Security news.
Today's security landscape is dominated by critical infrastructure exploitation and severe systemic flaws, led by active attacks targeting Cisco firewalls and SD-WAN controllers alongside critical Linux kernel vulnerabilities. Organizations also face significant exposure risks from chained attacks against PHP core installations and large-scale credential leaks affecting developer ecosystems. Defense teams should prioritize patching internet-facing network appliances and monitoring Linux environments for emerging exploit activity.
Cisco Patches Actively Exploited ASA and FTD Zero-Day
Cisco has addressed a high-severity denial-of-service zero-day (CVE-2026-76418) in Adaptive Security Appliance and Threat Defense software that remote attackers are actively exploiting to crash VPN appliances.
APT Group Targets Cisco SD-WAN to Deploy KeyDrift Malware
State-sponsored actor UAT-11473 is actively exploiting an authentication-bypass flaw (CVE-2026-20127) in Cisco Catalyst SD-WAN Controllers to install a custom persistent malware framework.
Critical Linux Kernel TCP Bug Assigned 9.8 CVSS Rating
A remote root flaw in Linux kernel TCP code (CVE-2026-98432) impacts major distributions including Ubuntu and RHEL, with researchers already demonstrating automated exploit generation against unauthenticated servers.
CISA Warns of Fragnesia Linux Flaw Chained in PHP2Shell Attacks
Threat actors are actively chaining a high-severity Linux kernel privilege escalation flaw with recent PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to compromise server infrastructure.
Massive Leak Exposes Records of Over 41,000 DHS Employees
A significant data leak has exposed job assignments, phone numbers, and full names belonging to thousands of personnel across ICE, CBP, and other Department of Homeland Security components.
Telegram for Android Zero-Click Voice Call Vulnerability Patched
Security researchers disclosed a flaw in Telegram for Android that allowed remote attackers to gain full device control simply by having the target answer an incoming voice call.
GitHub Launches npm Firewall to Prevent Malicious Package Installs
GitHub introduced a public preview of an install-time package firewall that analyzes metadata and download streams to block suspicious and malicious npm dependencies before execution.
Over 26,000 Live Cloud and AI Credentials Leaked on Gitee
A scan across 7.25 million public code repositories on Gitee uncovered tens of thousands of active, exposed API keys and credentials primarily tied to enterprise cloud and AI infrastructure.