Podcast

Cyber Briefing (2026-08-05): INC Ransomware SonicWall SMA zero-day at scale, Langflow RCE on KEV, cPanel SQL-root escalation

INC Ransomware claims 885 victims on SonicWall SMA 1000 zero-days CVE-2026-15409/15410 with TOTP seed theft. CISA adds Langflow CVE-2026-9198 RCE to KEV. cPanel CVE-2026-58048 (CVSS 9.4) SQL-root escalation.

Glenn Fryklund

Glenn Fryklund

— 5 min read
Share
Synthetic voice disclosure: This episode was produced with a synthetic voice. It is not read by a human narrator. If AI narration grates, consider muting during commutes and listening once with headphones; quality degrades gracefully after familiarization.

Episode Summary

INC Ransomware claims 885 victims exploiting SonicWall SMA 1000 zero-days (CVE-2026-15409/15410). Attackers steal TOTP seeds, making password resets ineffective. CISA added Langflow CVE-2026-9198 to KEV: unauthenticated RCE via a chained auto-login endpoint that runs user Python code without sandbox isolation. cPanel CVE-2026-58048 (CVSS 9.4) lets authenticated users execute SQL as database root; no confirmed exploitation but 370k+ exposed instances.

Episode: daily-2026-08-05 | Type: Daily Briefing | Runtime: ~13.8 min | Hosts: Marcus & Priya | QA: gates passed, PUBLISH_WITH_NOTE (approved for publish; runtime slightly over daily target but non-blocking, zero blocking findings). qa_report.json, docker-worker, 2026-08-09T19:43Z

Stories Covered

1. INC Ransomware dominates SonicWall SMA 1000 exploitation

Lead story: 885 victims claimed on the INC leak site as of Aug 2, spanning the US, Australia, UAE, Colombia, and Switzerland

Confirmed facts:

  • CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 form a two-zero-day chain in SonicWall SMA 1000 VPN appliances.
  • Fixes released by SonicWall mid-July 2026; pre-disclosure exploitation observed June 22, attributed to the UTA0533 threat cluster by Volexity.
  • INC Ransomware uses the KNUCKLEBALL Python script, the Suo5 HTTP proxy, and the ORANGETAIL Java web shell for ransomware delivery at scale.
  • Attackers extract session databases and TOTP MFA seeds; password resets do not evict persisted access (Suzu Labs).
  • 885 victims claimed on the INC leak site as of Aug 2, spanning the US, Australia, UAE, Colombia, and Switzerland.

Analysis:

  • The SonicWall SMA zero-day directly contradicts the core assumption that perimeter hardware keeps attackers out.
  • TOTP seed theft creates a persistent MFA bypass. That is 'assume compromise' territory per Volexity.
  • The pre-planning timeline (call attempts on registered numbers before public disclosure) indicates a coordinated attack, not opportunistic.

Defender actions:

  • Verify firmware on every SMA 1000 appliance (must be >= 12.4.3.0.3453 or >= 12.5.0.2835); take internet-exposed units offline immediately if the version cannot be confirmed.
  • Audit gateway access logs for sessions from IPs outside known-remote-worker geography during the June 22-July 16 window; watch for multiple concurrent sessions to the same admin account.
  • Rotate ALL MFA seeds (TOTP). Resetting passwords alone is insufficient per the Suzu Labs analysis.

Uncertainties:

  • Full scope of SMA 1000 appliances affected globally is unknown.
  • Whether TOTP seed extraction is used selectively or as a standard persistence technique is unconfirmed.
  • The number of organizations in the US/Australia/UAE/Colombia/Switzerland affected is not yet identified.

Sources:

2. CISA adds Langflow RCE to KEV

Follow-up story: Unauthenticated code execution via auto-login chain

Confirmed facts:

  • CVE-2026-9198 (CVSS 9.8) added to CISA KEV on August 4; BOD 26-04 due date August 7.
  • The /api/v1/auto_login endpoint mints SUPERUSER JWT tokens for any network caller without authentication.
  • The /api/v1/validate/code endpoint passes user-supplied code to Python exec() with no sandbox isolation.
  • Affected range: IBM Langflow OSS 1.0.0 through 1.10.0. Three critical RCEs in six months across two versions.
  • A PoC exploit is available on GitHub demonstrating the end-to-end unauthenticated RCE chain.

Analysis:

  • A structural parallel to SonicWall: both are tools deployed for protection/management that become initial-access vehicles.
  • exec() without a sandbox means confirmed exploitation cascades to every API key, secret, and downstream model endpoint accessible by the service account.
  • Three critical RCEs in six months across two versions indicates a systemic design flaw, not isolated bugs.

Defender actions:

  • Upgrade immediately to a version later than 1.10.0, or test /api/v1/auto_login with curl; if it returns a JWT without auth, isolate until patched.
  • Rotate ALL secrets accessible to the Langflow service account (API keys, database connection strings, OAuth tokens).
  • Audit user-submitted flows for imports from network libraries or external endpoint access patterns.

Uncertainties:

  • How many exposed Langflow instances are currently internet-reachable in production is unknown.
  • Whether other Langflow RCE vulns (e.g. CVE-2025-3248) remain under active exploitation alongside this one.

Sources:

3. cPanel CVE-2026-58048: authenticated users can execute SQL as database root

Quick hit

Confirmed facts:

  • CVE-2026-58048 is CVSS 9.4 (AV:N/AC:L/AT:N/PR:L/UI:N).
  • Root cause: the database rename function fails to preserve SQL execution context, allowing root-level SQL from authenticated shared-hosting customers.
  • Fixed in cPanel versions 11.110.0.137, 11.126.0.78, 11.134.0.48, and later builds across all supported lines.
  • Not yet exploited in the wild at time of reporting (Aug 3-4); no KEV status confirmed.

Analysis:

  • A classic design-level trust boundary failure. Not a misconfiguration but a fundamental implementation flaw where authenticated access modifies SQL mode.
  • With 370k+ exposed instances, KEV elevation is likely regardless of confirmed in-the-wild activity.

Defender actions:

  • Apply patched cPanel versions across all supported lines today for every instance regardless of exposure level.
  • Audit access logs for unusual geographic regions since the patches shipped; monitor MySQL process activity after rename operations.
  • Rotate credentials for every account with MySQL or MariaDB feature access. This is a design-level trust boundary failure.

Uncertainties:

  • Current exploitation status: may be under active use without public disclosure yet.
  • Exact scope of OS-level escalation paths remains unclear.

Sources:

Terms Explained

TOTP seed: A secret value used by authenticator apps to generate time-based one-time passwords for MFA. If stolen, password resets alone do not invalidate the attacker's access.

KEV (Known Exploited Vulnerabilities): CISA's catalog of vulnerabilities confirmed as actively exploited in the wild; adding a CVE triggers a 14-day BOD remediation requirement for federal agencies.

exec() without sandbox: Python code execution that runs user-supplied input directly on the host system with no isolation. Equivalent to running arbitrary OS commands.

SQL mode corruption: A database engine state error where intended restriction settings are silently dropped during certain operations, allowing unexpected privilege escalation.

Uncertainties / Watch Items

  • Full scope of SMA 1000 appliances affected globally.
  • Whether TOTP seed extraction is a standard persistence technique across all INC Ransomware campaigns (unconfirmed).
  • Number of exposed Langflow instances currently internet-reachable in production (unknown).
  • CVE-2026-58048 KEV elevation timeline given 370k+ exposed instances.
  • Whether Apache Traffic Server CVEs have been added to CISA KEV.

Episode ID: daily-2026-08-05 | Synthetic voice (supertonic-M3 / supertonic-F2) | Date: 2026-08-05 | Malwlab Cyber Briefing

Topics:

Read more