Today's cybersecurity news highlights several critical vulnerabilities being actively exploited, alongside significant law enforcement actions against long-standing botnets. We also see continued developments in AI security, both as a tool for defenders and a potential risk.
Two SonicWall SMA 1000 Zero-Days Under Active ExploitationVulnerability
SonicWall has issued an urgent warning about two newly discovered zero-day vulnerabilities (CVE-2026-83548 and CVE-2026-83549) affecting its Secure Mobile Access (SMA) 1000 series VPN appliances. These flaws can be chained together to achieve unauthenticated remote code execution and are currently being exploited by attackers.
Why it matters: If your business uses SonicWall SMA 1000 series VPN appliances, you must apply the latest security updates immediately to prevent unauthorized access and potential compromise of your network.
Read more at The Hacker News ↗
Critical Sangoma Switchvox Flaw Exploited for Remote ShellsVulnerability
Threat actors are actively leveraging a critical SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox SMB Edition. This flaw allows attackers to execute arbitrary code remotely without authentication, enabling them to deploy reverse shells and potentially take full control.
Why it matters: Businesses using Sangoma Switchvox should immediately patch their systems to prevent unauthenticated remote code execution and maintain control over their VoIP infrastructure.
Read more at The Hacker News ↗
Malicious Virtualizor Update Delivered via BGP HijackThreat
Hackers utilized a Border Gateway Protocol (BGP) hijack to reroute Softaculous traffic, subsequently serving a malicious Virtualizor update package. This sophisticated attack led to root-level compromise on some Virtualizor hypervisors, establishing persistent access for the attackers.
Why it matters: Even routine software updates can be weaponized; verify the authenticity of all updates and maintain strict network segmentation for critical hosting infrastructure to mitigate such supply chain attacks.
Read more at The Hacker News ↗
GeoNetwork Vulnerabilities Allow Unauthenticated RCEVulnerability
Two security flaws in GeoNetwork, an open-source geospatial metadata catalog used by government and agency geoportals, can be chained together to achieve unauthenticated remote code execution (RCE). Patches were released in July, with details made public in late August.
Why it matters: If your website or organization uses GeoNetwork, update to versions 4.4.12 or 4.2.17 (or newer) immediately to close this critical remote code execution vector.
Read more at The Hacker News ↗
Sality Botnet Infrastructure Dismantled After 23 YearsThreat
International law enforcement, including authorities from the U.S., Bulgaria, Hungary, and Romania, collaborated with private sector partners to disrupt the notorious Sality peer-to-peer botnet. The operation involved turning the botnet's own infrastructure against itself to cut off infected machines from command and control.
Why it matters: While a major threat has been significantly curtailed, remaining Sality infections on client systems still pose a risk; regularly scan and clean your systems to ensure they are free of dormant malware.
Read more at The Hacker News ↗
Russian Hacker Indicted for Excel Malware CampaignThreat
A Russian national has been extradited to the U.S. and charged with orchestrating a malware campaign that infected approximately 80,000 freelancers between 2016 and 2017. The scheme involved using around 255 fake accounts on a freelance platform to distribute malicious Excel attachments.
Why it matters: This highlights the persistent threat of phishing via seemingly legitimate platforms; always be wary of unexpected attachments, even from known services, and verify sender identity.
Read more at The Hacker News ↗
Fake Software Installers Disable Windows Update, Weaken DefenderThreat
A widespread malware campaign is utilizing fake software download websites to impersonate legitimate vendors and distribute malicious installers. These installers are designed to disable Windows Update and impair Microsoft Defender, leaving affected systems highly vulnerable.
Why it matters: Always download software directly from official vendor websites, not third-party download sites, and regularly verify that your security software and operating system updates are functioning correctly.
Read more at The Hacker News ↗
Malicious Apache Modules Hijack Brazilian Government SitesThreat
A cybercrime group, 'Gambling Goblin,' has been observed installing malicious Apache modules on web servers belonging to Brazilian government and educational institutions. These modules redirect legitimate website visitors to attacker-controlled pages promoting online gambling.
Why it matters: Regularly audit your web server configurations and logs for unauthorized modifications, especially for Apache modules, to prevent traffic redirection and maintain trust in your website.
Read more at The Hacker News ↗
Dropbox Accounts Breached via Lenovo Email Verification FlawBreach
Dropbox has notified some users about unauthorized access to their accounts. The breach occurred due to a vulnerability in Lenovo's email verification process, which allowed attackers to create fraudulent Lenovo IDs and subsequently gain access to linked Dropbox accounts.
Why it matters: Ensure you use strong, unique passwords for every online service and enable multi-factor authentication (MFA) on all critical accounts, especially those linked to other services, to prevent cascading breaches.
Read more at BleepingComputer ↗
AI Models in Cybersecurity: New Tools and VulnerabilitiesOther
Major AI developers like Google, Anthropic, and OpenAI are introducing advanced AI models and safeguards for cybersecurity. Google launched Gemini 3.8 Flash Cyber, and OpenAI's Astra has demonstrated the ability to find and exploit zero-day vulnerabilities, highlighting both the promise and potential risks of AI in security.
Why it matters: As AI becomes more integrated into security tools, businesses should understand its capabilities and limitations. While AI can enhance defenses, it also presents new attack vectors, such as malicious .git configs that can exploit AI coding agents.
Read more at The Hacker News ↗
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.