Alert

BLUF: A magnitude 7.8 earthquake has struck 24 km WSW of Burias, Philippines. Personnel, facilities, and operations in the southern Philippines and surrounding region should treat this as an active life-safety emergency. Tsunami warnings may apply — verify immediately with official sources. DETAILS Seismic event confirmed: M7.8 earthquake, hypocenter depth 35.0 km — classified as a shallow to intermediate crustal event capable of significant surface damage and strong shaking across a wide radius Epicenter coordinates: 5.600°N, 125.065°E — approximately 24 km WSW of Burias, in the Mindanao/Davao del Sur region of the southern Philippines Depth note: At 35 km, ground motion intensity is expected to be severe near the epicenter; structural damage, landslides, and infrastructure disruption are plausible — extent of damage is currently UNCONFIRMED Tsunami risk: A shallow M7.8 offshore event in this region carries credible tsunami generation potential. PHIVOLCS and PTWC advisories should be consulted immediately. No confirmed tsunami data is included in this alert at time of writing Aftershock risk: Significant aftershocks are probable following an event of this magnitude — treat affected structures as potentially compromised IMPACT Geographic scope: Southern Philippines (Mindanao region), potentially coastal areas of Indonesia, Palau, and surrounding Pacific basin if tsunami is generated Affected populations: Civilian and organizational personnel in Davao del Sur, Sarangani, and adjacent provinces Infrastructure: Communications, power, and transport links in the affected region may be degraded or severed Organizational risk: Any personnel, assets, or operational dependencies located in the southern Philippines should be considered potentially impacted until accountability is confirmed RECOMMENDED ACTIONS Immediately account for all personnel known to be in the southern Philippines region Consult PHIVOLCS (Philippine Institute of Volcanology and Seismology) and Pacific Tsunami Warning Center (PTWC) for official tsunami advisories — do not wait for internal confirmation Coastal personnel: Move to high ground NOW if in the affected region — do not wait for official warning if shaking was felt Activate continuity of operations plans for any facilities or dependencies in the affected area Do not re-enter damaged structures until cleared by local authorities Monitor official channels — NDRRMC (Philippines), USGS, and PTWC for updates SOURCES USGS Earthquake Hazards Program (trigger data) PHIVOLCS — verify at: phivolcs.dost.gov.ph (advisory status at time of alert: UNCONFIRMED) Pacific Tsunami Warning Center — verify at: tsunami.gov (advisory status at time of alert: UNCONFIRMED) ⚠️ UNCERTAINTY FLAG: Damage reports, casualty figures, and tsunami advisory status are NOT confirmed in this alert. This alert is based solely on seismic event parameters. Treat all downstream impact assessments as preliminary until official sources confirm. ...

BLUF: Apple has released Safari 26.5, a security update addressing vulnerabilities in the Safari browser. All users running affected versions of Safari on macOS, iOS, and iPadOS should apply this update immediately. Specific CVE details have not been confirmed at time of publication. DETAILS Apple has officially released Safari 26.5 as a security-focused update; the release is confirmed. CVE identifiers, vulnerability descriptions, severity ratings, and exploitation status have not been independently confirmed at time of this alert — full details are expected at Apple’s official advisory page: https://support.apple.com/en-us/100100 It is unknown at this time whether any vulnerabilities addressed in this release are being actively exploited in the wild. Safari updates typically address WebKit engine vulnerabilities, which can include remote code execution, cross-site scripting, and sandbox escape issues — however, no specific vulnerability class has been confirmed for this release. This alert will be updated as CVE details become available from Apple’s Security Updates page. IMPACT Who is affected: All users of Safari on macOS, iOS, and iPadOS running versions prior to Safari 26.5. Scope: Potentially broad — Safari is the default browser on all Apple platforms and is used by hundreds of millions of users globally. Severity: Cannot be assessed until CVE details are published. WebKit vulnerabilities historically range from moderate to critical. RECOMMENDED ACTIONS Update Safari immediately via System Settings → General → Software Update (macOS) or Settings → General → Software Update (iOS/iPadOS). Monitor Apple’s official advisory at https://support.apple.com/en-us/100100 for CVE details and severity ratings as they are published. Do not wait for severity confirmation — apply the update now given Apple’s standard practice of patching actively exploited vulnerabilities without pre-disclosure. Enterprise/MDM administrators: Push Safari 26.5 to managed devices and verify deployment compliance. Revisit this alert once CVE details are confirmed to assess whether additional mitigations are required. SOURCES Apple Software Updates: https://support.apple.com/en-us/100100 (CVE details pending at time of publication) Apple Security Updates portal: https://support.apple.com/en-us/111900 ⚠️ UNCERTAINTY FLAG: Vulnerability specifics, severity scores, and exploitation status are unconfirmed. This alert is based solely on the confirmed release of Safari 26.5 as a security update. Reassess upon Apple’s full advisory publication.

BLUF: Apple has issued macOS Tahoe 26.5.1, an out-of-cycle security update. All users running macOS Tahoe should apply this update immediately. Specific CVE details and vulnerability severity are not yet confirmed — treat as critical until Apple’s advisory is fully published. DETAILS Apple released macOS Tahoe 26.5.1 as a point release, indicating a targeted security fix rather than a routine feature update — out-of-cycle releases of this type historically address actively exploited or high-severity vulnerabilities. CVE identifiers and technical vulnerability details have not been independently confirmed at time of publication. Apple’s official advisory is located at: https://support.apple.com/en-us/100100 The nature of the vulnerability (local privilege escalation, remote code execution, kernel-level, etc.) is unconfirmed — do not assume scope until Apple’s advisory is fully populated. No public threat actor attribution or confirmed in-the-wild exploitation has been verified at this time. This may change as Apple’s advisory is updated. Apple typically withholds full CVE detail for a short period post-release to allow user adoption before exploitation attempts increase. IMPACT Affected: All systems running macOS Tahoe (26.x) prior to version 26.5.1 Scope: Potentially all macOS Tahoe users — enterprise and consumer Unaffected: Earlier macOS versions (Sequoia, Sonoma, Ventura) are not addressed by this specific update; separate advisories may follow Severity: UNKNOWN — pending Apple advisory confirmation. Treat as high-severity based on out-of-cycle release pattern. RECOMMENDED ACTIONS Apply macOS Tahoe 26.5.1 immediately via System Settings → General → Software Update Monitor Apple’s security advisory at https://support.apple.com/en-us/100100 for CVE details and severity ratings — check every 30–60 minutes until populated Enterprise teams: Prioritize deployment through MDM (Jamf, Kandji, Mosyle, etc.) — do not wait for standard patch cycle Do not assume scope is limited — until CVEs are confirmed, treat all macOS Tahoe endpoints as potentially exposed Review EDR telemetry on macOS endpoints for anomalous activity predating this advisory SOURCES Apple Software Update (macOS Tahoe 26.5.1 release) Apple Security Advisory portal: https://support.apple.com/en-us/100100 CVE details: PENDING — not yet confirmed at time of publication ⚠️ UNCERTAINTY FLAG: Vulnerability class, severity, and exploitation status are unconfirmed. This alert will require revision once Apple’s advisory is fully published. Do not over-scope response until CVEs are confirmed.

BLUF: Apple has released iOS 26.5.1 as an out-of-cycle security update. All iOS users should update immediately. CVE details are pending confirmation — specific vulnerability scope is not yet verified. DETAILS Apple released iOS 26.5.1 outside of its standard release cadence, indicating one or more security vulnerabilities of sufficient severity to warrant an emergency patch. CVE specifics have not been independently confirmed at time of publication. Apple’s official advisory is located at https://support.apple.com/en-us/100100 — users should consult this page directly for authoritative vulnerability details. Out-of-cycle iOS releases historically correlate with actively exploited vulnerabilities, zero-days, or critical kernel/WebKit flaws. This has not been confirmed for this release — treat as precautionary context only. Whether exploitation in the wild has been observed is unconfirmed at this time. No related threat actor attribution or exploit chain details are available at time of writing. IMPACT Affected: All iOS users running versions prior to 26.5.1. Scope: Potentially all iPhone models compatible with iOS 26. Exact model exclusions unknown pending full advisory review. Risk level: Cannot be precisely assessed until CVEs are confirmed. Emergency release cadence elevates assumed risk. RECOMMENDED ACTIONS Update immediately: Navigate to Settings → General → Software Update and install iOS 26.5.1. Review Apple’s advisory at https://support.apple.com/en-us/100100 for CVE numbers, affected components, and exploitation status once populated. Enterprise/MDM teams: Push forced update policy for managed iOS devices. Prioritize devices with access to sensitive systems or corporate credentials. Monitor Apple’s security updates page for advisory amendments — CVE details are sometimes published hours after initial release. Do not wait for organizational change windows if exploitation in the wild is subsequently confirmed. SOURCES Apple Software Releases: https://support.apple.com/en-us/100100 CVE details: PENDING — not confirmed at time of publication Exploitation status: UNCONFIRMED Alert will require update once Apple’s full advisory is published. Treat all unconfirmed elements as preliminary.

BLUF: Cisco has disclosed an unpatched zero-day vulnerability in its SD-WAN software that is actively being exploited in the wild. Organizations running Cisco SD-WAN products are at immediate risk. No patch is currently available. Mitigations should be applied immediately pending vendor fix. DETAILS Cisco has publicly warned of a zero-day vulnerability affecting its SD-WAN product line that is confirmed to be actively exploited in attacks No patch has been released at time of disclosure — this is an unmitigated vulnerability with known in-the-wild exploitation Source reporting originates from BleepingComputer citing Cisco’s own advisory; specific CVE identifier, CVSS score, and technical exploitation details have not been confirmed in the information provided — treat specifics as pending verification The attack vector, required privileges, and whether exploitation requires authentication are not confirmed in available details — organizations should consult Cisco’s official advisory directly for technical specifics Cisco SD-WAN is widely deployed in enterprise and service provider environments for network edge management, increasing potential blast radius IMPACT Who is affected: Organizations and managed service providers running Cisco SD-WAN solutions — scope is potentially broad given enterprise-wide deployment of this product line What is at risk: Network infrastructure, edge routing, and potentially connected internal segments depending on exploitation capability — exact impact scope unconfirmed pending full advisory details Exploitation status: Confirmed active — this is not theoretical RECOMMENDED ACTIONS Immediately review Cisco’s official security advisory at cisco.com/go/psirt for confirmed technical details, affected versions, and available workarounds Identify all SD-WAN assets in your environment and assess exposure — prioritize internet-facing management interfaces Apply any Cisco-recommended mitigations or workarounds in the absence of a patch — restrict management plane access where possible Increase monitoring on SD-WAN infrastructure for anomalous activity, unauthorized configuration changes, or lateral movement indicators Do not wait for a patch — implement compensating controls now and establish a patch deployment plan for when a fix is released Notify stakeholders and escalate to incident response posture if SD-WAN devices are exposed to untrusted networks SOURCES BleepingComputer — Cisco warns of unpatched SD-WAN zero-day exploited in attacks Cisco PSIRT (consult directly for authoritative technical details) ⚠️ UNCERTAINTY FLAG: Technical specifics including CVE, affected version list, attack vector, and exploitation method are not confirmed in available reporting. All operational decisions should be validated against Cisco’s official advisory before implementation.

BLUF: Cisco has disclosed a seventh actively exploited zero-day vulnerability in its SD-WAN software in 2026. CVE-2026-20245 enables arbitrary command execution as root on affected devices. No patch is currently available. Organizations running Cisco SD-WAN should treat this as an active threat and implement mitigations immediately. DETAILS CVE-2026-20245 has been publicly disclosed by Cisco and is confirmed under active exploitation in the wild as of this reporting. The vulnerability permits arbitrary command execution at root-level privilege, representing full system compromise of affected SD-WAN nodes. This is the seventh Cisco SD-WAN zero-day confirmed exploited in 2026, indicating a sustained and targeted focus on this product line by threat actors — the pattern and actor attribution are not confirmed in available reporting. No patch has been released by Cisco at time of publication. Cisco has issued an advisory; specific affected software versions and workaround guidance should be confirmed directly via Cisco’s Security Advisory portal. Scope of exploitation — including whether attacks are targeted or opportunistic — is not confirmed in current reporting. IMPACT Directly affected: Organizations deploying Cisco SD-WAN solutions, including enterprise, government, and critical infrastructure environments. Severity: Critical. Root-level command execution on network infrastructure devices can enable lateral movement, traffic interception, persistent access, and full network compromise. Broader context: The 2026 Verizon DBIR and ongoing Patch Tuesday cycles reflect an elevated vulnerability exploitation tempo this year; Cisco SD-WAN has been a recurring target throughout 2026. RECOMMENDED ACTIONS Check Cisco’s official Security Advisory for CVE-2026-20245 immediately — confirm whether your specific SD-WAN software version and deployment model are affected. Apply any available workarounds or mitigations published by Cisco in lieu of a patch. Do not wait for a patch before acting. Restrict management-plane access to SD-WAN controllers and edge devices — limit to trusted IPs, enforce MFA, disable unnecessary remote access interfaces. Increase monitoring on SD-WAN infrastructure for anomalous command execution, unexpected process spawning, or unusual outbound connections. Prioritize patching the moment Cisco releases a fix — given the active exploitation status, patch deployment windows should be treated as emergency, not routine. SOURCES SecurityWeek — Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 (primary source) Cisco Security Advisory portal — verify CVE-2026-20245 details directly at cisco.com/security ⚠️ UNCERTAINTY FLAG: Specific affected product versions, exploitation scale, and threat actor attribution are not confirmed in available reporting. Consult Cisco’s official advisory for authoritative scope and mitigation details before taking action. ...

BLUF: UDM-Pro firewall dropped suspicious internal traffic originating from 192.168.1.33. Device on local network attempted outbound or lateral communication that triggered IPS rules. Investigate 192.168.1.33 immediately for signs of compromise. DETAILS Trigger: Intrusion Prevention System (IPS) fired on UDM-Pro; action taken was DROP — traffic was blocked, not permitted Source IP: 192.168.1.33 — a device on the internal LAN segment; identity of device is unconfirmed at this time Direction: Internal — traffic originated inside the network perimeter, indicating a potentially compromised or misbehaving internal host Threat type: Classified as firewall/IPS event; specific signature, destination IP, destination port, and protocol are not confirmed in available data Single event detected — whether this is isolated or part of a pattern of activity from this host is unknown pending log review IMPACT Scope: Contained to internal network segment at time of detection; firewall action was DROP, meaning the specific traffic was blocked Affected asset: Device at 192.168.1.33 — identity unknown; could be workstation, IoT device, server, or guest device Risk: Internal origin is significant — if host is compromised, lateral movement to other LAN assets is possible regardless of this single block Broader context (unconfirmed relevance): Active threat landscape includes GlassWorm supply chain malware, HazyBeacon C2-over-AWS activity, and NTLMv2 hash theft via Windows Search URI — any of which could produce anomalous internal traffic patterns consistent with this event. No direct link to this event is confirmed. RECOMMENDED ACTIONS Identify 192.168.1.33 — check DHCP leases, ARP tables, or UDM-Pro client list to determine device type and owner immediately Pull full IPS logs from UDM-Pro for this event — capture destination IP, port, protocol, and full signature name before logs rotate Isolate the host — if device identity is confirmed, consider VLAN isolation or port block pending investigation Check for repeat events — query logs for any prior or subsequent traffic from 192.168.1.33 in the last 24–72 hours Run endpoint scan on identified device if accessible — prioritize EDR or AV scan given active supply chain and malware campaigns in current threat environment Do not dismiss as false positive until signature and destination are reviewed — internal-origin IPS drops warrant higher scrutiny than perimeter events SOURCES UDM-Pro IPS Event Log — FW DROP, internal direction, source 192.168.1.33 Threat context: The Hacker News (GlassWorm, HazyBeacon, NTLMv2 vulnerability reporting) ⚠️ Threat context items cited for situational awareness only — no confirmed connection to this event

BLUF: A device at 192.168.1.42 is exhibiting worm behavior consistent with TheMoon malware targeting Linksys routers. The attack was directed at the network gateway (192.168.1.1). The UDM-Pro IPS blocked the attempt. Immediate device isolation and investigation required. DETAILS IPS signature ET WORM TheMoon.linksys.router triggered on UDM-Pro; action taken was block — the attack did not reach the gateway Source device 192.168.1.42 initiated the connection on source port 5432 targeting the gateway at 192.168.1.1 TheMoon is a known worm that exploits vulnerabilities in Linksys (and similar SOHO) routers to propagate, execute unauthorized commands, and enlist devices into proxy botnets Direction logged as inbound to the UDM-Pro’s inspection engine — originating from inside the local network segment No additional context is available on the identity, type, or current state of the device at 192.168.1.42 — nature and extent of compromise on that host is unconfirmed IMPACT Affected: Device at 192.168.1.42 (identity unknown — investigate immediately); network gateway 192.168.1.1 Scope: Contained to local network segment at this time; IPS block prevented gateway exploitation Risk if unmitigated: Successful router compromise could enable traffic interception, DNS hijacking, lateral movement, or enrollment in a proxy botnet Unknown: Whether 192.168.1.42 has made additional outbound or lateral connections not captured by this alert; whether other internal hosts have been targeted RECOMMENDED ACTIONS Isolate 192.168.1.42 immediately — remove from network or apply a block rule at the UDM-Pro until the device is identified and assessed Identify the device — check DHCP leases, ARP tables, and UDM-Pro client lists to determine device type and owner Review IPS/firewall logs for any additional signatures or connections from 192.168.1.42, particularly outbound to known TheMoon C2 infrastructure Check the gateway (192.168.1.1) for signs of tampering — verify firmware integrity, admin credentials, and configuration Scan the network for additional devices exhibiting similar behavior; TheMoon is self-propagating and may have spread from another host Do not reconnect 192.168.1.42 until it has been fully reimaged or confirmed clean SOURCES UDM-Pro IPS Event Log — ET WORM TheMoon.linksys.router 1 Emerging Threats signature database (ET WORM ruleset) TheMoon worm — publicly documented threat (first observed 2014; variants active through present)

BLUF: Apple has released macOS 26.5.1, a security update requiring immediate attention. All users and administrators running macOS should review and apply this update. Specific CVE details have not been confirmed at time of publication — consult Apple’s official advisory directly. DETAILS Apple has officially released macOS 26.5.1 as a security-focused update. CVE identifiers, vulnerability descriptions, and severity ratings have not been independently confirmed at time of this alert — details may be pending Apple’s full disclosure cycle. Apple’s official security content page for this release is available at: https://support.apple.com/en-us/100100 Whether this update addresses actively exploited vulnerabilities is unconfirmed at this time. Update availability may vary by device eligibility and macOS version compatibility. IMPACT Who is affected: All users and organizations running macOS on Apple hardware. Scope: Potentially enterprise-wide if macOS endpoints are unpatched; exact attack surface is unknown pending CVE disclosure. Exploitation status: Not confirmed. Treat as urgent until Apple’s advisory clarifies severity and exploitation status. RECOMMENDED ACTIONS Apply macOS 26.5.1 immediately via System Settings → General → Software Update on all eligible macOS devices. Review Apple’s official security advisory at https://support.apple.com/en-us/100100 for CVE details as they are published — this page may update after initial release. Prioritize managed/enterprise endpoints — push update via MDM (e.g., Jamf, Kandji) if applicable. Monitor for Apple’s full CVE disclosure — Apple sometimes publishes vulnerability details hours to days after initial release. Do not wait for CVE confirmation before patching in high-risk environments. SOURCES Apple Software Update (macOS 26.5.1 release) Apple Security Updates page: https://support.apple.com/en-us/100100 ⚠️ UNCERTAINTY FLAG: CVE identifiers, CVSS scores, affected components, and exploitation status are unconfirmed at time of publication. This alert will require update once Apple’s full security content is disclosed. Do not treat absence of CVE detail as indication of low severity. ...

BLUF: CISA has added CVE-2026-45247, a deserialization vulnerability in the Mirasvit Full Page Cache Warmer plugin, to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. Organizations running this Magento/Adobe Commerce extension should treat this as an immediate priority. DETAILS CVE-2026-45247 has been formally added to CISA’s KEV Catalog, indicating confirmed evidence of active exploitation — not merely theoretical risk. The vulnerability affects Mirasvit Full Page Cache Warmer, a widely used performance extension for Magento/Adobe Commerce e-commerce platforms. The vulnerability class is deserialization — a category historically associated with remote code execution (RCE) and full system compromise. ⚠️ Specific exploit chain and confirmed impact severity have not been fully disclosed in available source data at time of publication. CVSS score, patch availability, and affected version range are not confirmed in the triggering advisory — organizations should consult the CVE record and Mirasvit’s official channels directly. Federal civilian agencies are subject to mandatory remediation timelines under BOD 22-01. Private sector organizations are strongly encouraged to follow the same cadence. IMPACT Directly affected: Organizations operating Magento 2 / Adobe Commerce storefronts with the Mirasvit Full Page Cache Warmer extension installed. Scope: E-commerce environments globally. Deserialization flaws in this context may expose customer PII, payment data pipelines, and backend administrative access. Broader context: This advisory arrives amid an elevated threat tempo — CISA and industry sources are simultaneously tracking active exploitation of WordPress plugins, LMS platforms, and PHP supply chain packages, suggesting broad opportunistic scanning across web application stacks. RECOMMENDED ACTIONS Immediately audit all environments for presence of the Mirasvit Full Page Cache Warmer extension. Check Mirasvit’s official release channel for a patched version and apply without delay. If no patch is available, consider disabling the extension until remediation is confirmed. Review web server and application logs for anomalous deserialization activity or unexpected admin-level actions. Federal agencies: Remediate per BOD 22-01 mandatory timelines. Confirm compliance with your CISO. Monitor CISA’s KEV Catalog for updated guidance as additional details are released. ⚠️ UNCERTAINTY FLAGS Patch availability, affected version range, and confirmed CVSS score are not verified in source data. Do not assume a patch exists before checking vendor channels. Full exploitation impact (RCE, data exfiltration, privilege escalation) is not confirmed in available details. SOURCES CISA Known Exploited Vulnerabilities Catalog — cisa.gov/known-exploited-vulnerabilities-catalog CVE Record: CVE-2026-45247 — cve.org CISA Binding Operational Directive 22-01