NEW NACHOVPN ATTACK USES ROGUE VPN SERVERS TO INSTALL MALICIOUS UPDATES

Summary from the TLDR InfoSec newsletter

"NachoVPN" vulnerabilities allow malicious VPN servers to install harmful updates on unpatched Palo Alto and SonicWall SSL-VPN clients. Attackers can trick users into connecting to rogue VPN servers through social engineering or phishing, potentially leading to credential theft and code execution. SonicWall and Palo Alto Networks have released patches to address the vulnerabilities. AmberWolf has provided additional details and an open-source tool.