CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

Threat actors are actively exploiting seven newly catalogued vulnerabilities across widely deployed products from SonicWall, Sangoma, JFrog, and others, using them to deploy reverse shells, escalate privileges, and install cryptocurrency miners. The chaining of multiple vulnerabilities — linked in at least one case to Qilin ransomware operators — demonstrates that unpatched systems in internet-facing positions can become entry points for severe, multi-stage attacks. CISA's Known Exploited Vulnerabilities catalog serves as a critical signal that these flaws are being weaponized in the wild, not just theoretically possible. Organizations that lack timely patch cycles or continuous vulnerability scanning are at acute risk of full compromise, data loss, or ransomware deployment.