VPN security Archives • Daily CyberSecurity

SafePay Ransomware Hits 600 Victims as FBI, CISA and Allies Issue Joint Warning

SafePay ransomware attack chain detailed in the joint CISA and FBI StopRansomware advisory

SafePay Ransomware Hits 600 Victims as FBI, CISA and Allies Issue Joint Warning

Do Son October 22, 2026

A new StopRansomware advisory warns SafePay ransomware has hit 600+ victims via VPN logins and edge flaws. See its tactics and key defenses.

Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access CVE-2026-0257 GlobalProtect authentication bypass exploited by ransomware gangs to open VPN sessions

CVE-2026-0257 GlobalProtect authentication bypass exploited by ransomware gangs to open VPN sessions

Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access

Do Son October 20, 2026

Ransomware gangs exploit CVE-2026-0257, a GlobalProtect authentication bypass in PAN-OS, to slip past MFA and open VPN sessions. Patch now.

Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access

Ivanti Connect Secure zero-day exploit chain CVE-2026-104935 used by UTA0576 to gain root access on a VPN appliance

Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access

Do Son October 13, 2026

UTA0576 chained an Ivanti Connect Secure zero-day, CVE-2026-104935, with a root exploit to steal AD credentials. Patch now and check memory.

Ivanti Connect Secure Vulnerability CVE-2026-104935 Exploited in the Wild

Do Son October 13, 2026

Ivanti Connect Secure vulnerability CVE-2026-104935 is exploited in the wild, letting unauthenticated attackers run commands. Update to 25.1.1.2 now.

WatchGuard Patches 14 Fireware OS Vulnerabilities, Including CVSS 9.2 RCE WatchGuard Fireware OS vulnerabilities including critical BOVPN Over TLS code injection CVE-2026-86131 and pre-auth fingerd overflow CVE-2026-81433 on Firebox appliances

WatchGuard Fireware OS vulnerabilities including critical BOVPN Over TLS code injection CVE-2026-86131 and pre-auth fingerd overflow CVE-2026-81433 on Firebox appliances

WatchGuard Patches 14 Fireware OS Vulnerabilities, Including CVSS 9.2 RCE

Do Son September 30, 2026

WatchGuard patched 14 Fireware OS vulnerabilities, including CVSS 9.2 RCE flaw CVE-2026-86131 in BOVPN Over TLS. Update Firebox appliances now.

Citrix NetScaler Zero-Day RCE Flaws Exploited, Patches Released

Do Son September 27, 2026

Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.

A Configuration Error Exposes Surfshark Internal Infrastructure Surfshark VPN test server breach diagram and internal infrastructure compromise

Surfshark VPN test server breach diagram and internal infrastructure compromise

A Configuration Error Exposes Surfshark Internal Infrastructure

Do Son September 11, 2026

Discover the details of the Surfshark test server breach. Learn how a configuration error exposed internal secrets and how the VPN provider responded.

CVE-2026-83548 Exploited: SMA1000 SSRF Hits 10.0 SonicWall SMA1000 vulnerability CVE-2026-83548 pre-authentication SSRF exploited in the wild CVSS 10.0 diagram

SonicWall SMA1000 vulnerability CVE-2026-83548 pre-authentication SSRF exploited in the wild CVSS 10.0 diagram

CVE-2026-83548 Exploited: SMA1000 SSRF Hits 10.0

Do Son September 1, 2026

CVE-2026-83548, a critical SonicWall SMA1000 vulnerability, is exploited in the wild. The pre-authentication SSRF flaw scores a maximum 10.0 CVSS.

InHand Router Flaws: Command Injection Patches Released Yarbo robot vulnerability hard-coded MQTT credentials, CVE-2026-10557, CVE-2026-7368 command injection vulnerabilities InHand router flaws

Yarbo robot vulnerability hard-coded MQTT credentials, CVE-2026-10557, CVE-2026-7368 command injection vulnerabilities InHand router flaws

InHand Router Flaws: Command Injection Patches Released

Do Son June 3, 2026

Severe InHand router flaws expose industrial networks to command injection vulnerabilities. Update your industrial firmware immediately to patch these bugs.

VPN Security Alert: Synology Patches Flaws in SSL VPN Client Synology Chat Server vulnerabilities Synology security update Synology DSM Update NAS Security Vulnerability Synology VPN Update SSL VPN Vulnerability Synology Telnet Flaw DSM Security Update Synology DSM Telnet vulnerability BeeStation Zero-Day, Pwn2Own RCE CVE-2024-11131 & CVE-2024-10442 CVE-2025-2848 Synology, NAS

VPN Security Alert: Synology Patches Flaws in SSL VPN Client

Do Son April 14, 2026

Synology urges SSL VPN Client users to update to v1.4.5-0684. Fixes critical 8.1 CVSS flaw allowing PIN theft and traffic interception. Secure your data now!

High-Severity strongSwan Flaw Enables Remote VPN Gateway Crashes libstrongswan double-free exploit strongSwan CVE-2026-47895 CVE-2023-41913 strongSwan Vulnerability VPN Denial of Service

libstrongswan double-free exploit strongSwan CVE-2026-47895 CVE-2023-41913 strongSwan Vulnerability VPN Denial of Service

High-Severity strongSwan Flaw Enables Remote VPN Gateway Crashes

Do Son March 26, 2026

strongSwan fixes a high-severity DoS flaw (CVE-2026-25075) in eap-ttls. Unauthenticated actors can crash VPN gateways. Patch now to stay protected!

WatchGuard Patches VPN PrivEsc & Firebox LDAP Injection WatchGuard Agent Privilege Escalation CVE-2026-6787 WatchGuard Vulnerability CVE-2026-1498 WatchGuard Firebox VPN Flaws, Command Injection WatchGuard Vulnerability CVE-2024-6592 and CVE-2024-6593

WatchGuard Patches VPN PrivEsc & Firebox LDAP Injection

Do Son February 5, 2026

WatchGuard patches two flaws: a VPN privilege escalation (NCPVE-2025-0626) and Fireware LDAP injection (CVE-2026-1498). Update Firebox and VPN clients now.

WatchGuard Under Siege: Critical CVSS 9.3 Zero-Day Exploited in the Wild to Hijack Corporate Firewalls

Cisco SD-WAN Vulnerability CVE-2026-20133 FortiGate Compromise Ivanti EPMM Zero-Day CVE-2026-1281 SmarterMail Vulnerability Storm-2603 WatchGuard Zero-Day, IKEv2 Out-of-Bounds Write Cisco Zero-Day, UAT-9686 Chinese APT FortiWeb RCE Exploitation CVE-2025-58034 VMware Zero-Day, Privilege Escalation Sitecore, remote code execution CVE-2025-53690 Windows CLFS, Privilege Escalation CVE-2024-47575 & CVE-2024-11120 CVE-2025-24983 vulnerability

WatchGuard Under Siege: Critical CVSS 9.3 Zero-Day Exploited in the Wild to Hijack Corporate Firewalls

Do Son December 19, 2025

WatchGuard warns of an active CVSS 9.3 zero-day (CVE-2025-14733). Attackers are exploiting IKEv2 VPNs for root RCE. Patch and rotate secrets now!

High-Severity WatchGuard Flaws Risk VPN DoS and RCE via IKEv2 Memory Corruption WatchGuard Agent Privilege Escalation CVE-2026-6787 WatchGuard Vulnerability CVE-2026-1498 WatchGuard Firebox VPN Flaws, Command Injection WatchGuard Vulnerability CVE-2024-6592 and CVE-2024-6593

High-Severity WatchGuard Flaws Risk VPN DoS and RCE via IKEv2 Memory Corruption

Do Son December 8, 2025

WatchGuard patched five flaws in Fireware OS. CVE-2025-11838 (CVSS 8.7) allows unauthenticated VPN DoS, while CLI Command Injection risks RCE in the management interface. Update immediately to v2025.1.3.

Coordinated Reconnaissance: 7,000+ IPs Target Palo Alto GlobalProtect and SonicWall API Endpoints Palo Alto SonicWall Scanning, Coordinated Reconnaissance

Palo Alto SonicWall Scanning, Coordinated Reconnaissance

Coordinated Reconnaissance: 7,000+ IPs Target Palo Alto GlobalProtect and SonicWall API Endpoints

Do Son December 6, 2025

GreyNoise detected a coordinated mass scanning campaign where 7,000+ IPs (from 3xK GmbH) probed Palo Alto GlobalProtect portals and SonicWall SonicOS API endpoints using identical client fingerprints.

Root Access Unlocked: Public PoC Exposes GlobalProtect macOS Privilege Escalation Flaw GlobalProtect, macOS Root

Root Access Unlocked: Public PoC Exposes GlobalProtect macOS Privilege Escalation Flaw

Do Son June 12, 2025

A flaw (CVE-2025-4232) in GlobalProtect for macOS allows local users to escalate to root. Public PoC code exists. Update now!