CISA Flags Two SonicWall SMA 1000 Flaws as Actively Exploited, Gives Agencies 3 Days to Patch

·5 views

CISA added two SonicWall SMA 1000 vulnerabilities — a pre-authentication SSRF flaw (CVE-2026-83548) and an OS command injection flaw (CVE-2026-83549) — to its Known Exploited Vulnerabilities catalog on September 2, 2026, with a federal remediation deadline of September 5. SonicWall responded the same day by publishing advisory SNWLID-2026-0016 alongside patched firmware versions 12.4.3-03526 and 12.5.0-02952. A ZoomEye scan conducted on September 18, 2026, identified only 7 records matching the precise SMA product fingerprint, reflecting that the appliance's management interface is not intended for public exposure. Security researchers caution that broader vendor-name searches returning millions of SonicWall-branded assets do not accurately represent SMA 1000 exposure and should not be conflated with the specific vulnerability surface. Organizations are advised to query their own perimeters using the product-specific fingerprint and treat any internet-reachable SMA 1000 portal as potentially vulnerable until patched versions are confirmed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds npm library to finally give designers full control over scrollbars

A developer and former UI/UX designer created an npm library called morphing-scroll in 2023 to address long-standing limitations in browser scrollbar customization. The project was inspired by years of frustration — first as a designer whose scrollbar concepts were rejected as technically impossible, then as a developer who experienced those constraints firsthand. Native browser scrollbars lack a unified standard across browsers and offer only minimal styling options, such as basic color changes and width presets. The library, built with JavaScript and React, aims to let developers replace the scrollbar thumb with any custom element, including animated or interactive ones. Inline styles were chosen to ship default styling reliably within the component itself.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Svelte 5 Runes Mirror React Hooks, Abandoning Framework's Original Magic

Svelte built its reputation on implicit reactivity, where a simple variable assignment like 'let count = 0' would automatically update the UI without any special syntax. Svelte 5, announced in September 2023 and stabilized in late 2024, replaced that approach with 'runes' — $state, $derived, and $effect — which closely parallel React's useState, useMemo, and useEffect hooks. The Svelte team, led by Rich Harris, justified the shift by citing scalability issues with the old reactive syntax and the need for reactivity to work outside .svelte files in plain JavaScript or TypeScript. The change delivered measurable benefits, including a reported 55% bundle size reduction in one real-world migration of a 147-component app. Critics argue, however, that Svelte has lost its defining identity by converging on the same explicit reactivity model it once positioned itself against.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Debug Log Flaw Exposes All User Passwords via Unsecured SIEM Dashboard

A security research exercise demonstrated how a forgotten debug statement in a web app's login route logged user passwords in plaintext on every authentication attempt. The logs were captured by an internal SIEM dashboard hosted at an unlisted but discoverable URL, reachable via standard directory enumeration tools like Gobuster. The SIEM console was protected only by default credentials, allowing anyone who found it to log in and read all captured passwords. Four distinct vulnerabilities enabled the attack: plaintext logging of sensitive fields, cleartext log storage, an exposed internal monitoring endpoint, and hardcoded default credentials. The findings highlight the need to redact sensitive data from logs, secure internal tools with proper credentials, and treat log files with the same care as production databases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Chief of Staff Runs Day-1 Solana Memecoin Pipeline, Flags Caution on First Lead

An AI system configured as a Chief of Staff completed its first end-to-end pipeline test, guiding a first-time Solana memecoin learner through a structured research and risk-assessment workflow. The pipeline routed a DexScreener discovery (DEXCAT) through three specialist roles — Researcher, Radar, and Risk — returning a CAUTION verdict and blocking any live funds due to thin liquidity, unverified holders, and a brand-new launch profile. The day-one retrospective identified key weaknesses, including cognitive overload from too many parallel workstreams, missing paper-trading mechanics before the first scan, and overly frequent status updates to the user. Scorecard ratings averaged 3.7 out of 5, with safety and refusal discipline scoring highest and token efficiency scoring lowest. The operator noted that future builds should begin with a single orchestrator, one specialist, a written refusal list, and a clear stop rule when the human operator feels overwhelmed.

0 comments Read more at DEV Community