SonicWall customers under threat as attackers exploit 2 zero-days

🚨 ACTIVE EXPLOITS & INCIDENTS

• SonicWall customers under threat as attackers exploit 2 zero-days — CyberScoop
  Attackers are actively chaining two zero-day vulnerabilities in SonicWall devices, exploited in the wild three weeks before vendor disclosure and patching. Immediate patching and monitoring for exploitation attempts are critical to prevent compromise.

• Google Gemini CLI abused as a hacking agent, malware botnet operator — BleepingComputer
  A Russian-speaking threat actor “bandcampro” is weaponizing Google’s open-source Gemini CLI AI tool to automate hacking operations and run a small botnet. This marks a novel use of AI tooling in malware campaigns, warranting increased detection focus on Gemini CLI usage in networks.

🔓 VULNERABILITIES & CVEs

• OpenWrt ACL bypass and arbitrary root file read (CVE-2026-62947) — CVE ThreatInt
  OpenWrt versions prior to 25.12.5 have an ACL bypass in the cgi-download handler allowing arbitrary root file reads. Exploitation could lead to sensitive data exposure on embedded devices. Patch or upgrade immediately.

• OpenWrt unauthenticated DHCPv6 client lease-file injection (CVE-2026-62948) — CVE ThreatInt
  Prior to 25.12.5, OpenWrt’s odhcpd allows unauthenticated DHCPv6 clients to inject lines into lease files, potentially enabling remote code execution or persistent manipulation. Critical for IoT and embedded device security teams.

• Repomix Command Injection via --remote-branch (CVE-2026-49987) — CVE ThreatInt
  Repomix versions before 1.14.1 allow remote code execution through unsanitized --remote-branch argument passed to git commands. This can be exploited by malicious repository inputs. Upgrade to 1.14.1+ to mitigate.

• Repomix secret scanning bypass (CVE-2026-49988) — CVE ThreatInt
  Repomix MCP server can read arbitrary local .js files, bypassing secret scanning protections prior to 1.14.1. This could leak sensitive credentials or tokens during repository packaging.

• Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read (CVE-2026-12997) — CVE ThreatInt
  WordPress Gravity Forms plugin suffers directory traversal via gform_uploaded_files parameter allowing unauthenticated arbitrary file reads. Affects all versions up to 2.10.4. Patch or mitigate immediately.

• Cherry Studio RCE via SearchService nodeIntegration Misconfiguration (CVE-2026-40501) — CVE ThreatInt
  Cherry Studio versions 1.2.2 through 1.9.12 have a remote code execution flaw due to nodeIntegration misconfiguration in SearchService. Fixed in commit 1518530. Urgent patching recommended.

• Credential disclosure in Strands Agents elasticsearch_memory tool (CVE-2026-15746) — CVE ThreatInt
  Strands Agents Python SDK’s elasticsearch_memory tool leaks credentials, exposing sensitive data to attackers. Review usage and update to patched versions.

• Dashy config write bypass via OIDC (CVE-2026-46485) — CVE ThreatInt
  Dashy dashboards prior to 4.0.8 allow unauthenticated or non-admin users using OIDC to write changes to config.yaml, risking unauthorized configuration changes. Upgrade to 4.0.8+.

• Dashy improper HTML sanitization in RSS widget (CVE-2026-54443) — CVE ThreatInt
  Dashy versions 1.9.4 to 3.2.0 fail to sanitize RSS feed item links, enabling XSS attacks. Patch or mitigate.

• Better Auth OAuth refresh token race condition (CVE-2026-53517) — CVE ThreatInt
  Better Auth versions 1.4.8-beta.7 to 1.6.11 have a refresh token rotation race condition allowing token reuse and potential account compromise. Update to latest patched versions.

• Better Auth unauthorized invitation acceptance (CVE-2026-53514) — CVE ThreatInt
  Better Auth prior to 1.6.11 and from 1.6.14+ improperly verify email matches in invitation acceptance, enabling unauthorized account access.

• Better Auth privilege escalation via SSO registration (CVE-2026-53515) — CVE ThreatInt
  Better Auth 1.2.10 to 1.6.11 allows any organization member to register SSO providers without admin rights, leading to privilege escalation.

• Better Auth device authorization session mismanagement (CVE-2026-45337) — CVE ThreatInt
  Better Auth 1.6.0 to 1.6.11 treats any authenticated session as owner of pending device authorizations, risking unauthorized device approvals.

• Dell ThinOS 10 obsolete feature UI vulnerability (CVE-2026-56687) — CVE ThreatInt
  Dell ThinOS 10 versions prior to 2605_10.2100 contain a low-privilege local UI vulnerability that could lead to privilege escalation or denial of service.

• Dell ThinOS 10 protection mechanism failure (CVE-2026-56087) — CVE ThreatInt
  Physical attackers on Dell ThinOS 10 (pre-2605_10.2100) may exploit protection mechanism failures to gain unauthorized access or escalate privileges.

• Zephyr ADIN2111/ADIN1110 Ethernet driver out-of-bounds write (CVE-2026-10673) — CVE ThreatInt
  Zephyr Ethernet driver mishandles Ethernet frame reassembly causing out-of-bounds writes, potentially exploitable for remote code execution or denial of service.

🕵️ THREAT RESEARCH & DEEP DIVES

• TuxBot v3 Evolution shows signs of LLM-assisted IoT botnet development — The Hacker News
  New IoT botnet framework TuxBot v3 Evolution appears to be partially generated with large language model assistance. Although AI-generated code included safety disclaimers, this trend signals growing AI involvement in malware development.

📰 LESSER-KNOWN / UNDER-REPORTED

• Getting MITRE techniques a customer raw detection rule covers — r/cybersecurity
  Community discussion on automating MITRE ATT&CK technique extraction from raw detection rules without metadata. Current reliance on regex/manual methods is costly; seeking algorithmic or AI-assisted solutions to improve SOC efficiency.