A CVSS 10.0 pre-authentication SSRF in SonicWall SMA 1000 SSL VPN gateways was exploited at least 135 times within days of disclosure. The same week, a ransomware response executive was arrested in the ShinyHunters investigation, and a threat actor demonstrated that commercial AI coding tools can orchestrate multi-target breach campaigns at scale. Three stories, three different threat vectors - all pointing at the same operational reality: the attack surface is expanding faster than most defenders can contract it.

In the News

SonicWall SMA 1000 CVSS 10 Flaw Exploited 135+ Times in Days

CVE-2026-102255 is a pre-authentication server-side request forgery (SSRF) vulnerability in SonicWall SMA 1000 series SSL VPN gateways. It carries a CVSS score of 10.0 - the maximum possible severity. The flaw requires no credentials, no user interaction, and no prior access. The attack surface is the internet-facing login endpoint itself.

Exploitation began within days of SonicWall publishing the patch. At least 135 exploitation attempts were confirmed across internet-facing appliances before most organizations had completed their patch cycles. The speed of exploitation underscores a pattern that has defined 2025 and 2026: threat actors are monitoring vendor advisories in near real-time and weaponizing disclosed vulnerabilities within hours, not weeks.

The SMA 1000 is a network-edge appliance specifically designed for remote access - it sits at the boundary between the internet and internal infrastructure. A pre-auth SSRF at this location gives an attacker the ability to pivot into internal networks without ever needing a valid credential. For organizations that still rely on traditional SSL VPN concentrators as their primary remote access mechanism, this is not a patching problem - it is an architectural exposure.

What defenders should do: Patch to SMA 1000 firmware 12.4.3-02854 immediately. If patching is not possible within 24 hours, remove the appliance from internet exposure. Long-term, evaluate SSE/ZTNA architectures that eliminate the internet-facing VPN concentrator entirely - the vulnerability class (pre-auth RCE/SSRF on network-edge devices) recurs across vendors every quarter.

ShinyHunters Probe Leads to Arrest of Ransomware Response Executive

Edward Dubrovsky, a Canadian cybersecurity executive who specialized in ransomware incident response, was arrested at a US conference in connection with the FBI’s investigation into the ShinyHunters threat group. The arrest places a ransomware response professional inside the extortion ecosystem they were ostensibly hired to combat.

The implications for the industry extend beyond one arrest. Third-party incident response contractors are granted extraordinary access during engagements - domain admin credentials, forensic images, negotiation communications, insurance policy limits. If any participant in that chain is compromised or complicit, the blast radius is not limited to a single victim. It encompasses every engagement that individual touched.

What defenders should do: This is an insider risk and third-party vetting story. Organizations should enforce least-privilege access for all contractors, including IR consultants. Session recording, privileged access management, and network segmentation that restricts contractor access to only the systems under investigation are compensating controls. Zero-trust principles apply to trusted insiders - especially when those insiders are brought in during a crisis.

CyberXero Uses Claude Code to Orchestrate 628K-Record Ukrainian Breach

The CyberXero threat actor used Anthropic’s Claude Code - a commercial AI coding assistant - as the orchestration layer for a multi-target breach campaign against Ukrainian organizations. Targets included WordPress deployments, e-commerce platforms, and critical infrastructure. The campaign combined Cobalt Strike beacons with AI-driven reconnaissance and exploitation scripting, resulting in 628,000 records exfiltrated.

This is the first publicly documented campaign where a commercial AI coding tool served as the operational backbone of a coordinated, multi-target intrusion. The distinction matters: previous AI-assisted attacks involved AI for phishing content generation or social engineering. CyberXero used AI for tactical automation - scanning, vulnerability identification, payload generation, and lateral movement scripting. The AI was not writing the phishing email; it was writing the exploit chain.

The operational implication is speed. Manual reconnaissance and exploitation against hundreds of targets requires weeks and a large team. AI orchestration compresses that to days with a small team. Defenders relying on manual SOC triage processes are now operating at a structural speed disadvantage against AI-augmented adversaries.

What defenders should do: Invest in automated detection and response capabilities that match the speed of AI-orchestrated attacks. Monitor for Cobalt Strike beacon indicators across endpoint and network telemetry. For organizations with WordPress or public-facing web infrastructure, audit plugin versions (see CVE-2026-85097 below) and deploy web application firewalls with updated rulesets. MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1059.001 (PowerShell), T1071.001 (Web Protocols for C2).

Defender Action Items

  • CVE-2026-102255 - SonicWall SMA 1000: Patch to firmware 12.4.3-02854 or remove from internet exposure within 24 hours. Scan for indicators of compromise on any SMA 1000 appliance that was internet-facing before the patch.
  • CVE-2026-85097 - Bricksforge WordPress Plugin: Update immediately or deactivate the plugin. Audit affected WordPress instances for web shells - unauthenticated PHP upload means any exposed instance should be treated as potentially compromised.
  • Third-party contractor access: Review privileged access granted to IR consultants and contractors. Implement session recording and network segmentation for all contractor engagements.
  • Cobalt Strike detection: Ensure EDR and network monitoring are tuned for Cobalt Strike beacon traffic patterns, including malleable C2 profiles. The CyberXero campaign used standard Cobalt Strike payloads - these are detectable with current signature sets.

Detection Queries

Cobalt Strike default named pipe detection - a high-fidelity indicator for default Cobalt Strike beacon configurations. This catches the most common deployment pattern, though sophisticated operators customize pipe names.

index=sysmon EventCode=17 PipeName IN ("\\MSSE-*", "\\postex_*", "\\status_*", "\\msagent_*", "\\postex_ssh_*")
| stats count by host, PipeName, Image
| where count > 0

SonicWall SMA 1000 SSRF exploitation attempt - monitor web proxy or firewall logs for anomalous requests targeting SMA management endpoints. Adapt the URI pattern to your deployment.

index=proxy OR index=firewall dest_port=443 uri_path="*/cgi-bin/management*" http_method=POST
| stats count by src_ip, dest_ip, uri_path
| where count > 5
| sort -count

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.