SonicWall's SMA1000 gets a second front door, and someone is already knocking
Decrypted: The UK Cyber BriefingShow Notes
SonicWall fixed a maximum severity, no-login flaw in its SMA1000 remote access gateways, and one researcher reports probes that match it. The Secure by Design lesson: internal services should not trust a request because of where it came from.
More from Decrypted: The UK Cyber Briefing
A poisoned LiteLLM release stole credentials after attackers pointed a genuine, signed publishing workflow at a lookalike repository. The Secure by Design lesson is about fixed inputs and single powerful tokens. Also: Arista's exploited SD-WAN flaw, OpenAI's agents and Railway's secrets scare.
Yesterday's PHP story has become an outage: 32 UK government services were unavailable on Thursday as officials applied patches. Plus a hijacked LiteLLM release and the role AI played in finding the PHP flaws.
The National Crime Agency and US and German agencies have published how SafePay, a ransomware gang with at least 600 victims, breaks in and operates. The Secure by Design lessons are old and cheap. Also: Plex2Shell and Google's AI vulnerability tally.
PHP shipped emergency fixes today for two critical remote code execution flaws, and the NCSC says any version may be affected. The lesson is knowing where PHP runs. Also: the SafePay ransomware advisory and the US order removing DeepSeek.
AOMEI Backupper's update files were briefly tampered with on its own servers, delivering a backdoor with no software flaw involved. The Secure by Design lesson is signed updates. Also: PHP's patches due today, rogue AI agent guidance, and a spyware ruling.