected
Microsoft Exchange servers, VPN software

CVE
CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, +5 more
1. Fri 9 OctChinese Actors Use Automated Tools to Steal Data from Global Organizations
2. TodayChinese Actors Combine Tools to Steal Data via Multiple Vulnerabilities
Read on CISA Post on X LinkedIn

Also covered by The Hacker News
```
{"coverage":0.613,"evidence":1,"freshness":0.335,"importance":1,"novelty":0.6,"quality":0.95,"total":0.83}
```
AhsayCBS Vulnerabilities Exploited for Webshells and Crypto Mining Critical·Exploited·CVSS 10.0·4 outlets·BleepingComputerNewRead Threat actors are exploiting unpatched AhsayCBS flaws to gain access and deploy miners.
Threat actors exploited CVE-2026-105133 and CVE-2026-105134 in the AhsayCBS backup management platform. The attack chain involved bypassing authentication followed by OS command injection to deploy webshells and XMRig miners.

Why it matters. Successful exploitation allows attackers to establish persistence, deploy miners, and potentially install additional backdoors on compromised hosts.

Do this today Restrict access to the AhsayCBS management interface to trusted IP addresses only.

Affected
AhsayCBS

CVE
CVE-2026-105133, CVE-2026-105134

Read on BleepingComputer Post on X LinkedIn

Also covered by SecurityWeek, Huntress
```
{"coverage":0.898,"evidence":0.9,"freshness":0.419,"importance":0.75,"novelty":1,"quality":0.95,"total":0.822}
```
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) Critical·KEV·CVSS 9.8·EPSS 86%·watchTowr LabsNewRead watchTowr Labs analyzed a complex RCE chain exploiting multiple PaperCut vulnerabilities and patch bypasses.
watchTowr Labs analyzed a complex RCE chain exploiting multiple PaperCut vulnerabilities and patch bypasses.

CVE
CVE-2026-81578, CVE-2026-82077, CVE-2026-82078

Read on watchTowr Labs Post on X LinkedIn

Also covered by r/netsec
```
{"coverage":0.387,"evidence":1,"freshness":0.761,"importance":0.75,"novelty":1,"quality":0.95,"total":0.804}
```

Vulnerabilities & Patches 4

Citrix: Patch NetScaler ADC/Gateway for CVE-2026-107406 RCE High·CVSS 9.5·6 outlets·BleepingComputerNewRead Patch NetScaler ADC and Gateway immediately due to a critical memory overflow vulnerability allowing RCE or DoS.
A memory overflow weakness exists in NetScaler ADC and NetScaler Gateway appliances. Exploitation can lead to remote code execution or denial-of-service. The vulnerability requires the appliances to be configured as a SAML Identity Provider or Service Provider.

Why it matters. The flaw has a CVSS score of 9.5, indicating high severity. Successful exploitation grants attackers control over targeted devices.

Do this today Upgrade NetScaler ADC and NetScaler Gateway to recommended versions: ADC/Gateway 13.1-64.29+; ADC 14.1-FIPS 14.1-73.46+; ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.283+.

Affected
NetScaler ADC and NetScaler Gateway

CVE
CVE-2026-107406

Read on BleepingComputer Post on X LinkedIn

Also covered by SecurityWeek, The Register
```
{"coverage":1,"evidence":0.7,"freshness":0.557,"importance":0.75,"novelty":1,"quality":0.95,"total":0.801}
```
wolfSSH Releases v1.6.0 Patching 5 Vulnerabilities Including SSH Bypass High·CVSS 9.0·GBHackersNewRead wolfSSH released v1.6.0 to fix five vulnerabilities, including a critical SSH host-key authentication bypass flaw.
wolfSSL released wolfSSH version 1.6.0, addressing five security flaws. The release fixes CVE-2026-16516, a critical ECDSA host-key validation issue. It also addresses flaws in Windows authentication contexts and three medium-severity issues.

Why it matters. The critical vulnerability allows a man-in-the-middle attacker to bypass SSH host-key authentication under specific deployment conditions. The Windows flaw could allow a lower-privileged user to reuse another user's elevated token.

Do this today Upgrade to wolfSSH version 1.6.0

Affected
wolfSSH up to version 1.5.0

CVE
CVE-2026-16516

Read on GBHackers Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.7,"freshness":0.328,"importance":0.75,"novelty":1,"quality":0.65,"total":0.656}
```
React Server Components Vulnerability Affects Next.js Deployments High·CVSS 7.5·GBHackersNewRead A vulnerability in React Server Components allows unauthenticated denial-of-service via crafted HTTP POST requests.
An attacker can exploit a flaw in React Server Components using specially crafted HTTP POST requests to induce a denial-of-service condition. This occurs due to quadratic processing when reconstructing multipart form data from raw HTTP requests. The vulnerable deserialization process executes before application-level authorization checks.

Why it matters. Exploitation can cause excessive CPU workload, potentially stalling or timing out other requests on the event loop. This risk exists even if the Server Action endpoint is only accessible from a public page.

Do this today Upgrade React Server Components dependencies to React 19.0.6, 19.1.7, or 19.2.6 and redeploy applications.

Affected
React 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, 19.2.0 through 19.2.5

CVE
CVE-2026-23870

Read on GBHackers Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.4,"freshness":0.66,"importance":0.75,"novelty":1,"quality":0.65,"total":0.614}
```
Nvidia DCGM Exporter Vulnerability Allows Unauthenticated DoS High·CVSS 8.2·The RegisterDay 2NewRead Exposed Nvidia DCGM Exporter instances allow unauthenticated resource exhaustion, potentially crashing GPU monitoring and disrupting AI workloads.
A vulnerability in Nvidia's DCGM Exporter allows unauthenticated resource exhaustion via the monitoring service. This flaw could cause the monitoring service to crash, thereby disrupting AI workloads running on the host. Nvidia released a fix for this flaw.

Why it matters. Exposure provides attackers with detailed reconnaissance data about GPU infrastructure and the capability to disrupt AI workloads remotely. Operators should restrict these monitoring services from public internet access.

Do this today Upgrade Nvidia DCGM Exporter to version 4.8.2 or later.

Affected
Nvidia DCGM Exporter

CVE
CVE-2026-47483
1. Fri 9 OctNvidia DCGM Exporter Vulnerability Allows Resource Exhaustion
2. TodayNvidia DCGM Exporter Vulnerability Allows Unauthenticated DoS
Read on The Register Post on X LinkedIn

Also covered by CSO Online, r/netsec
```
{"coverage":0.613,"evidence":0.4,"freshness":0.399,"importance":0.75,"novelty":0.6,"quality":0.85,"total":0.602}
```

Worth watching

Malware analysis Has AI Solved Reverse Engineering? Low Level · 9 Oct

Malware & Ransomware 3

Credential Theft via Malicious GitHub Actions Workflows High·The Hacker NewsNewRead Malicious workflows were pushed to numerous repositories using compromised open-source maintainer accounts.
Researchers disclosed a credential-theft campaign that compromised high-profile open-source maintainer accounts. Attackers used these accounts to push malicious workflows into over 340 repositories.

Why it matters. These workflows are designed to steal credentials from compromised repositories.

Do this today Audit GitHub Actions workflows in critical repositories for unauthorized additions.

Affected
Repositories using compromised maintainer accounts

Read on The Hacker News Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.798,"importance":0.75,"novelty":1,"quality":0.8,"total":0.543}
```
P7 DarkSword iOS Exploit Kit Steals Crypto Data and Enables Remote Commands High·The Hacker NewsNewRead Researchers detailed P7 DarkSword, an iOS exploit kit variant capable of stealing crypto wallet data and establishing remote command and control.
Researchers disclosed P7 DarkSword, an iOS exploit kit variant. This kit reduces its on-device footprint and adds functionality for on-device keychain and crypto-wallet theft. It also includes two-way command and control communication.

Why it matters. Defenders should assess exposure to sophisticated iOS exploitation techniques targeting sensitive data like cryptocurrency wallets.

Affected
iOS devices

Read on The Hacker News Post on X LinkedIn

Also covered by GBHackers
```
{"coverage":0.613,"evidence":0,"freshness":0.328,"importance":0.75,"novelty":1,"quality":0.8,"total":0.53}
```
Hackers Trojanize Terraform Provider for Cross-Platform Malware Deployment High·GBHackersNewRead Malware was deployed via a trojanized Terraform provider to steal credentials and establish remote control.
A campaign utilized a trojanized Terraform provider to deploy cross-platform malware targeting developer environments. The implant executes after Terraform starts the plugin, downloading and executing payloads disguised as font files. The malware establishes persistence and collects credentials from various sources.

Why it matters. This technique compromises the software supply chain, allowing initial access and credential theft within developer workflows. Defenders must assume developer workstations are compromised until proven otherwise.

Do this today Restrict untrusted providers and verify checksums against trusted sources.

Affected
Terraform providers

Read on GBHackers Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.598,"importance":0.75,"novelty":1,"quality":0.65,"total":0.508}
```

Threat Actors & Campaigns 2

FBI Reports Arrest of Suspected ShinyHunters Co-conspirator Medium·3 outlets·The RecordNewRead The FBI announced the arrest of another individual suspected of being part of the ShinyHunters group.
The FBI Director stated that agents arrested another suspected co-conspirator of the ShinyHunters group. This follows previous arrests of other alleged members, including an individual in Jordan. The group previously breached the FBI's jobs portal.

Why it matters. The incident confirms the group's capability to exfiltrate sensitive data from federal systems. Defenders should remain aware of threat actors targeting government infrastructure.

Read on The Record Post on X LinkedIn

Also covered by BleepingComputer, The Hacker News
```
{"coverage":0.774,"evidence":0,"freshness":0.723,"importance":0.5,"novelty":1,"quality":0.95,"total":0.533}
```
China-based Cybersecurity Company Enables Threat Actors Against Critical Infrastructure High·CISANewRead Partners warn a China-based company is enabling threat actors to target multiple critical infrastructure sectors.
CISA, FBI, NSA, and international partners issued warnings regarding a China-based cybersecurity company. This company reportedly enables threat actors to target various critical infrastructure sectors globally.

Why it matters. Defenders should assess exposure to threat actors utilizing tools or services associated with this identified company.

Read on CISA Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.335,"importance":0.75,"novelty":1,"quality":0.9,"total":0.507}
```

Breaches & Incidents 1

Oracle Health Data Breach Involves Nearly 20 Million Records High·SecurityWeekNewRead A cyberattack on Oracle Health's legacy Cerner systems compromised personal and medical data for nearly 20 million individuals.
Unauthorized access occurred to a legacy Cerner server not migrated to the Oracle Cloud. Evidence suggests the attacker used stolen customer credentials to copy data to a remote server.

Why it matters. The breach involves sensitive data including names, Social Security numbers, diagnoses, and test results. This represents one of the largest reported US healthcare data breaches.

Affected
Oracle Health Cerner systems

Read on SecurityWeek Post on X LinkedIn
```
{"coverage":0.387,"evidence":0,"freshness":0.303,"importance":0.75,"novelty":1,"quality":0.9,"total":0.503}
```

Tools & Releases 1

BigDiskBuster PoC Creates Silent Detection Gap in Microsoft Defender Info·PoC public·Dark ReadingNewRead A proof-of-concept technique creates a silent gap in Microsoft Defender's virus detection capability.
The BigDiskBuster proof-of-concept technique allows for a silent virus detection gap to exist while the service runs normally. This technique does not require an exploit to function.

Why it matters. Defenders should be aware of techniques that can create blind spots in endpoint detection and response coverage.

Read on Dark Reading Post on X LinkedIn
```
{"coverage":0.387,"evidence":0.5,"freshness":0.101,"importance":0.5,"novelty":1,"quality":0.85,"total":0.528}
```

CVE spotlight

CVE	Affects	CVSS	EPSS	Status
CVE-2015-3306	ProFTPDThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.	10.0	98%	Exploited (KEV)CISA due 11 Oct
CVE-2016-3081	Apache StrutsApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker…	8.1	95%	Exploited (KEV)CISA due 11 Oct
CVE-2015-5477	ISC BINDnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion fa…	7.5	92%	Exploited (KEV)CISA due 11 Oct
CVE-2021-3199	ONLYOFFICE DocsDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. …	9.8	15%	Exploited (KEV)CISA due 11 Oct
CVE-2023-22894	StrapiStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. Th…	4.9	3%	Exploited (KEV)CISA due 11 Oct
CVE-2026-81578	PaperCut NG/MFAn improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, u…	9.8	86%	Exploited (KEV)CISA due 14 Sep (passed)

Quiz

Yesterday's answer

According to the report, what specific methods are Chinese cyber threat actors using to target global organizations?

Supply chain compromise via third-party vendors

The story explicitly states that the actors are targeting organizations by exploiting vulnerabilities via cross-site scripting and password spraying on Microsoft Exchange servers.

Today's question

According to the security advisory, what specific component is affected by the SSRF vulnerability (CVE-2026-102255)??

On the radar tomorrow

KEV deadline tomorrowCVE-2015-3306 · ProFTPD
KEV deadline tomorrowCVE-2015-5477 · ISC BIND
Patch Tuesday in 3 daysTuesday 13 October
CTF starts Sat 04:30 UTCCryovault 2026 Quals
WatchingAnthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
WatchingHackers hijack Google domains after breaching ccTLD registries

Also worth your time

Exploits

Teltonika_RutOS 00.07.06.21 - command injectionRemote
TigerGraph_Community_Edition 4.2.4 - arbitrary file writeWebApps
WordPress 7.0.2 - Path TravesalWebApps
Food-Ordering 1.0 - LFIWebApps
Ecava_ntegraXor IGX_16.0.701.10 - RCERemote

Tools

morluto/rea★ 49653 · TypeScriptReverse engineer anything with agents, from app behavior down to native binaries.
promptfoo/promptfoo★ 25855 · TypeScriptTest your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, C…
maurosoria/dirsearch★ 14937 · PythonWeb path scanner
google/oss-fuzz★ 12711 · ShellOSS-Fuzz - continuous fuzzing for open source software.
BishopFox/sliver★ 12007 · GoAdversary Emulation Framework
openai/codex-security★ 11049 · TypeScriptOpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https:…

Community

Podcasts

180: ContiDarknet Diaries · 59:17
Soap Box: HD Moore talks OT security, frontier fearmongering and moreRisky Business · 34:01
SN 1099: An Alien Mind - From RSA Weakness to Agentic AttacksSecurity Now · 3:03:15
SANS Stormcast Friday, October 9th, 2026: AI Agent Forensics; AI-Assisted Attack on South Korean Banks; IDN Typosquatting; Cisco Finesse SSRF (CVE-2026-20362)SANS Internet Storm Center · 6:14

That's today's brief.

The next brief lands at 06:30 IST.

Saturday, 10 October 2026