SANS StormCast: SonicWall SMA 1000 Exploits, AI Git Cloning Vulnerabilities, and Faronics Abuse

The September 3rd, 2026 SANS Internet Storm Center StormCast highlights an active exploit targeting SonicWall SMA 1000 series devices, chaining a server-side request forgery (SSRF) vulnerability to bypass authentication and a second flaw enabling arbitrary code execution. The SSRF allows attackers to use the web server as a proxy to access internal APIs without authentication. Additionally, AI agents cloning Git repositories are vulnerable to remote code execution due to malicious commands in .git configuration files, with eight tested agents all affected and four patched. Huntress reported threat actors abusing Faronics, a legitimate remote management tool, to evade detection while maintaining persistence. The episode references a detailed blog post on URL validation challenges at xclown.com.