SonicWall Warns of Critical SMA1000 SSRF Flaw; Researchers Report Probes Days After Patch

·6 views

SonicWall has disclosed four vulnerabilities in its SMA1000 remote access appliances, led by a pre-authentication server-side request forgery in the Work Place interface rated CVSS 10.0. The advisory, published October 6, 2026, lists affected models and fixed hotfix versions available through MySonicWall. Researchers at Defused reported that exploitation attempts reached their decoy systems on October 8, two days after disclosure, though SonicWall says it has seen no evidence of in-the-wild exploitation. A captured payload targeted a local service on port 5984, underscoring the risk to internal systems. The flaw affects the same portal that attackers exploited as a zero-day earlier in 2026, prompting urgent patching advice for appliance owners.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Real-Time VAT Validation in a React Checkout Form

The article explains how to validate VAT IDs as customers type into a React checkout field without exposing API credentials. Calling the vatnode API directly from the browser would leak the key in the client bundle and fail due to CORS restrictions, so the author recommends a backend proxy route that stores the key server-side. The architecture routes the React component through the developer's own endpoint, which forwards requests to vatnode and returns normalized results. Before any network call, the implementation performs a local format check, with special handling for Greek (EL) and Northern Ireland (XI) prefixes. The guide also provides a minimal Next.js route handler that reads the key from a server-only environment variable and standardizes the response shape.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

New AI Bias Audit Uses Paired Scenarios to Pinpoint Where Models Show Unfairness

A new benchmark evaluates AI bias through paired scenarios that change one demographic detail at a time, such as name, gender, or origin, while holding everything else constant. Responses are compared for symmetry using deterministic scoring and a fixed LLM judge, and results are broken down by axes like cultural bias, intersectionality, and factual neutrality. On the leaderboard, HY3 (free) scored 82.9 and Nemotron 3 Ultra (free) scored 81.7, with GLM 5.2 at 78.0. The authors argue that per-axis profiles are more useful than a single overall score for choosing models for specific risk areas. They also caution that the audit does not measure real-world harm and that LLM judges carry their own biases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Changed Device IP Addresses: Why Private Wi-Fi Addresses Can Break DHCP Reservations

A device that normally receives the same local address may suddenly be assigned a different one, often because of private Wi-Fi address features. A DHCP reservation ties an address to a recognized client, but a device's private Wi-Fi address is a separate identifier, so the reservation may not match. The guide advises checking the router's connected-client view, noting the time and network, and comparing the device's current Wi-Fi address with the one in the reservation. If they differ, the reservation should be updated, and the device should be reconnected to confirm the intended address is offered before any manual assignment is made.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Reminder Policies Should Include Escalation Rules for Stalled Approvals

A single reminder is often insufficient to resolve an approval that has stalled in a workflow. The article argues that an effective reminder policy should specify the waiting period, the intended recipient, the number of reminder attempts, and a clear escalation path. It recommends making the delay threshold configurable instead of hardcoding it into the flow logic. The author also suggests recording in the history when each reminder was sent and when responsibility shifted to a substitute or a higher-level approver. Without escalation, the piece contends, a process relies on someone noticing the notifications, which limits its reliability.

0 comments Read more at DEV Community