#vpn
-
EFF: VPN Apps Are Vanishing From Russia's App Store Again, and They Are Worth Defending
VPN developers report that Apple is once again pulling their apps from the Russian App Store. The Electronic Frontier Foundation calls this an unacceptable blow to a tool that protects privacy and free speech.
-
Cisco patches actively exploited zero-day in ASA and FTD firewalls
CVE-2026-76418 lets unauthenticated remote attackers force Cisco firewalls with SSL VPN enabled to reload. The company has already seen attacks and urges customers to update.
-
The k0t Campaign: Enterprise Firewalls Breached, 70,000+ Credentials Exposed
Researchers at Group-IB and NyxLab have detailed a large-scale campaign against internet-facing Fortinet and Palo Alto Networks edge devices. A threat actor known as k0t compromised organizations worldwide and harvested over 70,000 credentials.
-
Ivanti warns of actively exploited Connect Secure zero-day
Ivanti is urging customers to patch immediately: an actively exploited flaw in its Connect Secure remote access gateway lets attackers bypass authentication and run commands on affected appliances.
-
FBI: FortiBleed Harvested 86,644 Fortinet Device Credentials and Is Still Active
The FBI and U.S. Secret Service warned that the FortiBleed credential-harvesting campaign remains an active threat to internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
-
SonicWall patches max-severity SSRF flaw in SMA1000 gateways
The company has issued emergency hotfixes for its SMA1000 series: the flaw let an unauthenticated attacker make the appliance issue requests on their behalf and reach internal functionality.
-
Psiphon Ready to Leave Canada Over Lawful-Access Bill
Psiphon, a maker of censorship-circumvention tools, says it will leave Canada if Bill C-22 passes, forcing providers to secretly build surveillance capabilities for police and intelligence services.
-
GSoC 2026: a student tames NetBSD's racoon2 IKE daemon
As part of Google Summer of Code 2026, Artem Belan rewrote NAT traversal, fixed IPv6, and gave racoon2 its first automated test suite.
-
Check Point confirms attacks on VPN Security Gateway RCE flaw
The company reports active exploitation of a pre-authentication flaw, CVE-2026-85102, in its VPN certificate handling, alongside a second bug used as a zero-day since July.
-
September Windows updates break Always On VPN connections
Microsoft has warned that installing the September 2026 Windows 11 security updates may disrupt the enterprise Always On VPN remote access solution.
-
Check Point warns of a management server zero-day used in targeted attacks
The vendor says a flaw in its Security Management Server was exploited as early as July 23 and shipped a fix on September 22. In parallel, attackers are probing Spark firewalls through a VPN flaw.
-
VPN Flaw Exposes Data of 246,000 Japanese Government Personnel
Japan's Digital Agency has reported a leak of roughly 246,000 records containing the personal data of public-sector employees: an attacker breached the system through a vulnerability in a VPN device.
-
Surfshark reports breach of an internal testing and proxy server
A configuration error left the VPN provider's internal testing server reachable from the internet, and attackers gained access to it. According to the company, customer data and production infrastructure were not affected.
-
Check Point Patches Two Critical Flaws in VPN Certificate Handling
Both holes carry a 9.8 rating and could, in theory, let an unauthenticated attacker execute code remotely — but the vendor won't spell out the “certain conditions.”
-
SonicWall Patches Two 0-Days in SMA 1000: Attackers Chain the Flaws Together
The company released updates for its SMA 1000 series VPN gateways after two vulnerabilities — one of them rated a maximum 10 on the CVSS scale — were actively exploited.
-
737 fake Chrome VPN extensions intercepted the traffic of Russian-speaking users
Researchers at Socket have uncovered a large-scale campaign: hundreds of free VPN extensions posed as well-known brands and routed all browser traffic through an attacker's proxy.
-
Sandworm targets IT pros through fake job openings and a trojanized WireGuard
Ukraine's CERT has detailed a social-engineering campaign in which hackers pose as recruiters to trick candidates into installing a modified VPN client laced with malicious code.
-
Cisco Warns of Active Exploitation of a Flaw in ASA and FTD
A vulnerability in the VPN components of Cisco Secure Firewall lets attackers reboot devices remotely. The company has observed attacks and released fixes.
-
SonicWall SMA1000 Vulnerabilities Now Weaponized by Ransomware Operators
CISA has confirmed that ransomware gangs have begun exploiting two recently patched vulnerabilities in SonicWall SMA1000 remote access gateways, including a critical SSRF flaw.
-
Trojanized QuickFox Installer Delivered the FDMTP Backdoor
Fortinet researchers have uncovered a years-long supply-chain attack on QuickFox, a VPN service aimed at Chinese nationals abroad: an infected Windows installer deployed the FDMTP backdoor, previously linked to the Mustang Panda group.
- More