Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

thehackernews.com Oct 12, 2026

Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

Curated by Shubham · TechCapsules · Oct 12, 2026

AI-summarised brief · reviewed before publication

Threat actors began exploiting a critical pre‑authenticated SSRF flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of its public disclosure. The vulnerability, CVE‑2026‑102255, carries a CVSS score of 10.0 and allows remote attackers to force the appliance to issue arbitrary internal requests, potentially compromising internal services and extracting credentials. SonicWall issued patches on October 6, 2026 (versions 12.4.3‑03670 and 12.5.0‑03082), but exploitation was detected by Defused Cyber and Previdian on October 8, with 135 attempts traced to two U.S. IP addresses. This is the latest in a series of high‑severity flaws targeting the SMA 1000, following June zero‑day attacks that enabled credential theft, MFA seed harvesting, and lateral movement into corporate networks.

💡 Why It Matters

· The rapid weaponisation of a flawless‑rated SSRF demonstrates that even patched devices can be compromised almost immediately, forcing organizations to reassess patch‑to‑protect timelines and monitoring of legacy security appliances.

Capsules Cybersecurity

Read full article on thehackernews.com

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Cybersecurity researchers have uncovered a dual‑track AI‑enhanced intrusion campaign run by a Russian‑speaking broker known as CyberXero. The group combines off‑the‑shelf tools such as Cobalt Strike with Anthropic’s Claude Code to automate attacks on vulnerable WordPress and e‑commerce sites while manually targeting Ukrainian energy and critical‑infrastructure operators. Exploiting flaws like CVE‑2026‑63030, CVE‑2026‑60137 and a SQL‑injection bug in the Support Board plugin, the automated pipeline scanned 4,708 sites, seized 429 admin panels and deployed 32 web shells within a minute. The focused pipeline breached four Ukrainian entities, exfiltrating over 628,000 personal records, and also compromised assets in Poland, China and the Netherlands. Open‑directory leaks revealed AI session logs, plaintext tokens and toolkits, confirming the operation remains active.

💡 By integrating generative AI to bypass model safeguards, CyberXero demonstrates a scalable method for cyber‑criminals to accelerate large‑scale data theft while retaining the ability to conduct precision attacks on critical infrastructure.

gamesradar.com · Oct 12

As Gears of War: E-Day servers suffer DDoS attack, the devs are…

The Coalition confirmed that Gears of War: E‑Day’s online services suffered distributed denial‑of‑service attacks on October 12, causing intermittent disconnects, login failures and other disruptions for players worldwide. The developer posted on Twitter that the attacks began earlier in the day and that technical teams are actively mitigating the traffic and monitoring the situation. Normal multiplayer functionality is expected to return soon, though some users reported hours of instability. The incident comes just days after the game’s launch on October 6, interrupting the transition of many players from single‑player campaign to multiplayer modes. The studio thanked the community for patience while it works to firewall the attackers. The outage highlights the vulnerability of launched live‑service titles to coordinated cyber threats.

💡 A fresh‑release title being knocked offline underscores how quickly cyber attacks can derail player engagement during critical launch windows.

thehackernews.com · Oct 12

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

Patchstack reported active exploitation of a CVSS 10.0 vulnerability in the Bricksforge WordPress plugin (CVE‑2026‑85097). The flaw, present in versions through 3.1.8.9, lets unauthenticated attackers upload a GIF/PHP polyglot, then manipulate the ‘temporaryFileUploads’ URL field to execute arbitrary PHP code via the plugin’s form‑submission endpoints. Exploits were first seen on Oct. 7, 2026, targeting the REST API (/wp‑json/bricksforge/v1/form_submit) and admin‑ajax.php actions, using varied PHP extensions and encodings to bypass filters. Patchstack observed 63 source IPs, with automated patterns suggesting rotating proxies. Bricksforge released a fix in version 3.1.8.10, and users are urged to upgrade to 4.0.1 and monitor the affected endpoints for suspicious activity. Security researchers noted that sites could be used to host web shells, steal credentials, and launch attacks visitors.

💡 The exploit turns a popular visual‑builder plugin into a remote‑code gun, giving attackers immediate server control on thousands of WordPress sites.

eurogamer.net · Oct 12

Gears of War: E-Day server crashes and login problems are because of…

Microsoft’s studio confirmed that the launch of Gears of War: E‑Day was disrupted by distributed denial‑of‑service attacks that overloaded the game’s online infrastructure. Players reported intermittent disconnects, prolonged login queues and full server outages that prevented access to both multiplayer and the single‑player campaign. The Gears of War community account on X posted an explanation, noting the attacks and promising ongoing mitigation, while Xbox’s official channel later announced that services had returned to normal and provided a link for support updates. The issue surfaced shortly after the game’s release and followed similar DDoS incidents earlier this year affecting titles such as Arc Raiders, The Finals and Final Fantasy XIV. Developers continue to monitor the situation throughout the weekend for now.

💡 The attack underscores the growing vulnerability of high‑profile game launches to coordinated cyber assaults, forcing publishers to allocate resources to real‑time defense rather than content.

newsbreak.com · Oct 11

💻 Fairfax, VA IT Hiring Now: Multiple Cyber & ERP Leadership Roles

Fairfax, Virginia’s technology sector is experiencing a hiring surge, particularly in cybersecurity and higher‑education systems. The Fairfax County Government’s Community Services Board seeks an Information Security and Access Control Analyst I to coordinate agency‑wide security, manage access to electronic health records, and serve as a first‑tier helpdesk for HIPAA‑protected data. Tevora, with offices in Fairfax and Irvine, is recruiting a Managing Director for Compliance Services to lead its Payments, SOC, and Federal Compliance practices, requiring ten or more years of security consulting experience and certifications such as CISSP or CISM. The firm also needs a Senior Director of Cybersecurity Transformation & AI Security to guide multi‑year transformation programs for C‑level executives, demanding at least 12 years of consulting background. George Mason University is hiring a Manager of Banner Central Support to oversee its ERP system, focusing on development, ticket prioritization, and system upgrades. All positions are full‑time, with compensation varying by experience and profit‑share options where noted; applicants should verify current status as listings may change quickly.

💡 The concentration of senior‑level cyber and ERP roles signals Fairfax’s emergence as a regional hub for advanced security and enterprise‑software talent, attracting expertise that could elevate public‑sector and academic digital resilience.

theregister.com · Oct 10

Two characters open up a world of typosquatting opportunities in Chromium browsers

Researchers have identified two Unicode characters—Cyrillic “ө” and Latin “ƙ”—that enable new typosquatting attacks in Chromium‑based browsers such as Chrome and Edge. The glyphs closely resemble the Latin letters “e/o” and “k,” allowing malicious actors to register domains that appear identical to legitimate URLs when rendered in Unicode, while the underlying Punycode reveals a fake address. Ian Muscat and Leanne Briffa of the “Have I Been Squatted” project demonstrated 20 lookalike domains using these characters, bypassing current browser safety checks that rely on visual similarity detection. The findings highlight a gap in how browsers display internationalized domain names, exposing users to phishing sites that can masquerade as popular services without triggering standard warnings.

💡 Attackers can now exploit obscure characters to craft convincing phishing URLs that slip past existing browser defenses, increasing the risk of credential theft.