Skip to content
Critical Exploits Target WordPress and SonicWall; Ledger Wallets Compromised

Critical Exploits Target WordPress and SonicWall; Ledger Wallets Compromised

First seen 14 Oct 2026, 18:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 19:36 UTC
  • •Two critical vulnerabilities (CVSS 10.0) are actively exploited: WordPress Bricksforge and SonicWall SMA 1000.
  • •Ledger hardware wallets sold via CryptoBilis are compromised, leading to significant cryptocurrency theft.
  • •Immediate action is required to patch or disable affected systems to mitigate risks.

A critical remote code execution vulnerability (CVE-2026-85097) in the WordPress Bricksforge plugin is being, allowing unauthenticated attackers to execute arbitrary code on affected sites. Simultaneously, a critical server-side request forgery vulnerability (CVE-2026-102255) in SonicWall SMA 1000 appliances is also under attack, with over 135 instances reported. Additionally, Ledger hardware wallets sold through a Southeast Asian reseller have been compromised by unauthorized spy chips, resulting in an estimated $90 million in stolen cryptocurrency. Ledger has suspended sales from affected resellers and is reviewing its security measures. The FBI has made arrests related to ransomware operations, indicating ongoing law enforcement actions against cybercrime. Security professionals are urged to patch or disable vulnerable systems immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-07
CVE-2026-102255 published
A critical SSRF vulnerability in SonicWall SMA 1000 appliances was disclosed, with a CVSS score of 10.0.
Defendwork
2026-10-08
CVE-2026-85097 published
A critical RCE vulnerability in the WordPress Bricksforge plugin was disclosed, with a CVSS score of 9.8.
Defendwork
2026-10-10
First public PoC for Bricksforge
Proof-of-concept code for the Bricksforge vulnerability was made public, increasing exploitation risk.
Defendwork
2026-10-12
First public PoC for SonicWall
Proof-of-concept code for the SonicWall vulnerability was released, facilitating potential attacks.
Defendwork
2026-10-13
Ledger spyware incident confirmed
Ledger confirmed unauthorized hardware implants in wallets sold via CryptoBilis, leading to $90 million theft.
Moneyweb.Co.Za

More articles in this cluster (2)

Following this threat?

Track AT&T and CVE-2026-102255 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (28)

1 / 3

Common questions

Which systems are affected by the vulnerabilities?
The WordPress Bricksforge plugin and SonicWall SMA 1000 appliances are affected by critical vulnerabilities.
What should I do if I use these systems?
Immediately patch or disable the vulnerable systems to prevent exploitation.
How can I verify if my Ledger wallet is compromised?
Check for tampering signs and follow Ledger's guidelines for inspecting your device.