IT Daily Roundup: October 11, 2026
1. Researchers release working AnyDesk Linux 8.0.2 exploit, patch has been available since June
Researchers published a proof-of-concept exploit called AnyPwn on GitHub on October 8, 2026. The flaw is a heap buffer overflow in the session protocol's mode-5 packet handling, caused by unchecked 32-bit arithmetic. An attacker only needs access to TCP port 7070 and can execute arbitrary code as root without any authentication. Windows and macOS are not affected.
The fix has been available since June 2026 as version 8.0.3, with the latest release at 8.1.0. AnyDesk described the fix in its changelog only as a "bug fix that could lead to a crash." The exploit is probabilistic and depends on heap layout, but it works.
Why this matters: AnyDesk is one of the most common remote management tools at client sites and within IT firms. Check the version on every Linux system running AnyDesk and update to at least 8.0.3. If an immediate update is not possible, restrict access to TCP port 7070 to trusted IP addresses only.
2. Attackers scan SonicWall SMA1000 for SSRF flaw CVE-2026-102255, patch released October 6
SonicWall released a patch for CVE-2026-102255 on October 6, 2026, affecting SMA1000 6210, 7210, and 8200v appliances. The flaw is in the Appliance WorkPlace interface: a remote, unauthenticated attacker can force the appliance to issue requests on their behalf into the internal network and perform unauthorized operations. The SMA 100 Series and SSL-VPN on firewall appliances are not affected.
Previdian's honeypot network detected active exploitation attempts on October 9. Three days after the patch shipped. Whether any attempt succeeded has not been confirmed.
Why this matters: SonicWall SMA1000 acts as a VPN gateway in many mid-sized environments. If you manage one for a client, the patch is waiting. Check security advisory SNWLID-2026-0017 on SonicWall's website and apply the firmware update. This is one to handle promptly.
3. The South Korean bank attacks showed what an AI agent can do in the wrong hands
A Chinese-speaking attacker used the open-source ARTEX platform together with Claude agents to breach Shinhan Bank, KB Kookmin Bank, and Hana Bank in early October 2026. ARTEX is an agentic penetration testing tool developed in China. It used DeepSeek v4.1-flash as its primary language model, supplemented by GLM-5.3 and Grok 4.6. Client personal data and credit card numbers were exposed, some systems went offline temporarily. The South Korean government called an emergency meeting.
Records found on the attacker's infrastructure included Claude Code sessions, ARTEX configuration files, and agent memory files. The ARTEX developer closed the project after confirmed real-world use. Derivatives of its code remain available, according to researchers.
← All postsWhy this matters: This is the first publicly documented case of an attacker deploying an agentic AI platform in a coordinated attack on financial institutions. For most businesses, the direct risk is not immediate. But the signal is clear: monitoring for anomalous network behavior and auditing access to AI APIs are controls that are becoming relevant sooner than expected.