Breaking-Alert

Published Saturday, June 27, 2026 at 01:05 PM PT BLUF: Researchers at Pwn2Own Automotive 2026 continued Day Two exploitation demonstrations against automotive targets. Specific vulnerability details from this session are not fully confirmed in available data — treat all unpatched automotive systems as potentially at elevated risk pending vendor advisories. DETAILS: Pwn2Own Automotive 2026 is an ongoing multi-day competition hosted by Zero Day Initiative (ZDI) targeting automotive systems, including in-vehicle infotainment (IVI), EV charging infrastructure, and related components. Day Two continued sessions produced additional successful exploitation attempts; specific targets, CVE assignments, and technical details from this continuation block are not confirmed in available source data — full results have not been extracted from the trigger payload. Day One of the competition saw 30 entries targeting automotive systems; Day Two maintained elevated activity with stakes described as continuing to rise, per ZDI reporting. A full three-day schedule was completed, with Day Three results and a Master of Pwn designation also reported — indicating the competition has concluded and all demonstrated vulnerabilities are now in ZDI’s coordinated disclosure pipeline. NOTE: The trigger payload appears to contain a partial or malformed data extract (onload="this.classList.add("loaded")"). Specific exploit details for this session cannot be confirmed from available information. IMPACT: ...

Published Friday, June 26, 2026 at 07:00 PM PT BLUF: CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation in the wild. Federal Civilian Executive Branch (FCEB) agencies are under mandatory remediation timelines per BOD 22-01. All other organizations are strongly urged to treat these as priority remediation items. ...

Published Friday, June 26, 2026 at 12:59 PM PT BLUF: Australia’s Security Intelligence Organisation (ASIO) has confirmed state-sponsored actors compromised an Australian critical infrastructure operator’s network and were actively preparing to sabotage it. ASIO Director General Mike Burgess has characterized the threat as a direct “threat to life.” Critical infrastructure operators — particularly in Australia — should treat this as an active threat environment requiring immediate posture review. ...

Published Thursday, June 25, 2026 at 06:53 PM PT BLUF: Threat cluster CL-STA-1062 is actively targeting Southeast Asian government entities and critical infrastructure organizations in an espionage campaign deploying a custom backdoor. Affected organizations should immediately audit for indicators of compromise and review network egress activity. DETAILS Threat actor: Unit 42 tracks this activity under cluster designation CL-STA-1062; attribution beyond this designation is not confirmed in available reporting Targets: Government entities and critical infrastructure organizations across Southeast Asia — specific countries and sectors not confirmed in available details Tooling: Attackers are deploying a hybrid toolkit that includes a custom backdoor identified as TinyRCT; full capability scope of TinyRCT (persistence mechanisms, C2 infrastructure, exfiltration methods) is not confirmed in available details Objective: Campaign assessed as espionage-motivated; no destructive activity confirmed at this time Status: Campaign activity is active; timeline of initial compromise activity is not confirmed in available reporting IMPACT Who: Southeast Asian government ministries, agencies, and critical infrastructure operators are primary targets; third-party vendors or contractors with network access to these entities may face secondary exposure risk Scope: Regional — Southeast Asia; no confirmed spillover to other regions at this time Data at risk: Consistent with espionage objectives — sensitive government data, operational infrastructure details, and communications are likely collection priorities; specifics unconfirmed RECOMMENDED ACTIONS Hunt for TinyRCT indicators — request full IOC list from Unit 42 reporting; deploy signatures across endpoint and network detection tooling immediately Audit outbound network traffic — review anomalous egress connections, particularly to unfamiliar external infrastructure; espionage actors prioritize low-and-slow exfiltration Review privileged access — audit accounts with access to sensitive government or operational technology systems for unauthorized activity or credential misuse Patch and harden perimeter — ensure internet-facing systems are fully patched; espionage clusters frequently exploit known vulnerabilities for initial access Engage threat intelligence — organizations in the affected region should contact Palo Alto Unit 42 or national CERTs for full technical indicators SOURCES Primary: Palo Alto Networks Unit 42 — CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure Note: This alert reflects information available in the Unit 42 release summary. Full technical details, IOCs, and TTPs should be obtained directly from the Unit 42 report. Several details — including specific targeted countries, TinyRCT full capability profile, and initial access vectors — remain unconfirmed pending full report review.

Published Thursday, June 25, 2026 at 12:51 AM PT BLUF: A critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) was actively exploited in the wild for an extended period before Cisco disclosed and patched it. Attackers achieved root-level access at affected organizations, including at least one communications service provider. All organizations running Cisco Catalyst SD-WAN Manager must apply available patches immediately. DETAILS CVE-2026-20245 affects Cisco Catalyst SD-WAN Manager and was exploited as a zero-day — meaning no patch was available during the active exploitation window. Exploitation enabled attackers to gain root access to affected systems, according to reporting from Mandiant and Google Threat Intelligence. At least one communications service provider was confirmed as a victim, per CyberScoop reporting; broader targeting scope is not yet fully confirmed. Google Threat Intelligence observed attackers selectively deleting and restoring system configuration files as part of post-exploitation activity, suggesting deliberate operational security tradecraft. This is the 7th Cisco SD-WAN vulnerability exploited in 2026, indicating a sustained and targeted focus on this product line by threat actors. IMPACT Directly affected: Organizations running Cisco Catalyst SD-WAN Manager — particularly enterprises, managed service providers, and communications infrastructure operators. Scope: Root-level compromise allows full system control, potential lateral movement, persistent access, and configuration manipulation. The communications sector appears to be a confirmed target; broader sector targeting is not yet confirmed. Exploitation duration: Months of unpatched exploitation means organizations should assume potential compromise predates any internal detection activity. RECOMMENDED ACTIONS Apply Cisco’s patch for CVE-2026-20245 immediately if not already done. Verify patch status across all SD-WAN Manager instances. Assume breach posture for any Cisco Catalyst SD-WAN Manager instance exposed prior to patching — initiate forensic review. Hunt for indicators of compromise consistent with root-level access and configuration file manipulation (deletion/restoration patterns flagged by Mandiant). Audit SD-WAN configuration integrity — compare current configurations against known-good baselines. Restrict management-plane access to SD-WAN Manager to trusted IP ranges pending full remediation. Review the six prior Cisco SD-WAN CVEs exploited in 2026 — if your environment was not fully patched across all, treat as potentially compromised. ⚠️ UNCERTAINTY FLAGS Full attribution (nation-state vs. criminal) has not been confirmed in available reporting. Complete victim count and sector breadth remain unknown at this time. CVSS score and specific technical vulnerability class (e.g., auth bypass, command injection) are not confirmed in provided source material. SOURCES SecurityWeek — Cisco SD-WAN Zero-Day Exploited Months Before Patching The Hacker News — Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access Google Threat Intelligence — Zero-Day Exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager CyberScoop — Malicious hackers exploit Cisco zero-day for highest access level at communications service provider BleepingComputer / Mandiant — How Cisco SD-WAN zero-day attacks gained root access

Published Thursday, June 25, 2026 at 12:50 AM PT Organizations running Cisco Catalyst SD-WAN Manager are under active exploitation via an unpatched or recently patched zero-day vulnerability enabling root-level access; immediate assessment and mitigation action required. DETAILS CVE-2026-20245 affects Cisco Catalyst SD-WAN Manager and has been confirmed exploited in the wild; Mandiant has published technical analysis detailing how attackers leveraged the flaw to achieve root access on affected systems. Google Threat Intelligence confirms zero-day exploitation, with attackers observed selectively deleting and restoring system configuration files — a technique consistent with persistent access operations and evidence destruction. CyberScoop reports at least one confirmed victim is a communications service provider, where threat actors obtained the highest available access level. Attribution and broader victim scope remain unconfirmed at this time. SecurityWeek reports the vulnerability was exploited for an extended period prior to patching, making this the seventh Cisco SD-WAN vulnerability exploited in 2026. Patch availability status should be verified directly with Cisco — it is unclear from available reporting whether a full patch is currently released or still pending. This event occurs alongside separate active exploitation of Cisco Unified CM (CVE-2026-20230), indicating a broader threat actor focus on Cisco network infrastructure in the current period. IMPACT ...

Published Thursday, June 25, 2026 at 12:50 AM PT BLUF: Nation-state threat actors have successfully compromised Australian critical infrastructure networks with the stated or assessed intent to “cripple” systems at a time of their choosing. Australian critical infrastructure operators and their security teams should treat this as an active, ongoing threat requiring immediate posture review. DETAILS Nation-state actors have breached Australian critical infrastructure systems, according to reporting by The Register — the specific sectors affected have not been confirmed in available source material The characterization “cripple it at a time of their choosing” indicates assessed adversary intent to pre-position for future disruptive or destructive action, not merely espionage — this is a significant escalation indicator Attribution to a specific nation-state actor has not been confirmed in available details; identity of threat actor(s) should be treated as unconfirmed pending official Australian government or ASD/ACSC statement This incident fits a documented global pattern: UK NCSC has separately assessed that hostile states are linked to approximately three-quarters of attacks on UK critical infrastructure, with Russia, China, and Iran named as primary actors CISA has previously issued advisories on Chinese state-sponsored actors compromising networks globally for espionage and pre-positioning purposes — no confirmed link to this specific incident IMPACT Who: Australian critical infrastructure operators across potentially multiple sectors — specific sectors unconfirmed Scope: Pre-positioned access suggests adversaries may have persistence across operational technology (OT) and/or IT networks; full scope of compromise is unknown at this time Risk: Threat is not assessed as imminent attack — adversary intent appears to be maintaining access for future activation; however, this assessment may change RECOMMENDED ACTIONS Australian CI operators: Initiate threat hunt for indicators of lateral movement, persistence mechanisms, and OT network anomalies immediately Review privileged access and remote access pathways into OT/ICS environments — a common pre-positioning vector Contact ASD/ACSC (1300 CYBER1) for sector-specific guidance and to report anomalies Do not assume clean networks — pre-positioned access may be dormant and evade standard detection Isolate and audit any internet-facing systems connected to operational technology environments Monitor for official ASD/ACSC advisory — additional indicators of compromise (IOCs) may be forthcoming SOURCES The Register Security (primary reporting) UK NCSC / NCSC CEO public statements (contextual) CISA advisory on Chinese state-sponsored actor activity (contextual pattern only) ⚠ UNCERTAINTY FLAG: Threat actor identity, specific sectors compromised, and full scope of intrusion are unconfirmed in available source material. This alert will require update upon official Australian government or ASD/ACSC disclosure.

Published Wednesday, June 24, 2026 at 06:49 PM PT BLUF: The UK National Cyber Security Centre has confirmed that hostile state actors are responsible for approximately three-quarters of cyber attacks targeting the UK’s critical national infrastructure. All CNI operators and their supply chains should treat this as an elevated threat environment and review defensive postures immediately. ...

Published Wednesday, June 24, 2026 at 06:48 PM PT BLUF: Threat actors have actively exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager to gain root-level access. At least one confirmed victim is a communications service provider. Organizations running Cisco Catalyst SD-WAN Manager must treat this as a priority incident and apply mitigations immediately. DETAILS Mandiant has published technical analysis revealing the exploitation mechanism used to achieve root access on Cisco Catalyst SD-WAN Manager via CVE-2026-20245. Specific technical details of the exploit chain are attributed to Mandiant’s investigation. Active exploitation confirmed against at least one communications service provider, per CyberScoop reporting. The attacker achieved the highest available access level on targeted systems. CVE-2026-20245 is identified as the primary vulnerability exploited. A separate but related Cisco flaw, CVE-2026-20230 in Cisco Unified CM, is also now being exploited in attacks per BleepingComputer — indicating a broader Cisco-focused threat campaign may be underway. Linkage between these two exploitation efforts is unconfirmed. Root access achieved means attackers had full control of affected systems, enabling potential lateral movement, persistent backdoor installation, data exfiltration, and network traffic manipulation. Threat actor attribution is not confirmed in available reporting. Motivation and full scope of targeting remain under investigation. IMPACT Directly affected: Organizations running Cisco Catalyst SD-WAN Manager Sector at elevated risk: Telecommunications and communications service providers; enterprises using SD-WAN infrastructure Scope: Currently confirmed at minimum one victim organization; broader targeting likely given zero-day status and root-level access achieved Severity: Critical — root access on SD-WAN management infrastructure provides adversary visibility into and control over network routing, segmentation, and potentially connected environments RECOMMENDED ACTIONS Audit immediately — Identify all Cisco Catalyst SD-WAN Manager instances in your environment, including internet-exposed management interfaces. Apply patches/mitigations — Check Cisco’s Security Advisory portal for CVE-2026-20245 patches or workarounds. Apply without delay. Hunt for indicators — Engage threat hunting for anomalous root-level activity, unexpected process execution, or unauthorized configuration changes on SD-WAN infrastructure. Restrict management access — If patching is not immediately possible, restrict SD-WAN Manager access to trusted IPs only and disable external-facing management interfaces. Review Cisco Unified CM exposure — Given concurrent exploitation of CVE-2026-20230, assess and patch Unified CM deployments in parallel. Escalate to IR — Any organization in the telecommunications sector should consider this a high-priority incident requiring immediate investigation. SOURCES BleepingComputer — Mandiant SD-WAN zero-day root access reporting CyberScoop — Exploitation at communications service provider Google Threat Intelligence — CVE-2026-20245 zero-day exploitation analysis BleepingComputer — Cisco Unified CM CVE-2026-20230 active exploitation ⚠️ NOTE: Full technical details of the exploit chain, complete victim scope, and threat actor attribution remain unconfirmed at time of publication. Monitor Cisco PSIRT and Mandiant for updated guidance.

Published Wednesday, June 24, 2026 at 03:47 PM PT BLUF: A magnitude 7.1 earthquake struck 28 km northwest of Montalbán, Carabobo State, Venezuela at shallow depth. Residents in north-central Venezuela and potentially coastal areas should expect significant shaking, structural damage, and possible aftershocks. Tsunami potential is unconfirmed — await official guidance from FUNVISIS and NOAA/PTWC. DETAILS Magnitude: M7.1 — classified as a major earthquake; capable of causing severe damage over large areas Epicenter: 28 km NW of Montalbán, Venezuela — Coordinates: 10.407°N, 68.493°W (Carabobo/Cojedes state border region) Depth: 13.2 km — shallow-focus event; shallow earthquakes typically produce stronger surface shaking and greater damage potential than deeper events Affected corridor: Montalbán, Valencia, Maracay, and potentially Caracas may experience significant to severe shaking; population exposure is high given proximity to Venezuela’s densely populated northern corridor Aftershock risk: Elevated — M7.1 events routinely generate significant aftershocks; secondary structural failures are a confirmed hazard class for this magnitude IMPACT Population at risk: Millions of residents across Carabobo, Aragua, and surrounding states in Venezuela’s most densely populated region Infrastructure: Older and unreinforced structures in the region face elevated collapse risk; power, water, and communications disruption is probable Tsunami status: UNCONFIRMED — epicenter is inland but proximity to Caribbean coast warrants monitoring; no official tsunami warning confirmed at time of this alert Humanitarian: Venezuela’s existing infrastructure and emergency response capacity is severely degraded; disaster impact may be disproportionate relative to magnitude RECOMMENDED ACTIONS If in affected region: Drop, cover, hold on. Do not exit buildings during shaking. Evacuate to open areas only after shaking stops; assess for structural damage before re-entry Coastal populations: Monitor PTWC (Pacific Tsunami Warning Center) and FUNVISIS for tsunami advisories — do not assume all-clear until official confirmation Organizations with personnel in Venezuela: Initiate personnel accountability checks immediately; assume communications may be degraded Emergency managers: Pre-position assessment teams; anticipate access constraints given Venezuela’s road infrastructure condition Do not rely on social media for damage assessment — await FUNVISIS and official Venezuelan civil protection (PROTECCIÓN CIVIL) reporting UNCERTAINTY FLAGS ⚠ Casualty figures: None confirmed at time of alert ⚠ Tsunami risk: Not confirmed — monitoring ongoing ⚠ Infrastructure damage: Unverified — assess via official channels only ⚠ Aftershock sequence: Ongoing monitoring required ...