⚡ Weekly Recap: Firewall Exploits, AI Data Theft, Android Hacks, APT Attacks, Insider Leaks & More

According to The Hacker News, threats this week show attackers no longer need a single mega-breach, but are weaponising widely trusted tools such as firewalls and edge devices.

Fortinet, SonicWall, Cisco, and WatchGuard reported exploits in their products, with Cisco noting attacks abusing CVE-2025-20393 in AsyncOS delivered by a China-nexus APT actor codenamed UAT-9686 to drop malware such as ReverseSSH, Chisel, AquaPurge and AquaShell, while SonicWall linked exploitation of CVE-2025-40602 (with CVE-2025-23006) to unauthenticated remote code execution on SMA 100 series devices.

The piece emphasises that firewalls and edge appliances have become a favourite attack surface, providing deeper visibility into traffic, VPNs and downstream systems. It also highlights that several CVEs across vendors are being actively exploited, underscoring the ongoing risk from unpatched vulnerabilities in trusted infrastructure.

The round-up also notes broader trends, including Android adware campaigns, government-focused intrusions, and evolving malware campaigns, painting a picture of a landscape where small cracks in trusted software can lead to widespread impact.