vpn security2 articles
Surfshark Misconfigured Server Breach: User Data Unaffected, But It's Still Embarrassing
Surfshark disclosed a cybersecurity incident discovered on August 31, in which a misconfigured internal test server was accessed by a threat actor, exposing limited engineering data such as system binaries, internal configurations, and build-related credentials. However, the company confirmed that no user data, VPN services, encryption keys, IP addresses, or browser traffic were compromised, as the affected server was isolated from production systems. In response, Surfshark contained the breach, rotated affected credentials, implemented additional security measures, and announced plans for an independent security audit.
Unknown Threat Actor Chained SonicWall Zero-Days to Root Before Anyone Knew They Existed
A previously unknown threat actor (UTA0533) exploited two zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — in SonicWall SMA 1000 series VPN appliances before patches were publicly released, chaining them together to achieve root-level access on compromised devices. The attacker deployed custom malware, including a web shell and HTTP proxy tool, modified startup scripts for persistence, and used packet capture utilities to steal LDAP credentials. While UTA0533 demonstrated advanced capability in compromising the appliances, evidence suggests they had limited success in moving laterally to other systems on the network.