Threats Day Bulletin: Rootkit Patch, Federal Breach, One Plus SMS Leak, TikTok Scandal & More
Summary: SonicWall released SMA 100 firmware 10.2.2.2-92sv with additional file checking to remove known rootkit malware, after Google reported threat actor UNC6148 deploying OVERSTEP on end-of-life SMA 100 devices; SonicWall moved the end-of-support date for all SMA 100 devices to October 31, 2025. CISA published an advisory on the Shai-Hulud self-replicating npm worm, which authenticated to the npm registry as compromised developers and injected code into other packages to spread and steal credentials.
Why it matters: The Shai-Hulud worm spread by exploiting maintainers' existing publishing rights, so a single compromised developer account can propagate malware across the open-source packages your build pipeline pulls in. SonicWall's answer to OVERSTEP is to retire the SMA 100 line entirely by October 31, 2025, leaving anyone still running these VPN appliances on a fixed end date.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-36401CVE-2025-10184
- Related
- CVE-2024-36401: OSGeo Geo Server Geo Tools Eval Injection Vulnerability Known Exploited Vulnerabilities · Jul 15, 2024