INC Ransomware chains two SonicWall SMA 1000 zero-days to root, and the patch does not evict it
Two flaws in SonicWall SMA 1000 VPN gateways — a CVSS 10 SSRF and a code injection — were exploited as zero-days by INC Ransomware from July 2026. Applying the patch is necessary but not sufficient: attackers roll vulnerable firmware back to keep their foothold.