Security

Published Wednesday, June 24, 2026 at 06:49 PM PT BLUF: The UK National Cyber Security Centre has confirmed that hostile state actors are responsible for approximately three-quarters of cyber attacks targeting the UK’s critical national infrastructure. All CNI operators and their supply chains should treat this as an elevated threat environment and review defensive postures immediately. ...

Published Wednesday, June 24, 2026 at 06:48 PM PT BLUF: Threat actors have actively exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager to gain root-level access. At least one confirmed victim is a communications service provider. Organizations running Cisco Catalyst SD-WAN Manager must treat this as a priority incident and apply mitigations immediately. DETAILS Mandiant has published technical analysis revealing the exploitation mechanism used to achieve root access on Cisco Catalyst SD-WAN Manager via CVE-2026-20245. Specific technical details of the exploit chain are attributed to Mandiant’s investigation. Active exploitation confirmed against at least one communications service provider, per CyberScoop reporting. The attacker achieved the highest available access level on targeted systems. CVE-2026-20245 is identified as the primary vulnerability exploited. A separate but related Cisco flaw, CVE-2026-20230 in Cisco Unified CM, is also now being exploited in attacks per BleepingComputer — indicating a broader Cisco-focused threat campaign may be underway. Linkage between these two exploitation efforts is unconfirmed. Root access achieved means attackers had full control of affected systems, enabling potential lateral movement, persistent backdoor installation, data exfiltration, and network traffic manipulation. Threat actor attribution is not confirmed in available reporting. Motivation and full scope of targeting remain under investigation. IMPACT Directly affected: Organizations running Cisco Catalyst SD-WAN Manager Sector at elevated risk: Telecommunications and communications service providers; enterprises using SD-WAN infrastructure Scope: Currently confirmed at minimum one victim organization; broader targeting likely given zero-day status and root-level access achieved Severity: Critical — root access on SD-WAN management infrastructure provides adversary visibility into and control over network routing, segmentation, and potentially connected environments RECOMMENDED ACTIONS Audit immediately — Identify all Cisco Catalyst SD-WAN Manager instances in your environment, including internet-exposed management interfaces. Apply patches/mitigations — Check Cisco’s Security Advisory portal for CVE-2026-20245 patches or workarounds. Apply without delay. Hunt for indicators — Engage threat hunting for anomalous root-level activity, unexpected process execution, or unauthorized configuration changes on SD-WAN infrastructure. Restrict management access — If patching is not immediately possible, restrict SD-WAN Manager access to trusted IPs only and disable external-facing management interfaces. Review Cisco Unified CM exposure — Given concurrent exploitation of CVE-2026-20230, assess and patch Unified CM deployments in parallel. Escalate to IR — Any organization in the telecommunications sector should consider this a high-priority incident requiring immediate investigation. SOURCES BleepingComputer — Mandiant SD-WAN zero-day root access reporting CyberScoop — Exploitation at communications service provider Google Threat Intelligence — CVE-2026-20245 zero-day exploitation analysis BleepingComputer — Cisco Unified CM CVE-2026-20230 active exploitation ⚠️ NOTE: Full technical details of the exploit chain, complete victim scope, and threat actor attribution remain unconfirmed at time of publication. Monitor Cisco PSIRT and Mandiant for updated guidance.

Published Wednesday, June 24, 2026 at 03:47 PM PT BLUF: A magnitude 7.1 earthquake struck 28 km northwest of Montalbán, Carabobo State, Venezuela at shallow depth. Residents in north-central Venezuela and potentially coastal areas should expect significant shaking, structural damage, and possible aftershocks. Tsunami potential is unconfirmed — await official guidance from FUNVISIS and NOAA/PTWC. DETAILS Magnitude: M7.1 — classified as a major earthquake; capable of causing severe damage over large areas Epicenter: 28 km NW of Montalbán, Venezuela — Coordinates: 10.407°N, 68.493°W (Carabobo/Cojedes state border region) Depth: 13.2 km — shallow-focus event; shallow earthquakes typically produce stronger surface shaking and greater damage potential than deeper events Affected corridor: Montalbán, Valencia, Maracay, and potentially Caracas may experience significant to severe shaking; population exposure is high given proximity to Venezuela’s densely populated northern corridor Aftershock risk: Elevated — M7.1 events routinely generate significant aftershocks; secondary structural failures are a confirmed hazard class for this magnitude IMPACT Population at risk: Millions of residents across Carabobo, Aragua, and surrounding states in Venezuela’s most densely populated region Infrastructure: Older and unreinforced structures in the region face elevated collapse risk; power, water, and communications disruption is probable Tsunami status: UNCONFIRMED — epicenter is inland but proximity to Caribbean coast warrants monitoring; no official tsunami warning confirmed at time of this alert Humanitarian: Venezuela’s existing infrastructure and emergency response capacity is severely degraded; disaster impact may be disproportionate relative to magnitude RECOMMENDED ACTIONS If in affected region: Drop, cover, hold on. Do not exit buildings during shaking. Evacuate to open areas only after shaking stops; assess for structural damage before re-entry Coastal populations: Monitor PTWC (Pacific Tsunami Warning Center) and FUNVISIS for tsunami advisories — do not assume all-clear until official confirmation Organizations with personnel in Venezuela: Initiate personnel accountability checks immediately; assume communications may be degraded Emergency managers: Pre-position assessment teams; anticipate access constraints given Venezuela’s road infrastructure condition Do not rely on social media for damage assessment — await FUNVISIS and official Venezuelan civil protection (PROTECCIÓN CIVIL) reporting UNCERTAINTY FLAGS ⚠ Casualty figures: None confirmed at time of alert ⚠ Tsunami risk: Not confirmed — monitoring ongoing ⚠ Infrastructure damage: Unverified — assess via official channels only ⚠ Aftershock sequence: Ongoing monitoring required ...

Published Wednesday, June 24, 2026 at 03:17 PM PT BLUF: A magnitude 7.1 earthquake struck 21 km west of Morón, Venezuela at shallow depth (10 km). Population centers along Venezuela’s northern Caribbean coast face immediate risk of structural damage, casualties, and secondary hazards. Emergency services should activate. Tsunami assessment status is UNKNOWN at time of this alert — verify with PTWC/NOAA immediately. ...

Published Wednesday, June 24, 2026 at 12:48 PM PT BLUF: CISA has issued a warning that a critical vulnerability in the Lantronix EDS5000 device server is being actively exploited in the wild. Organizations operating Lantronix EDS5000 hardware should treat this as an immediate priority and apply mitigations now. DETAILS CISA has added the Lantronix EDS5000 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation is underway — not theoretical. The Lantronix EDS5000 is a network-attached device server commonly used in industrial, enterprise, and critical infrastructure environments to connect serial devices to IP networks. Specific CVE identifier, CVSS score, and technical exploitation mechanism are not confirmed in source material provided — treat severity as critical pending vendor advisory review. CISA’s KEV designation means federal civilian agencies are subject to mandatory remediation deadlines; private sector organizations should treat this with equivalent urgency. This alert follows a pattern of CISA warnings targeting network infrastructure and edge devices, including recent advisories on Ubiquiti, Fortinet, and Cisco Unified CM vulnerabilities. IMPACT Who is affected: Any organization deploying Lantronix EDS5000 device servers — particularly industrial operators, healthcare networks, and enterprise environments where serial-to-IP connectivity is in use. Scope: Active exploitation confirmed; attack surface includes any internet-exposed or network-accessible EDS5000 units. Risk: Successful exploitation of device servers can enable unauthorized network access, lateral movement, and potential pivot into connected OT/IT systems. Full impact scope not confirmed from available source material. RECOMMENDED ACTIONS Inventory immediately — identify all Lantronix EDS5000 devices in your environment. Check for vendor patch — visit Lantronix’s official security advisory page for available firmware updates; apply if available. Isolate if unpatched — restrict network access to EDS5000 units; remove internet exposure where possible. Monitor for indicators of compromise — review logs on and around affected devices for anomalous access or configuration changes. Apply CISA KEV remediation timeline — federal agencies must comply with mandatory deadlines; all others should treat as P1. ⚠️ UNCERTAINTY FLAGS Specific CVE number, CVSS score, and exploitation method are not confirmed in provided source material. Verify against CISA KEV catalog and Lantronix advisories directly before communicating internally. Threat actor attribution is unknown at this time. SOURCES The Hacker News — CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited CISA Known Exploited Vulnerabilities Catalog — cisa.gov/known-exploited-vulnerabilities-catalog (verify directly for full technical details)

Published Wednesday, June 24, 2026 at 12:47 PM PT BLUF: Threat actors have actively exploited an unpatched Cisco vulnerability to gain maximum-level access at a communications service provider. All organizations running affected Cisco infrastructure — particularly Cisco Catalyst SD-WAN Manager — should treat this as an active threat and apply mitigations immediately. DETAILS Mandiant documented active zero-day exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, enabling root-level command execution on affected systems, per Google Threat Intelligence reporting. Attackers achieved the highest available access level on compromised systems at a confirmed communications service provider victim; the identity of the victim has not been publicly disclosed. Observed attacker behavior includes selective deletion and restoration of system configuration files, suggesting deliberate anti-forensic or persistence activity. Attribution is unconfirmed. Mandiant has not publicly identified the threat actor or linked the activity to a known group as of this alert. Whether attackers gained broad visibility into internal traffic — a critical concern given the victim’s role as a communications provider — remains unconfirmed. IMPACT Directly affected: Organizations running Cisco Catalyst SD-WAN Manager. Elevated risk: Communications service providers, whose infrastructure may carry third-party customer traffic, represent high-value targets with potential downstream exposure to the provider’s clients. Scope of broader campaign: Unknown. It is unclear whether this is an isolated incident or part of a wider targeting pattern. RECOMMENDED ACTIONS Patch immediately — Apply Cisco’s available patch for CVE-2026-20245. A proof-of-concept has been publicly available, increasing exploitation risk across the broader threat landscape. Audit SD-WAN Manager logs for unauthorized configuration changes, unexpected deletions, or anomalous privileged access events. Review network segmentation around SD-WAN management planes to limit lateral movement potential. Communications providers should assess whether customer traffic visibility may have been exposed and consider notification obligations accordingly. Monitor Mandiant and Cisco advisories for updated indicators of compromise (IOCs) — none have been confirmed publicly at this time. SOURCES Mandiant / Google Threat Intelligence: Zero-Day Exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager CyberScoop: Malicious hackers exploit Cisco zero-day for highest access level at communications service provider SOC Prime: CVE-2026-20245 analysis ⚠️ UNCERTAINTY FLAG: Threat actor identity, full victim scope, and whether traffic interception occurred are all unconfirmed. This alert will require update as Mandiant releases additional findings. ...

Published Wednesday, June 24, 2026 at 12:47 PM PT BLUF: Threat actors are actively exploiting a zero-day vulnerability in Cisco Catalyst SD-WAN Manager. Organizations running affected SD-WAN Manager instances should treat this as an active incident. Patch or mitigate immediately. DETAILS CVE-2026-20245 is under active exploitation in Cisco Catalyst SD-WAN Manager, according to Google Threat Intelligence reporting. Specific CVSS score and affected version range are not confirmed in available source material — verify against Cisco’s advisory. Threat actors have demonstrated post-exploitation capability including selectively deleting and restoring system configuration files modified during their activity — a deliberate anti-forensic technique indicating a sophisticated, operationally aware actor. The file manipulation behavior suggests actors are actively attempting to conceal their presence and timeline of access, complicating incident response and forensic reconstruction. A prior related Cisco zero-day (CVE-2026-20230, Unified CM) had a public proof-of-concept available at time of disclosure — whether a PoC exists for CVE-2026-20245 is not confirmed at this time. Attribution of the threat actor has not been confirmed in available reporting. Sophistication of anti-forensic tradecraft is noted. IMPACT Directly affected: Organizations running Cisco Catalyst SD-WAN Manager in their network infrastructure. Scope concern: SD-WAN Manager serves as a centralized control plane for SD-WAN deployments. Compromise may provide adversary visibility into or control over wide-area network routing, policy, and configuration across multiple sites. Secondary risk: Anti-forensic file manipulation means dwell time and scope of access may be significantly underestimated without deep forensic investigation. RECOMMENDED ACTIONS Immediately audit Cisco Catalyst SD-WAN Manager instances for unauthorized access, anomalous configuration changes, or unexpected file deletions and restorations. Apply Cisco patches as soon as available — check Cisco’s Security Advisory portal now for CVE-2026-20245 guidance. Restrict management-plane access to SD-WAN Manager: enforce allowlisting, disable unnecessary external access, require MFA. Preserve forensic artifacts now — given confirmed anti-forensic activity, initiate log preservation and memory capture before further remediation steps. Assume breach posture if your SD-WAN Manager has been internet-exposed or inadequately segmented pending full investigation. SOURCES Google Threat Intelligence — CVE-2026-20245 zero-day exploitation reporting CyberScoop — prior Cisco zero-day exploitation context SecurityWeek — CVE-2026-20230 Cisco Unified CM related reporting ⚠️ NOTE: Specific affected version ranges, CVSS score, and threat actor attribution are not confirmed in available source material at time of publication. Monitor Cisco PSIRT and CISA KEV catalog for updates. ...

Published Wednesday, June 24, 2026 at 07:16 AM PT Organizations running Cisco Unified Communications Manager are under active attack via CVE-2026-20230, a critical flaw enabling root access. Patches have been available for weeks. Apply them now. DETAILS CVE-2026-20230 is a critical vulnerability in Cisco Unified Communications Manager (Unified CM) that, if exploited successfully, can allow an attacker to gain root-level access to affected systems. Active exploitation was reported by threat intelligence firm Defused on June 23, with observed activity occurring over the preceding weekend. A proof-of-concept (PoC) exploit was publicly available at the time Cisco issued its original patch advisory, per SecurityWeek reporting — significantly lowering the barrier to exploitation. The Hacker News reporting indicates the PoC revealed a file-write path to root, clarifying the likely exploitation mechanism. As of reporting, exploitation has been observed originating from a single source — broader threat actor attribution and full scope of targeting are not yet confirmed. IMPACT Directly affected: Organizations running unpatched Cisco Unified CM deployments, particularly those with internet-exposed management interfaces. Scope: Unified CM is widely deployed in enterprise voice and collaboration environments. Successful exploitation grants root access, enabling full system compromise, lateral movement, and potential interception of communications infrastructure. Exploitation window: Patches were available weeks prior to confirmed active exploitation — organizations that delayed remediation are at elevated risk. RECOMMENDED ACTIONS Apply Cisco’s patches for CVE-2026-20230 immediately if not already done. Treat this as emergency remediation. Restrict management interface access — ensure Unified CM administration portals are not exposed to the public internet; enforce network-level access controls. Hunt for indicators of compromise on Unified CM systems, including unexpected file modifications, new accounts, or anomalous process activity consistent with privilege escalation. Review logs for suspicious access attempts, particularly targeting administrative interfaces, over the past two weeks. Isolate any systems showing signs of compromise pending forensic review. SOURCES CSO Online — Attackers exploit Cisco Unified CM flaw weeks after patch release SecurityWeek — Hackers Exploiting Cisco Unified CM Vulnerability BleepingComputer — Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks The Hacker News — Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root Defused (threat intelligence firm) — exploitation activity reported June 23 ⚠️ Uncertainty flag: Full attacker attribution, total number of victims, and whether exploitation has expanded beyond the initially observed single source are not yet confirmed at time of publication. ...

Published Wednesday, June 24, 2026 at 07:15 AM PT BLUF: Tenable research identified 457 million AI-related security issues across more than 7,000 organizations over a single 30-day measurement period — averaging approximately 62,000 exposures per organization. Shadow AI adoption is confirmed as a primary driver. All organizations deploying or permitting AI tools should conduct immediate exposure assessments. ...

Published Wednesday, June 24, 2026 at 07:14 AM PT BLUF: Threat actor group ShinyHunters has successfully breached more than 100 organizations by exploiting an unpatched zero-day vulnerability in Oracle PeopleSoft. All organizations running Oracle PeopleSoft should treat this as an active threat requiring immediate action. DETAILS ShinyHunters, a prolific financially motivated threat actor group previously linked to high-profile data theft operations, is confirmed as the actor behind this campaign The attack vector is a zero-day vulnerability in Oracle PeopleSoft — meaning exploitation occurred before a patch was available; patch availability status at time of publication is not confirmed in source reporting Confirmed victim count stands at 100+ organizations; full scope of affected entities, sectors, and geographic distribution has not been publicly confirmed Nature of data accessed or exfiltrated across victim organizations has not been confirmed in available reporting — assume sensitive HR, financial, and identity data is at risk given PeopleSoft’s typical deployment profile ShinyHunters has a documented history of large-scale data exfiltration and sale on criminal marketplaces; downstream exposure risk is elevated IMPACT Directly affected: Any organization running Oracle PeopleSoft, particularly internet-facing deployments Scope: Enterprise-wide — PeopleSoft is widely deployed across higher education, government, healthcare, and large enterprises for HR, ERP, and financial management functions Data at risk: Likely includes employee PII, payroll data, benefits records, and authentication credentials — confirm based on your specific PeopleSoft configuration Secondary risk: Credential harvesting from PeopleSoft could enable lateral movement into connected enterprise systems RECOMMENDED ACTIONS Immediately audit Oracle PeopleSoft deployments — identify all internet-facing instances and restrict external access where operationally feasible Monitor Oracle’s security advisory portal for emergency patch or mitigation guidance; apply any available patches on an emergency basis Review PeopleSoft access logs for anomalous authentication attempts, privilege escalation, or unusual data exports — prioritize logs from the past 30–90 days Isolate PeopleSoft environments from broader network segments if compromise is suspected Alert identity and HR teams — credential and PII exposure should be assumed until ruled out; initiate incident response procedures accordingly Contact Oracle support directly for guidance if you have an active support contract SOURCES The Register Security — ShinyHunters hacked 100+ orgs by exploiting an Oracle PeopleSoft 0-day ⚠️ UNCERTAINTY FLAG: Source reporting at time of alert generation is limited to headline-level detail. Patch availability, full victim list, exploited CVE identifier, and confirmed data types exfiltrated are unconfirmed. Update response posture as Oracle and additional reporting provide clarification.