SonicWall SMA 1000 flaws under active attack
Two vulnerabilities in the remote-access appliance are being exploited. NCSC rates both likelihood and impact high and urges immediate updates plus compromise checks.
CYBERNUKE.NL // EUROPEAN THREAT MONITOR SIGNAL LOCKEDLAST SYNC --:-- CET // AUTO 3H
THE LAST FEED BEFORE THE FIREWALL52.3676° N / 4.9041° E
THREATCON02CRITICAL
FLASH
SONICWALL SMA 1000 FLAWS UNDER ACTIVE ATTACK///153 MILLION DRIVER LICENCE SCANS ALLEGEDLY OFFERED FOR SALE///CRITICAL CITRIX NETSCALER AUTH BYPASS TARGETED IN THE WILD///CHROME V8 ZERO-DAY EXPLOITED BEFORE THE PATCH LANDED///SEALED COURT DATA EXPOSED IN THOMSON REUTERS BREACH
PRIORITY INTERCEPTREF // CN-260904-A1
PATCH NOW
SonicWall SMA 1000 flaws under active attack
Two vulnerabilities in the remote-access appliance are being exploited. NCSC rates both likelihood and impact high and urges immediate updates plus compromise checks.
READ NCSC-NLGLOBAL ACTIVITYDETECTION WINDOW // 24H
EXP18.4K
IDS42.8K
MAL11.3K
BOT37.1K
PHI24.6K
VUL6.9K
VISUAL SIMULATION23:18:04CLUSTER-EU → EDGE-NLEXPLOIT PROBE23:18:07CLUSTER-AP → IDENTITY-EUCREDENTIAL ATTACK
SIMULATED HEAT + ROUTES // VISUAL MODEL // NOT LIVE ATTACK ATTRIBUTION
INCOMING TRANSMISSIONS
THE LIVE WIRE
15 SIGNALS // CONNECTING // SYNC --:--
153 million driver licence scans allegedly offered for sale
The FBI is investigating after a dark-web identity service advertised a vast cache of US and Canadian identity documents reportedly linked to IDScan.
Critical Citrix NetScaler auth bypass targeted in the wild
Sensors recorded attempts matching a public proof of concept for CVE-2026-19490. Exposed ADC and Gateway appliances should be assessed and patched.
Chrome V8 zero-day exploited before the patch landed
Google fixed CVE-2026-85046, a type-confusion flaw in V8 with an exploit already in the wild. Chromium-based browsers require an update and restart.
Sealed court data exposed in Thomson Reuters breach
C-Track files affecting courts across the US and Canada may include sealed information, social security numbers, licence data and medical details.
Coder registry infrastructure pushed credential-stealing modules
Attackers added unauthorised registry servers to Coder infrastructure and served malicious Terraform modules carrying credential-theft code.
“Fire Ant” operators turn Cisco routers into attack platforms
China-linked actors compromised routers to monitor traffic, collect credentials and create durable paths into connected high-value environments.
Sality botnet disrupted after two decades online
US and European authorities used the malware’s peer-to-peer architecture against it, severing thousands of infected machines from operators.
Dropbox accounts breached through Lenovo verification flaw
A legacy identity integration let attackers register fraudulent Lenovo IDs and enter linked Dropbox accounts without the existing password.
A password reset may not evict an infostealer operator
Stolen browser cookies can preserve access after credentials change. Response teams need to revoke sessions, rotate exposed secrets and inspect the infected host.
AI-assisted intruder compressed a multi-week attack into hours
Unit 42 investigated an intrusion where agentic tooling mapped services, harvested secrets and abused pipelines. Human direction remained central, but operational speed increased sharply.
ACR Stealer activity rises across two observed intrusion chains
Microsoft documented two delivery paths used to deploy ACR Stealer and published defensive context for responders tracking credential theft in enterprise environments.
Open-source package compromise grows in volume and impact
Google Threat Intelligence and Mandiant detail recent repository and dependency attacks, plus practical controls for reducing package and build-pipeline exposure.
CERT-EU maps August espionage, cybercrime and supply-chain activity
The monthly TLP:CLEAR brief reviews hundreds of open-source reports, including EU-focused espionage, phishing, infrastructure disruption and dependency compromise.
Sangoma Switchvox SQL injection exploited in the wild
CVE-2026-9586 can allow unauthenticated remote code execution against the enterprise VoIP platform. Exploitation evidence and indicators are now public.
MULTI-SOURCE CORROBORATION
SOURCE ARRAY
12 VERIFIED SOURCES // 11 AUTO-SYNC FEEDS // 3H CACHE
BLAST MAP // FEED MIX
EXPLOITS
27%
BREACHES
13%
MALWARE
20%
DARKWEB
07%
OTHER SIGNALS
33%
SURVIVAL DOCTRINE
- 01
PATCH THE EDGE. Prioritise internet-facing KEVs and remote-access infrastructure.
- 02
KILL THE SESSION. Password resets alone do not revoke stolen browser cookies.
- 03
VERIFY THE SOURCE. Treat third-party identity and build systems as part of your perimeter.
ON WATCH
SMA 1000IMMEDIATE
NETSCALERIMMEDIATE
CHROMIUMMONITOR
SSO TRUSTMONITOR
DEV REGISTRIESHARDEN