A large-scale brute force password attack using almost 2.8 million IP addresses is underway, attempting to guess the credentials for a wide range of networking devices, including those from Palo Alto ...

Storm-2561 distributes trojanised VPN clients impersonating major vendors to steal corporate credentials through manipulated search results.

South Korean VPN provider IPany experienced a supply chain attack by the PlushDaemon hacking group, which compromised its VPN installer and deployed malware affecting customer systems.

TL;DR SonicWall published advisory SNWLID-2026-0016 on September 1, 2026. It confirms active exploitation of two SMA1000 flaws. The headline SonicWall SMA1000 vulnerability, CVE-2026-83548, is a pre-authentication SSRF rated a maximum 10.0 CVSS. A second bug, CVE-2026-83549, adds post-authentication remote code execution. Why It Matters SMA1000 appliances sit at the network edge as enterprise VPN gateways. Therefore, a pre-auth flaw exposes the front door to remote attackers.

Malware family ROOTRUN, KNUCKLEBALL, Suo5, ORANGETAIL Threat actor UTA0533 (pre-disclosure cluster, suspected link to INC Ransomware); INC Ransomware confirmed as current dominant operator Target Internet-facing SonicWall SMA 1000 series VPN appliances Delivery vector Unauthenticated exploitation of CVE-2026-15409 and CVE-2026-15410 Key capabilities Root compromise, memory-resident web shell, credential harvesting, persistence Source Resecurity, with corroboration from Volexity and Rapid7 TL;DR: A SonicWall SMA exploit chain lets an unauthenticated attacker reach root on SMA 1000 VPN appliances.

CVE-2026-0257 reveals the urgent threat ransomware groups pose by exploiting VPN vulnerabilities. Take immediate action to secure your systems.

CVE-2026-0257 has revealed severe flaws in VPNs, enabling major ransomware threats. Understanding these vulnerabilities is critical for defense strategies.

CVE-2026-0257 shows ransomware exploitation of VPNs is real, but evidence on impact and extent remains fuzzy for cybersecurity professionals to decipher.

The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) has designated two individuals and a VPN service provider for enabling ransomware actors' and other cybercriminals' malicious activities, including ransomware attacks against Americans. The VPN, named First VPN Service (1VPNS), has been accused of offering its tools to ransomware groups, along with its 45-year-old Ukrainian