Earlier this week SonicWall released hotfixes for its SMA1000 remote-access gateways (models 6210, 7210 and 8200v). One of them fixes a flaw rated the maximum 10 out of 10 that someone without a login could abuse. On Friday, security firms Previdian and Defused said they were seeing attack attempts against their own decoy SMA1000 devices, set up to catch attackers, BleepingComputer reported. Nobody has confirmed that any real customer device was broken into, SonicWall hasn’t confirmed attacks, and the flaw isn’t on CISA’s exploited list. Shadowserver counts more than 400 SMA1000 appliances reachable from the internet. Only the SMA1000 line is involved; SonicWall firewalls’ own SSL-VPN and the SMA 100 series are not.

If you have an SMA1000, or an IT provider runs one for you, check its version. According to SonicWall’s vulnerability record (CVE-2026-102255), 12.4.3-03526 and 12.5.0-02952 and anything older are affected. SonicWall’s own advisory page still wouldn’t load when we checked Monday, so the fixed versions come from press reports: SecurityWeek lists 12.4.3-03670 and 12.5.0-03082. Confirm them in your SonicWall support portal before you install. Gateways patched for July’s and September’s SMA1000 problems still need this one. After patching, look through the appliance’s admin accounts and logs for anything you don’t recognize. If you can’t patch right away, limit who can reach the Work Place portal from the internet. If a provider manages it, ask them in writing when they patched.

For everyone: security firm Push Security said Friday that a Google search ad for “claude mac” sent people, through a Bing link and a hacked website, to a convincing fake Claude download page. According to Push, the page showed Anthropic’s real install command, but its copy button put a different command on the clipboard, one that downloads something from the attackers. This comes from a single research firm, and BleepingComputer notes that what the download actually does is still unknown; there is no count of victims. What to do: skip “Sponsored” results when you download software, and type the company’s address yourself. Never paste a command from a web page into Terminal or PowerShell unless you reached that page from the vendor’s own site. If you already ran a Claude install command from an ad, disconnect from the internet, run your antivirus, and change the passwords saved in your browser from another device. IT managers: tell staff where approved AI tools come from, and consider blocking unapproved installers on managed Macs.

Still developing: grocery company Ahold Delhaize has taken systems offline after a cyberattack. It isn’t yet clear whether US stores or customers are affected; we’ll follow up if there’s something to do.