Cybersecurity report: SonicWall vulnerability exploited and new AI-targeting malware

Multiple cybersecurity threats and legal developments have been reported. A maximum-severity vulnerability (CVE-2026-102255) in SonicWall SMA1000 devices is currently under active exploitation. The flaw allows remote, unauthenticated attackers to perform unauthorized operations by directing the appliance to issue requests on their behalf.

In malware developments, researchers identified PoeLLM, a botnet that targets exposed AI and open-source services to mine cryptocurrency. The malware uses a unique command-and-control method where infected machines extract keywords from a poem hosted on GitHub to determine the server's IP address. Additionally, the GhostAction supply chain campaign has been linked to the theft of secrets from 772 GitHub repositories, targeting credentials for services such as AWS, Azure, and various databases.

In legal news, Jonathan Spalletta of Maryland has been convicted of computer fraud and money laundering. The conviction stems from two 2021 hacks of the decentralized crypto exchange Uranium Finance, where he exploited smart contract flaws to steal millions of dollars. Meanwhile, the FBI has reportedly dismissed an Accenture contractor following a major data breach involving ShinyHunters.