🔴 SonicWall SMA1000 CVSS 10.0 zero-days actively exploited, ⚖️ Sality botnet dismantled after23 years, 🏭 HPE Fabric Composer dual critical flaws, 🌐 Chrome patches26 vulns incl. critical UAFs, 🤖 Hugging Face Transformers RCE before consent, 💰 Exodus wallet trojan deploys RAT proxy

SonicWall issued an emergency advisory for two zero-day vulnerabilities in SMA1000 appliances being actively chained in remote code execution attacks. CVE-2026-83548 is a CVSS 10.0 command injection flaw in the Appliance WorkPlace interface stemming from SSRF, while CVE-2026-83549 is a command injection in the Appliance Management Console requiring admin privileges. Both are confirmed exploited in the wild and have been added to CISA's KEV catalog. The vulnerabilities affect SMA1000 models 6210, 7210, and 8200v, with over400 appliances currently exposed online according to Shadowserver. SonicWall is urging immediate upgrades to the hotfix release, re-imaging of appliances, password resets, and TOTP token revocation. This is the highest-priority remediation target in today's landscape.

An international law enforcement operation has dismantled infrastructure belonging to the Sality P2P botnet, which had been active since at least 2003. The U.S. DOJ, FBI, and DCIS seized Sality-linked domains in the United States, while partners in Bulgaria, Hungary, and Romania took down European-hosted servers. CrowdStrike executed a P2P sinkhole isolating infected machines from control channels, and Europol confirmed the operation targeted a network linked to over 11 million infected IP addresses across its lifespan. At the time of disruption, two active Sality sub-networks were pushing EggJagger malware through clipjacking attacks, and approximately 15,000 active devices remained infected. CrowdStrike tracks the operator as SALTY SPIDER, believed to be based in Russia's Republic of Bashkortostan.

HPE Networking patched52 vulnerabilities in Fabric Composer versions 7.3.3 and earlier, two of which scored CVSS 10.0. CVE-2026-76658 in the SSH daemon lets an unauthenticated remote attacker execute arbitrary commands as a privileged OS user, achieving full host compromise. CVE-2026-76657 grants unauthenticated admin access to the Fabric Composer interface. Both require no authentication and no user interaction. Fabric Composer is a network automation and management platform used in data center environments, so full compromise gives an attacker the ability to reconfigure network fabric, intercept management traffic, and pivot into broader infrastructure.

Google shipped Chrome Stable Channel updates to version 152.0.7977.75, patching 26 security vulnerabilities. Two critical use-after-free bugs stand out: CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL. Eleven additional flaws received high-severity ratings, including use-after-free bugs in the Proxy, Browser, and Dawn components, an uninitialized resource issue in the V8 JavaScript engine, and a GPU buffer overflow. The breadth of memory-safety issues across different Chrome subsystems in a single release is notable.

CVE-2026-80047 is a vulnerability in Hugging Face Transformers versions 4.49.0 through 5.8.1 that allows attacker-controlled Python code to be written to disk before the user approves remote code execution. The flaw affects the GenerativePreTrainedModel.load_custom_generate() workflow, which fetches custom generation logic from model repositories. Transformers downloads the file and copies it into the local cache at ~/.cache/huggingface/modules before the trust_remote_code consent prompt is evaluated. An attacker who controls a model repository can plant a malicious generate.py that lands on the victim's filesystem before any approval check occurs. CERT/CC documented this as VU#456290. If any automated process or IDE reads from the Hugging Face module cache, the planted code could execute without the user ever seeing the trust prompt.

A trojanized installer masquerading as the Exodus cryptocurrency wallet is deploying a modular RAT across Windows systems. Huntress documented four unrelated organizations compromised between late July and mid-August 2026, with three incidents occurring within 85 minutes on August 18 alone. The malware modifies three files in the legitimate Exodus package while the wallet itself runs invisibly in the background. The RAT combines hidden VNC access, SOCKS proxying, file management, and browser-data theft. Attackers are prioritizing long-term interactive access over immediate cryptocurrency theft, converting compromised machines into proxy infrastructure.

The Silver Fox threat actor is running an active campaign targeting China-based organizations across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. Attackers operate convincing counterfeit download pages for brands including Razer, Microsoft Edge, Kaspersky, and Baidu Netdisk, using look-alike domains. The campaign uses dynamically generated ZIP archives that allow attackers to change file hashes while retaining the same archive name, defeating simple hash-based detection. After extraction, a wrapper executable drops malware into randomized folders under C:\Users\Public or C:\ProgramData with randomized filenames.

JFrog patched CVE-2026-82329 on August 28, a critical authentication bypass in Artifactory that lets an unauthenticated network attacker obtain administrative privileges under the default configuration. CVSS 9.8. WatchTowr confirmed in-the-wild exploitation on September 1, reporting that attackers are minting admin tokens on vulnerable internet-facing instances. The risk is software supply chain compromise: Artifactory manages packages, containers, binaries, and AI model artifacts, and an attacker with admin access can alter repository settings, inject malicious artifacts into trusted feeds, and create persistent access tokens. Self-hosted deployments require manual update to one of the fixed versions.

Threat actors are actively exploiting CVE-2026-0768, an unauthenticated remote code execution vulnerability in Langflow's custom component editor. The critical-rated flaw sits in the code validator and requires no authentication. VulnCheck detected the campaign after observing exploitation attempts against UK honeypots, with initial activity over the weekend escalating to 360 observed attacks. Traffic originates primarily from Russia. The exploitation payloads combine reconnaissance with credential harvesting, querying environment variables for Langflow secrets, OpenAI API keys, and AWS access-key material, and attempting to read Langflow's cached secret key. Separately, threat actors are also targeting Ruby on Rails with critical RCE vulnerabilities, focusing on internet-exposed installations for cloud credential theft.

Boston Scientific detected a cybersecurity incident on August 25, causing a network outage that disrupted access to on-premises operating systems and business applications. The company could not process or ship customer orders. By August 30, investigators found no signs of unauthorized activity since the initial detection date. The medical device manufacturer, which makes stents, catheters, pacemakers, and defibrillators, engaged CrowdStrike for incident response. The company has not identified the threat actor or disclosed whether data was accessed or exfiltrated. As of the latest update, Boston Scientific continues restoring affected systems, with no timeline for full restoration.

A dark web service called "Nexus" surfaced on the Russian cybercrime forum Exploit on August 31, offering digital scans of over 153 million US and Canadian drivers licenses, plus more than 10 million ID cards, three million travel documents, and 579,000 medical cards. The dataset appears to originate from a Louisiana-based identity verification company. The FBI's New Orleans field office opened a formal investigation. Among the documents available are those belonging to high-ranking US government officials. The breadth suggests a systemic compromise of an identity verification pipeline rather than scattered breaches. This is a major identity theft infrastructure event enabling downstream fraud including synthetic identity creation and deepfake-assisted social engineering.

Thirteen malicious Composer themes on Packagist are being used to turn Vietnamese movie and comic streaming sites into iPhone spyware delivery platforms. The injected JavaScript targets mobile visitors with a WebKit-to-kernel exploit chain for iPhones running iOS 18.4 through 18.6.x, weaponizing CVE-2025-31277 and CVE-2025-43529. Once the kernel escape succeeds, the payload harvests keychain databases, Wi-Fi passwords, SMS messages, contacts, photos, browser cookies, and cryptocurrency wallet seeds from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, and OKX. An August 2026 redeployment added targeted queries for crypto wallet mnemonics. The campaign is actively running and the Packagist ecosystem remains a vector.

Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny for a series of ATM jackpotting attacks across the US. The group, ages 26 to 33, targeted ATMs they considered vulnerable to malware, attempting to install software that would command the internal cash dispenser to empty its cassettes. They were arrested in December 2025 after failing to compromise an ATM. U.S. Attorney Ryan Kriegshauser cited ATMii, ATMitch, GreenDispenser, Alice, RIPPER, Skimer, SUCEFUL, and Ploutus as known malware families used in jackpotting. The case illustrates that physical ATM malware operations remain an active criminal vector despite being less publicized than remote cyberattacks.

Watchlist: deploy SonicWall SMA1000 hotfix immediately and re-image appliances; audit for unexplained GRE tunnel interfaces on Cisco IOS XR routers; patch HPE Fabric Composer before attackers chain the dual CVSS 10.0 flaws; push Chrome152.0.7977 updates; verify Hugging Face Transformers is patched and audit models loaded from external sources; block Silver Fox domains and monitor for the documented archive naming patterns; patch self-hosted JFrog Artifactory and audit for unauthorized admin tokens; remediate Langflow CVE-2026-0768 before credential-harvesting payloads pivot into cloud environments; track Boston Scientific for restoration timeline and potential data exposure; monitor FBI investigation into the Nexus driver's license dataset for downstream fraud campaigns.