Silent Patches, Fast Exploits, and an Arrest Inside Ransomware Response

TL;DR: SonicWall’s CVSS 10.0 flaw is under exploitation, AnyDesk shipped a root-level fix with no security label, and Flax Typhoon’s KEV deadline passed Sunday. Pull SMA 1000 logs back to disclosure, inventory every AnyDesk install, and confirm all five Flax Typhoon flaws are patched.

Attackers exploited SonicWall’s maximum-severity SMA 1000 flaw within three days of the patch. Following last week’s note on the unnumbered CVSS 10.0 SSRF, it now has an identifier, CVE-2026-102255, and 135 recorded exploitation attempts. Treat the advisory date as your incident start date. Search SMA 1000 logs from that day forward for requests to internal addresses and admin endpoints.

AnyDesk shows the other half of the patch problem. A researcher published a working exploit for AnyPwn, a pre-auth heap overflow in AnyDesk for Linux that runs commands before the user approves a session, with root privileges in some configurations. The vendor fixed it in June and never labeled the release as a security update. If your triage keys on “security fix” tags, you skipped it. I’ve watched teams defer remote-access tool updates for months because nothing flagged urgency. Inventory every AnyDesk install, including Linux jump hosts, and push the current version.

Bricksforge belongs in the same bucket if you run WordPress. CVE-2026-85097 scores 10.0, allows unauthenticated file upload and PHP execution through version 3.1.8.9, and attackers are using it today.

AI orchestration moved from lab demo to casework. BleepingComputer reports a Chinese operator used the ARTEX AI pentest suite and Claude agents against South Korean financial firms. The Hacker News reports CyberXero paired Cobalt Strike with Claude Code to steal 628,000 Ukrainian records. Both campaigns relied on known tooling, so your Cobalt Strike detections still fire. The change is tempo. The operator iterates while your analyst writes the ticket. Measure alert-to-containment time, not only alert coverage.

The FBI seized seven domains tied to Flax Typhoon, the China-linked group scanning critical infrastructure. CISA added five flaws the group abuses to the KEV catalog with an October 11 federal deadline. That deadline passed Sunday. Private-sector teams have no mandate, which makes the deadline a free prioritization signal.

The FBI also arrested Edward Dubrovsky in Pennsylvania in the ShinyHunters investigation. Krebs first called him the founder of a ransomware negotiation firm. His former employer, Cypfer, says he was a managing director. The complaint is sealed, so treat this as an allegation. The practitioner lesson holds regardless. Your negotiator and IR retainer see your worst day and your most sensitive data. Ask them how they scope staff access to client material.

Today: pull SMA 1000 logs back to the disclosure date, build the AnyDesk inventory, and diff your patch state against the five Flax Typhoon entries in KEV.