All Articles

TL;DR for CISOs: A maximum-severity SonicWall SMA1000 flaw is now drawing exploitation attempts within days of its patch, a new DarkSword iPhone spyware variant adds credential and wallet theft, and a fresh GhostAction wave is pushing credential-stealing workflows into GitHub repositories.

Editor's note: Sunday was a lighter news day, so this edition covers three items reported over the weekend and early Monday, with one sourced from reporting dated October 12.

Lead story: SonicWall SMA1000 flaw sees exploitation attempts days after patch

What happened

SonicWall disclosed the flaw on October 6 and shipped hotfixes the same day. Within roughly two days, two threat intelligence firms were logging traffic from outside parties probing for it. Those two firms run decoy systems, so the evidence shows interest in the flaw, not a confirmed breach of a customer.

The reported probing targets the same WorkPlace portal as the July and September flaws, using a different technique. For teams that already patched twice this year, the pattern matters more than the individual bug: this product line has become a repeat target, and each fix is followed by a new test of the same entry point.

Evidence

Verified against independently fetched sources:
1. BleepingComputer, Max severity SonicWall SMA1000 flaw now exploited in attacks
2. SecurityWeek, Critical SonicWall vulnerability exploited days after disclosure
3. The Hacker News, SonicWall patches CVSS 10.0 pre-authentication SSRF flaw in SMA1000 appliances

What this means for your team

If you run SMA1000, the useful question is not whether you are on the September build. It is whether the new hotfix is installed and whether the appliance's WorkPlace portal needs to be reachable from the internet at all.

Because earlier SMA1000 flaws were exploited before or at disclosure, a clean patch status today does not tell you the box was clean last month. Ask your network team to separate two questions: are we patched, and have we looked for signs of earlier compromise.

Action checklist

1. Inventory every SMA1000 appliance, confirm its build against the fixed versions, and record who approved the restart that the hotfix requires.
2. Check whether the WorkPlace portal is exposed to the internet and restrict it to what users truly need. Limit the management console to administrative networks.
3. Search proxy and appliance logs since October 6 for OPTIONS requests and references to the internal CouchDB port described in the reporting.
4. If the appliance was exposed during the July or September windows, ask your incident team whether a compromise review was completed, and schedule one if not.

P7 DarkSword variant adds keychain and crypto-wallet theft to iPhone spyware

What happened

iVerify's report describes a new build of an existing iOS exploit kit rather than a new Apple vulnerability. The newer build removes debug logging, adds on-device packaging of keychain contents and gives operators a way to send commands to an infected phone. The researchers say it targets files from more than 25 wallet apps.

For enterprises, the interesting detail is where the case began: an employee's phone at a financial institution. A watering-hole kit does not need to know who the victim works for, which means corporate credentials stored in a keychain can be collected as a side effect of a consumer-style campaign.

Evidence

Verified against independently fetched sources:
1. The Hacker News, P7 DarkSword iOS exploit kit adds crypto wallet data theft and remote commands
2. 9to5Mac, P7 DarkSword: new iPhone spyware variant targets unpatched devices

What this means for your team

Phones that can still run a vulnerable iOS 18 build but are not enrolled in your management tooling are the gap. Personal devices used for single sign-on, authenticator apps or email are in scope even if you never issued them.

Detection is harder than before, since old indicators no longer match. Mobile threat defense vendors need the new indicators from iVerify's report, and your team should confirm they have loaded them.

Action checklist

1. Pull a report of iOS versions across managed and BYOD iPhones that access corporate email or SSO, and set a deadline to move them to the current Apple release.
2. Ask your mobile security provider whether the new P7 indicators from iVerify are loaded, and what a hit would trigger.
3. Review Lockdown Mode for executives, finance and crypto-exposed staff, and decide who is asked to enable it.
4. Check any websites or marketing tags you control for abandoned analytics domains that others could re-register and use to redirect visitors.

GhostAction returns: credential-stealing workflows spread across GitHub repositories

What happened

Attackers with access to maintainer accounts add a workflow file that looks like a routine security check. When it runs, it collects the secrets the repository already uses, scans committed files and history for credential patterns, and sends the result out over an outside connection.

Reporting differs on which maintainer accounts were involved, so this briefing relies on Socket's account of the October 8 burst. The consistent point across sources is that rotating the stolen secrets is not enough, because the credential that let the attacker commit is still valid until someone revokes it.

Evidence

Verified against independently fetched sources:
1. Socket, New GhostAction wave hits hundreds of repos, expanding beyond CI/CD secrets to cloud credentials
2. GitGuardian, GhostAction returns: 772 repos hit in new GitHub Actions wave
3. The Hacker News, Credential-stealing GitHub Actions workflows planted in tens of thousands of repositories

What this means for your team

Your exposure is not limited to open-source maintainers. Any developer account with write access, a fork with Actions enabled, or an old repository with committed keys can become the source of a leak.

The campaign also shows why secrets in git history keep causing incidents years after the commit. Cleaning the current branch does not remove what a history scan will still find.

Action checklist

1. Search all organization repositories for new workflow files named like security-audit.yml or github_actions_security.yml dated since August 31, including forks and non-default branches.
2. Where one is found, revoke the personal access token or session that created it, then rotate every secret the workflow could read.
3. Turn on secret scanning with push protection and require approval before workflows run from outside contributors or newly created forks.
4. Review cloud audit logs for activity from keys that were present in any affected repository during the exposure window.

Also notable

• AhsayCBS backup console: two flaws (CVE-2026-105133 and CVE-2026-105134) under active exploitation, with no patch available at the time of SecurityWeek's report. Huntress recommends restricting management access. Source: SecurityWeek, The Hacker News headline listing.
• Let's Encrypt will make 64-day certificate validity the default from February 10, 2027, a step toward 45 days in 2028. Teams with hardcoded renewal dates should test in staging. Source: SecurityWeek (single source reviewed).
• A former infrastructure engineer was sentenced to prison for an insider extortion plot against an industrial employer, after deleting administrator accounts and demanding 20 bitcoin. Source: SecurityWeek (single source reviewed).

Frequently asked questions

Is the SonicWall SMA1000 flaw being exploited?

Two threat intelligence firms, Previdian and Defused, reported exploitation attempts against CVE-2026-102255 starting around October 8, according to BleepingComputer and SecurityWeek. Whether any attempt compromised a real system has not been confirmed, and SonicWall's advisory did not flag active exploitation.

Which SonicWall products are affected?

SMA1000 models 6210, 7210 and 8200v running 12.4.3-03526 and older or 12.5.0-02952 and older. The SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected. Fixed builds are 12.4.3-03670 and 12.5.0-03082 or later.

What does the P7 DarkSword variant do?

Per iVerify as reported by The Hacker News and 9to5Mac, it steals keychain and crypto-wallet data from infected iPhones, hides more of its activity, and accepts remote commands. Check Apple's security release notes to confirm patch coverage for your iOS versions.

What is GhostAction?

A supply chain campaign that adds credential-stealing workflow files to GitHub repositories under compromised accounts. Socket reports more than 500 accounts affected since October 7, and GitGuardian documented 772 repositories hit between August 31 and September 30.

What should a CISO do first this week?

Confirm SMA1000 hotfix status and portal exposure, check iOS versions on devices that reach corporate email or SSO, and search repositories for unauthorized workflow files and exposed secrets.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.