Security news.
Critical enterprise infrastructure is under heavy fire today, led by active zero-day exploitation against Cisco firewall VPNs and state-backed intrusions targeting VMware ESXi. Administrators also face mounting pressure from active attacks leveraging PHP2Shell against exposed firewall interfaces, alongside significant mass data breaches at DHS and Sony. Prompt edge-device patching and strict credential audits should remain the immediate priorities.
Cisco Patches Actively Exploited ASA and FTD Zero-Day
Cisco has issued emergency patches for CVE-2026-76418 (CVSS 8.6), a high-severity flaw in Remote Access SSL VPN services that remote attackers are actively exploiting to crash firewall devices.
China-Linked Hackers Weaponize VMware ESX Zero-Day
CISA added CVE-2026-41709 to its KEV catalog following discoveries that China-linked group Warp Panda used the low-severity ESX flaw as a zero-day to tamper with logging and evade audit trails.
PHP2Shell Under Active Exploitation on Palo Alto Interfaces
Attackers are aggressively targeting internet-exposed Palo Alto Networks management interfaces using the recently disclosed critical PHP vulnerabilities to gain remote execution.
Volt Typhoon Links Found in Cisco SD-WAN KeyDrift Attacks
Cisco Talos linked the KeyDrift malware campaign—which exploited CVE-2026-20127 to steal SD-WAN traffic encryption keys—to infrastructure connected to Volt Typhoon's "Silent Train" network.
Telegram Android Zero-Click Voice Call RCE Patched
A critical vulnerability patched in Telegram v12.10.4 allowed threat actors to remotely execute code on Android devices simply when the recipient answered an incoming voice call.
41,000 DHS Employee Records Leaked Following SSO Breach
Work and personal details belonging to over 41,000 Department of Homeland Security personnel were leaked online following a compromise of an Okta single sign-on system.
Sony ISP Subsidiary Suffers Breach Exposing 2.6 Million Records
Hackers breached Sony Network Communications' Japanese ISP services (So-net and Plala), compromising 2.6 million customer records, over 54,000 email passwords, and banking details.
26,400 Valid Cloud and AI Credentials Found Exposed on Gitee
A scan across 7.25 million public Gitee code repositories revealed tens of thousands of active credentials, exposing critical cloud environments and commercial AI provider API keys.