Vulnerability
Two chained vulnerabilities (CVE-2026-83548 and CVE-2026-83549) have been disclosed in SonicWall SMA1000 series appliances, potentially leading to remote code execution. The former is a server-side request forgery vulnerability with a severity score of 10, while the latter is an OS command injection vulnerability with a score of 7.8. SonicWall has confirmed exploitation in the wild, and CISA has added them to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate by Saturday.
A Forescout Research - Vedere Labs report indicates that frontier AI can be used to exploit vulnerabilities in programmable logic controllers (PLCs), devices recently targeted by hackers, affecting U.S. water, energy, and factory operations. Researchers used Claude to port a remote code execution vulnerability in WAGO PLCs to another model, but the AI still required human guidance.
In a report released Tuesday, CISA detailed the differing outcomes of two red team exercises. One organization (A) failed to stop the attack due to a lack of communication between security operations centers (SOCs) and being overwhelmed by false-positive alerts; the other (B) limited the attack's spread through rapid response and a mature security posture, but still exposed vulnerabilities in cloud identity management. The report summarized six common shortcomings, including insufficient alert tuning, excessive permissions, and credentials that never expire.
Researchers discovered 15 new vulnerabilities in TP-Link Omada's zero-touch deployment process, which can be chained by hackers to gain initial access and move laterally. The vulnerabilities affect devices such as routers, firewalls, and IP cameras. TP-Link has released security advisories and patches.
At Black Hat USA 2025, security experts noted that cyberattacks on operational technology (OT) systems are shifting from data theft and ransomware to physical destruction, with Iran-linked hackers demonstrating the ability to disable safety monitoring systems. Due to numerous industrial devices having default passwords, unpatched vulnerabilities, and lacking encryption protection, attackers can cause severe damage without advanced AI or zero-day exploits.
Check Point Software issued a security advisory on Wednesday, disclosing a critical authentication bypass vulnerability (CVE-2026-16232) in its SmartConsole login process that is being actively exploited, affecting a small number of customers. The vulnerability allows attackers to gain full administrative access after obtaining an application login token, enabling them to modify security policies and configurations, with a severity score of 9.1/10. The official jumbo hotfix has been released to address this vulnerability and two other security issues, and the U.S. CISA has also added it to its Known Exploited Vulnerabilities catalog, requiring federal agencies to complete mitigation within a specified timeframe.
According to a preview of the annual internet exposure report released by internet monitoring company Censys, as of early 2026, North America hosts approximately 38% of the world's internet-exposed industrial control systems (ICS), ranking first. Meanwhile, the number of publicly accessible AI services has grown rapidly, increasing from 183,000 IP addresses in October 2025 to 294,000 by early 2026. Notably, AI products with the most severe vulnerabilities (such as Langflow and LiteLLM) saw the largest increases in internet-exposed instances, with Langflow growing by 169% over nine months, accumulating 18 vulnerabilities, of which 14 are high-severity and 4 have been exploited; LiteLLM's exposed instances nearly doubled, and it has a pre-authentication SQL injection vulnerability that is being actively exploited. The total number of ICS devices increased from 129,000 in 2024 to 138,000 by early 2026, with Asia's share rising and Europe's declining.