☀️ Good morning. Here's everything that happened in cybersecurity yesterday — in under 5 minutes.
Yesterday was a study in borrowed trust. SonicWall shipped emergency hotfixes for two SMA 1000 zero-days already under attack, one of them a perfect CVSS 10.0, while Softaculous reconstructed a 33-hour BGP hijack in which attackers held a technically valid TLS certificate and used it to serve a malicious Virtualizor update that planted persistent root access. Manifold Security disclosed eight flaws across seven command-line AI coding agents, including Claude Code, Codex, and Cursor, where a repository's own Git config names a command the agent runs on the developer's machine without asking. On the other side of the ledger, the DOJ, CrowdStrike, and Shadowserver turned the 23-year-old Sality botnet's peer-to-peer design against itself and cut more than 15,000 machines off from their operator. And a dark web service surfaced selling digital scans of more than 153 million driver's licenses, apparently siphoned from an ID verification vendor, with the FBI now investigating.
🔥 Top Stories
01 — SonicWall Patches Two Actively Exploited SMA 1000 Zero-Days, One Rated CVSS 10.0
Vulnerabilities & Patching
SonicWall disclosed and shipped emergency hotfixes for two vulnerabilities in its SMA 1000 series secure remote access appliances that attackers were already exploiting in the wild. CVE-2026-83548 is a pre-authentication server-side request forgery flaw in the Appliance Work Place interface with a CVSS v3.1 base score of 10.0. Chained with CVE-2026-83549, it produces unauthenticated remote code execution on the appliance. Both were found internally by SonicWall's own researchers, William Perry and Adam Babis, which means the exploitation was discovered before any public proof-of-concept existed.
SMA 1000 boxes sit at the network edge for medium and large enterprises, government agencies, and managed security service providers, so a pre-auth chain here is initial access to everything behind the VPN. Apply the hotfix today, and treat any internet-facing SMA 1000 that was exposed before patching as suspect rather than clean: review authentication logs, rotate appliance credentials and session secrets, and hunt for unexpected outbound connections. One national SOC assesses further attacks as almost certain, and this is the second round of SMA edge zero-days exploited this year.
02 — A 33-Hour BGP Hijack Delivered a Malicious Virtualizor Update With Persistent Root Access
Supply Chain Attack
Softaculous has reconstructed the routing attack that rerouted its update traffic in late August. Beginning around August 28 at 20:57 UTC, attackers used a Border Gateway Protocol hijack to divert traffic destined for Softaculous infrastructure, then presented a technically valid TLS certificate for Softaculous domains. Update clients saw a correctly signed connection to the right hostname and installed a malicious Virtualizor package that established persistent root access on the host. One hosting provider reported that 5 of the 34 Virtualizor hypervisors it checked sustained root-level compromise.
The uncomfortable part is that nothing in the victim's stack malfunctioned. TLS validated, the vendor was real, the update path was the official one; the attacker simply owned the route and obtained a certificate for it. If you installed or updated Virtualizor during the hijack window, assume root compromise and rebuild the host rather than attempting cleanup, then rotate every credential, API key, and SSH key that hypervisor could reach. Longer term, this is the argument for RPKI route origin validation and for pinning update integrity to something that does not inherit its trust from routing.
03 — Malicious .git Configs Can Make Claude Code, Codex, and Cursor Run Attacker Code
Artificial Intelligence (AI)
Manifold Security disclosed eight security flaws across seven command-line AI coding agents, among them Claude Code, Codex, and Cursor. In each case a repository's own Git configuration names a command that the agent invokes automatically as part of normal operation. The command executes as the developer's user, outside the agent's sandbox, and without an approval prompt. Exploitation requires only that the repository reach the developer's machine, which is to say a clone. Four of the eight were still unpatched at publication.
This collapses the distance between reading code and running it. The mental model most developers carry, that inspecting an untrusted repo is safe until you choose to build it, does not hold when an agent is doing the inspecting. Update every CLI coding agent to its latest release, and until the remaining four are fixed, do not point an agent at a repository you did not vet, especially not a fork, a pull request branch, or anything from a public search result. Where the work requires untrusted code, run the agent inside a container or disposable VM with no credentials mounted.
04 — DOJ and CrowdStrike Disrupt Sality by Poisoning the Botnet's Own Peer List
Law Enforcement
On August 31, authorities from the United States, Bulgaria, Hungary, and Romania, working with CrowdStrike and the Shadowserver Foundation, executed a takedown of Sality, a peer-to-peer botnet that first appeared in 2003 as a file-infecting virus. Rather than seizing command servers, which Sality's decentralized design made impractical, the operation injected sinkhole entries into the botnet's own peer lists and took down its payload URLs. The result cut more than 15,000 infected machines worldwide off from their operator after a 23-year run.
Read this as a defensive template, not just a scoreboard entry: the resilience mechanism that made Sality durable, its trust in peer-supplied node lists, was the same property that let defenders redirect the whole network. But a disruption is not a disinfection. Every one of those Windows hosts is still infected and still running a file infector that spreads through executables and removable media. If you receive a Shadowserver notification for your address space, treat it as a live incident: isolate, scan for infected binaries, and rebuild the machines that have been carrying this for years.
05 — FBI Investigates Dark Web Service Selling 153 Million Driver's License Scans
Data Breach & Identity
A new identity theft service that launched on the dark web this week advertised digital scans of more than 153 million driver's licenses belonging to people in the United States and Canada. Based on interviews with individuals whose licenses appeared for sale, the images appear to have been siphoned from a widely used identity verification company based in Louisiana. The New Orleans field office of the FBI opened an official inquiry into the source of the images, and the crime site has since gone offline.
Identity documents are the worst possible category of stolen data because they cannot be rotated. A leaked password is a Tuesday; a leaked license photo is a permanent bypass credential for every service that treats a document upload plus a selfie as proof of personhood. If your organization relies on a third-party ID verification vendor, ask now what images it retains, for how long, and whether liveness checks would catch a replayed scan. Individually, a credit freeze remains the single most effective response.
📊 By The Numbers
10.0 — CVSS base score for CVE-2026-83548, the pre-auth SSRF in SonicWall's SMA 1000 Appliance Work Place interface, chainable to unauthenticated RCE.
33 hours — length of the BGP hijack window during which Softaculous update traffic was diverted and a malicious Virtualizor package was served.
8 flaws across 7 agents — Manifold Security's disclosure covering command-line AI coding agents, with four still unpatched at publication.
15,000+ — infected machines cut off from Sality's operator when authorities poisoned the botnet's peer lists on August 31.
153 million — driver's license scans from the US and Canada offered by the dark web identity service now under FBI investigation.
⚡ The Signal
Every significant story yesterday was an attack on a trust anchor rather than on a control. The SonicWall chain turned the VPN appliance, the device organizations buy specifically to be the trusted boundary, into the way in. The Virtualizor incident produced a valid TLS handshake to the correct hostname from the legitimate vendor's update path, and still ended in root. The coding agent flaws weaponized the developer's most trusted local artifact, a Git repository, against the tool the developer trusts to read it. And the 153 million license scans are the raw material of the identity verification layer that everything else now defers to when it wants to know a human is real.
None of these required defeating cryptography, and none required a novel exploit primitive. They required finding the layer where verification quietly stops. TLS proves you reached the name in the certificate; it does not prove BGP delivered you to the right machine, and it turns out an attacker who controls the route can get a certificate that says otherwise. An AI agent's sandbox constrains what the model asks to run; it does not constrain what the surrounding tooling runs on the model's behalf. A vendor's ID check proves a document image was uploaded; it does not prove the person uploading it is the person in the photo.
The Sality takedown is the same insight pointed the other way, and it is worth sitting with. Sality survived 23 years because its peers trusted each other's node lists instead of depending on a central server. Defenders won by supplying that trusted channel with sinkhole entries. Same structural weakness, opposite beneficiary. The lesson is not that peer-to-peer is fragile; it is that every system has a layer it accepts without checking, and whoever finds it first sets the terms.
The practical takeaway for defenders is unglamorous: inventory where your assurances actually come from. Which of your update paths inherit their integrity from routing? Which of your developer tools execute repository-supplied configuration? Which of your identity decisions rest on a document image a vendor holds and you have never seen? Those are the answers yesterday's attackers already had.
🔍 What You May Have Missed
Health Data of More Than 9.5 Million People Leaked From Aesto Record System — The healthcare data company notified federal regulators this week that sensitive information on over 9.5 million people was exposed in a December cyberattack, a nine-month gap between incident and disclosure that will draw regulatory attention.
Nearly 22,000 Microsoft Exchange Servers Remain Exposed to CVE-2026-62911 — Shadowserver's daily scans still find roughly 22,000 unpatched servers against a critical authentication bypass Microsoft fixed on August 11, with the US (6,200) and Germany (5,100) leading the count.
Chinese-Speaking Crew Turns Brazilian Government Sites Into SEO Weapons — Check Point tracked Gambling Goblin installing malicious Apache modules on Brazilian government and educational web servers since mid-2025 to divert visitors to betting pages, a reminder that web server modules are a persistence layer most teams never audit.
📅 What to Watch
Windows Memory Integrity Switches On Automatically in October 2026 — Starting next month, Windows quality updates will enable memory integrity, and Virtualization-based Security where it is not already running, on eligible devices with little or no configuration. Test driver compatibility in your fleet now rather than in October.
Active Exploitation of Sangoma Switchvox CVE-2026-9586 Is Underway — A critical unauthenticated SQL injection in Switchvox SMB Edition 8.3, CVSS 9.3, is being used to deploy reverse shells without credentials. Internet-exposed VoIP instances should be patched and checked for compromise immediately.
UK Moves to Block High-Risk Tech Suppliers From Critical Infrastructure — Late amendments to the Cyber Security and Resilience Bill would give ministers power to restrict specific technology providers. Watch whether the final text names criteria or leaves designation to ministerial discretion, and note that the bill's AI provisions target users rather than model vendors.
OpenAI's Astra Crosses a 'Critical' Cyber Capability Threshold — The designation applies when a model can independently find and exploit zero-days across many well-defended systems, and it landed the same week Google announced Gemini 3.8 Flash Cyber and a gated early access program for defenders. Expect the access-control question, who gets the capable models first, to dominate the next quarter.
Stay sharp. Stay ahead.
Till next time,
The CyberSignal Team