Hackers Actively Exploiting ArrayOS AG VPN Vulnerability to Deploy Webshells

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Hackers Exploit ArrayOS AG VPN Vulnerability to Deploy Webshells Threat actors are exploiting a command injection vulnerability in ArrayOS AG VPN devices to deploy webshells and create unauthorized user accounts. The vulnerability has been actively targeted since at least August 2025, affecting various organizations. Array Networks issued a security update in May 2025 to address the flaw, but it remains untracked due to the lack of an assigned identifier. 4 sources 38