#VPN
All CosmicBytez Labs articles tagged #VPN, across news, security advisories, how-to guides, and projects.
- News
Honeypots Log 105 Attacks on Ivanti Connect Secure Ahead of CISA Deadline
Previdian logged 105 exploit attempts from 50 IPs against the Ivanti ICS zero-day chain as CISA's Oct 16 federal patch deadline nears.
- News
Ivanti Connect Secure Zero-Day Attacks Highlight Vendor Patching Hurdles
UTA0576 chained CVE-2026-104935 with two more flaws for root-level RCE on patched Ivanti Connect Secure VPNs after a July fix missed the full bypass.
- News
Ivanti Connect Secure Zero-Day Chain Gave Attackers Root Access to Fully Patched VPNs
An actor Volexity calls UTA0576 chained 3 Ivanti Connect Secure zero-days for unauthenticated root access; only 2 of 3 flaws are patched.
- Security
CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing
Ivanti confirms active exploitation of a pre-auth spoofing flaw in Connect Secure VPN gateways that lets attackers execute arbitrary commands remotely.
- News
Check Point Warns of Hackers Exploiting Security Gateway VPN RCE Flaw
Check Point confirms active exploitation of CVE-2026-85102, a CVSS 9.8 pre-auth RCE in Security Gateway VPN certificate handling; CISA set a Sept 25 deadline.
- News
240,000 Hit by Data Breach at Japan's Digital Agency
Hackers exploited a disclosed VPN vulnerability and a maintenance account to breach Japan's Digital Agency, exposing data on 240,000 people.
- News
Japan's Digital Agency Says VPN Flaw Exposed 246,000 Personnel Records
Japan's Digital Agency says an attacker exploited a VPN flaw to access Government Solution Service files, exposing about 246,000 personnel records.
- News
Check Point Patches Critical VPN Vulnerabilities
CVE-2026-85102 and CVE-2026-85103 (CVSS 9.8) let attackers achieve unauthenticated RCE via Check Point VPN certificate handling.
- News
Dutch NCSC Warns Check Point VPN Flaw Exploitation Is Imminent
The Dutch NCSC warns exploitation is imminent for two critical Check Point VPN flaws enabling RCE on Security Gateways and Management Servers.
- News
Surfshark VPN Says Hackers Breached Internal Testing, Proxy Servers
A misconfigured internal test server exposed Surfshark's build credentials and code history; the company says customer VPN data was not affected.
- Project
Headscale: Self-Hosted Tailscale Control Server for Zero-Trust Mesh VPN
Replace Tailscale's cloud coordination server with a self-hosted Headscale instance, then lock the tailnet down with ACL policies, tagged nodes, and a...
- News
Attackers Chain Two SonicWall SMA 1000 Zero-Days in Active Attacks
SonicWall confirms active exploitation of two chained SMA 1000 zero-days — a pre-auth SSRF (CVSS 10.0) and post-auth command injection.
- News
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
SonicWall confirms active exploitation of a chained SSRF and OS command injection pair in SMA 1000 appliances, its third such attack chain in a year.
- Security
CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
A post-auth OS command injection in the SMA1000 Management Console, chained with a pre-auth SSRF flaw, gives attackers unauthenticated root-level RCE.
- News
Why Even the Best Edge Security Still Misses High-Risk Sessions
Attackers hide behind residential proxies and VPNs to look legitimate to edge security. Session enrichment adds the context defenses are missing.
- News
737 Chrome VPN Extensions Caught Routing Traffic Through Attacker Proxies
Socket researchers found 737 fake Chrome VPN extensions silently routing 75,000+ users through SOCKS5 proxies on port 1082, enabling full AiTM interception.
- News
Cisco Warns of ASA and FTD VPN Flaw Actively Exploited to Crash Firewalls
CVE-2026-20349 (CVSS 8.6) in Cisco ASA and FTD allows unauthenticated remote attackers to crash SSL VPN devices via crafted HTTP requests — no workaround...
- News
INC Ransomware Emerges as Dominant Threat Actor Exploiting SonicWall SMA 1000 Flaws
INC Ransomware has emerged as the dominant threat actor accelerating exploitation of recently disclosed SonicWall Secure Mobile Access 1000 series VPN...
- HOWTO
WireGuard VPN: Secure Remote Access for IT Professionals
Deploy a modern, high-performance WireGuard VPN server on Linux for secure remote access. Covers server setup, client configuration, multi-peer...
- Security
CVE-2026-47724: nebula-mesh API Authorization Bypass Enables Cross-Tenant Takeover (CVSS 9.9)
A critical authorization bypass in nebula-mesh, the self-hosted control plane for Slack's Nebula VPN, allows any holder of a non-admin operator API key to...
- News
Critical Palo Alto VPN Bug Now Exploited by Qilin Ransomware Gang
The Qilin ransomware gang is actively exploiting a critical PAN-OS GlobalProtect authentication bypass vulnerability to breach enterprise networks,...
- News
SonicWall SMA1000 Flaws Exploited as Zero-Days to Push Custom Malware
Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks before patches were available, allowing threat...
- News
SonicWall SMA 1000 Zero-Days Exploited in the Wild Before Public Disclosure
A previously undocumented threat actor tracked as UTA0215 by Volexity exploited multiple zero-day vulnerabilities in SonicWall Secure Mobile Access 1000...
- News
SonicWall Warns of Two Zero-Day Exploits Targeting SMA1000 — Patch Immediately
SonicWall has issued an urgent advisory warning of two zero-day vulnerabilities in its SMA1000 appliances — CVE-2026-15409 and CVE-2026-15410 — that can...
- News
Why Patch Directives Only Go So Far
Six weeks of undetected access through a compromised VPN appliance exposes a hard truth: patching is necessary but not sufficient. Organisations already...
- News
FortiBleed Leak Exposes Fortinet VPN Credentials for 73,000 Devices
A data leak dubbed FortiBleed has exposed configuration files and VPN credentials for 73,932 Fortinet firewall URLs, putting organizations worldwide at...
- News
Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw
Palo Alto Networks has confirmed active exploitation of CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect portals carrying a...
- News
Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
This week's security roundup covers an actively exploited Chrome zero-day, attackers abusing UniFi network controllers, fresh macOS infostealer campaigns,...
- News
Check Point VPN Zero-Day Exploited Since Early May by Qilin Ransomware
A critical zero-day vulnerability in Check Point's VPN products has been under active exploitation since at least early May 2026, with a Qilin ransomware...
- News
CISA Gives Feds 3 Days to Patch Check Point VPN Bug Exploited as Zero-Day
CISA ordered federal agencies to patch a critical Check Point Remote Access VPN flaw within 3 days after Qilin ransomware affiliates were confirmed...
- News
''First VPN'' Cybercrime Service Disrupted, Administrator
The FBI and international partners have disrupted First VPN, a criminal VPN service used by dozens of ransomware groups for network reconnaissance and...
- News
First VPN Dismantled in Global Takedown Over Use by 25
International authorities have disrupted a criminal VPN service called First VPN that was used by more than 25 ransomware groups to conceal network...
- News
Europe Dismantles VPN Service Used by Cybercriminals to Hide Ransomware Attacks
European law enforcement has taken down First VPN, a privacy service that had been openly advertised on Russian-language cybercrime forums as a tool for...
- News
Police Seize 'First VPN' Service Used in Ransomware and Data Theft Attacks
International law enforcement has dismantled 'First VPN,' a criminal VPN service marketed on Russian-speaking cybercrime forums and used to facilitate...
- News
Hackers Bypass SonicWall VPN MFA Due to Incomplete Patching
Threat actors brute-forced credentials and bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances to deploy ransomware tools,...
- Project
WireGuard Road Warrior VPN Server
Build a self-hosted WireGuard VPN server on Ubuntu for secure remote access — with NAT masquerading, DNS leak protection, QR-code client provisioning, and...
- Checklist
Network Security Audit Checklist
Systematic audit checklist for network infrastructure security — firewall rules, segmentation, VPN configuration, DNS security, wireless security, and...
- Security
Critical PAN-OS GlobalProtect Gateway RCE Vulnerability
A critical unauthenticated remote code execution vulnerability in Palo Alto Networks PAN-OS GlobalProtect gateway allows complete firewall takeover. CVSS 9.8.
- HOWTO
FortiGate IPsec VPN: Site-to-Site with Azure
Configure IPsec site-to-site VPN between FortiGate firewall and Azure VPN Gateway. Covers IKE configuration, routing, BGP, and high availability.
- HOWTO
FortiGate SSL VPN Setup: Secure Remote Access Configuration
Configure FortiGate SSL VPN for secure remote user access. Covers portal setup, user authentication, firewall policies, and FortiClient configuration.
- Security
Critical Vulnerability Discovered in Popular Enterprise VPN
Security researchers have identified a severe authentication bypass vulnerability affecting multiple enterprise VPN products. Immediate patching recommended.
- HOWTO
WireGuard VPN Setup and Security Hardening on Linux
Deploy a hardened WireGuard VPN server on Linux — key generation, server and client config, firewall rules, and security best practices for production use.
- News
Ivanti Connect Secure Under Active Attack - CISA Issues
CISA has issued an emergency directive requiring federal agencies to mitigate Ivanti Connect Secure vulnerabilities within 48 hours as active exploitation...