VulnHub

A significant security vulnerability in Cisco's Catalyst SD-WAN Manager has been exploited by attackers months before its public disclosure. The flaw, which was revealed in early June, was reportedly being used in attacks as early as March. This situation raises serious concerns for organizations using Cisco's SD-WAN technology, as they may have been at risk for an extended period without knowledge of the threat. Companies are urged to review their systems and apply any available patches to mitigate potential risks. The exploitation of this vulnerability highlights the importance of timely disclosures and the need for vigilance in monitoring systems for suspicious activity.

A serious vulnerability in Cisco Catalyst SD-WAN, identified as CVE-2026-20245, has been exploited by hackers for months before it was publicly disclosed. This flaw, which has a CVSS score of 7.8, allows authenticated attackers to execute privileged commands on affected systems. Google-owned Mandiant reported that the exploitation occurred at least two months prior to the disclosure, raising concerns about the security of networks using this technology. Organizations using Cisco Catalyst SD-WAN should take immediate action to secure their systems, as this vulnerability poses a significant risk to network integrity. The incident serves as a reminder of the importance of timely disclosure and patch management in cybersecurity.

A recently discovered vulnerability in Cisco Catalyst SD-WAN has been exploited by an unknown attacker for at least two months before its public disclosure. This security flaw, identified as CVE-2026-20245, has a high severity rating of 7.8 and allows an authenticated local attacker to execute arbitrary commands with elevated privileges. This means that if an attacker gains access to a system, they could potentially take control of critical functions within the network. Companies using Cisco Catalyst SD-WAN should be aware of the risk posed by this vulnerability and take immediate action to protect their systems. The findings from Mandiant underscore the importance of timely patching and monitoring for unusual activity in network environments.

The latest Malware newsletter from Security Affairs discusses several significant cybersecurity incidents affecting a wide range of sectors. Notably, a supply chain attack on OptinMonster has compromised 1.2 million websites, raising concerns about the security of third-party services. Additionally, a China-linked threat actor has targeted both public and private medical organizations, focusing on areas like artificial intelligence and national defense research. Another piece highlights the Rokarolla malware, which is designed to steal banking information from Android devices. These incidents underscore the ongoing risks faced by organizations and individuals alike, as attackers increasingly exploit vulnerabilities across various sectors.

A new Android banking trojan named Rokarolla has emerged, targeting 217 banking and cryptocurrency applications. This malware operates with a sophisticated toolkit, utilizing 137 different commands to carry out its operations. Users of affected apps may be at risk of having their sensitive financial information compromised. As cybercriminals continue to develop more advanced tactics, it's crucial for users to stay vigilant and ensure they have proper security measures in place. The rise of such malware highlights the ongoing threat to mobile banking and cryptocurrency platforms, making it essential for both users and developers to prioritize security.

This week saw several cybersecurity incidents that highlight ongoing vulnerabilities in various systems. A zero-day vulnerability was discovered in Google Chrome, which could allow attackers to execute arbitrary code. Additionally, exploits affecting UniFi devices were reported, taking advantage of outdated software. Cybercriminals are also utilizing phishing kits that are increasingly easy to rent, making them more accessible to a wider range of attackers. Meanwhile, macOS systems are facing threats from new data-stealing malware, and a flaw in VPN services was identified, potentially exposing user data. These incidents remind users and organizations of the continuous need to update their software and remain vigilant against evolving cyber threats.

Google has initiated legal action against a Chinese cybercrime group accused of using its Gemini AI technology to send phishing text messages to Americans. This group is believed to operate a phishing-as-a-service tool called Outsider, which facilitates these scams. The use of Gemini AI in this context raises concerns about how advanced technologies can be weaponized for malicious purposes. This case not only targets the perpetrators but also aims to raise awareness about the growing sophistication of phishing attacks that can deceive unsuspecting users. As phishing remains a major threat to online security, this lawsuit underscores the need for vigilance among consumers and businesses alike.

Recent reports from WatchGuard and ESET reveal two banking trojan campaigns targeting users in Latin America and Europe. The Grandoreiro malware is aimed at Windows devices, while the BTMOB RAT is designed for Android users. These campaigns specifically target companies in Spain, Portugal, and Mexico, as well as mobile users in Brazil. The malware's ability to siphon sensitive financial information poses a significant risk to both businesses and individual users. As cybercriminals continue to adapt their tactics, it's crucial for users to remain vigilant and implement security measures to protect their devices and data.

CrowdStrike and Google have successfully dismantled the Glassworm botnet, which has been targeting software developers since early 2025. This botnet is notable for its focus on compromising development environments, potentially allowing attackers to introduce malicious code into legitimate software projects. The operation highlights the risks that developers face, as their tools and platforms can be exploited by cybercriminals. By disrupting this botnet, the companies aim to protect software development processes and ensure the integrity of the applications being created. This incident serves as a reminder of the ongoing cybersecurity challenges in the software development sector.

A new malware campaign named 'Premium Deception' has been discovered, using 250 fake Android apps to trick users into signing up for paid services without their consent. Researchers found that these apps, which masquerade as legitimate tools and games, charge users covertly, often leading to unexpected fees in their accounts. This campaign affects a wide range of Android users, particularly those who download apps from unofficial sources or third-party app stores. It's a reminder for users to be cautious about app permissions and to download software only from trusted platforms. The incident emphasizes the ongoing risks of mobile malware and the need for better awareness among users about app security.

Google's latest Chrome update, version 148, addresses several critical vulnerabilities, including a serious use-after-free issue affecting various browser components. This type of vulnerability can allow attackers to execute arbitrary code, potentially leading to unauthorized access or data breaches. Users of Chrome should update to the latest version to ensure their browsers are secure. Keeping browsers up to date is crucial, as these vulnerabilities can be exploited if left unpatched. The update underscores the ongoing need for vigilance in cybersecurity, especially given the frequency of browser-based attacks.

Researchers at ThreatFabric have identified a new variant of the TrickMo Android banking trojan, which is now routing its command and control (C2) traffic through The Open Network (TON). This change in infrastructure allows the malware to operate more stealthily, making it harder for security measures to detect and block its activities. The TrickMo trojan primarily targets Android devices, aiming to steal sensitive banking information from users. This development is concerning because it indicates that attackers are adapting their strategies to evade detection, which could lead to increased financial fraud. Users of Android devices, particularly those who engage in online banking, need to be vigilant and take precautions to protect their information.