Cisco has verified that attackers are actively exploiting CVE-2026-20079, a maximum-severity (CVSS 10.0) flaw in its Secure Firewall Management Center software that lets unauthenticated remote attackers bypass login and run commands as root. The company first disclosed the bug in March without evidence of exploitation, but updated its advisory this week to acknowledge PSIRT detected active attacks in August, though it hasn't shared attacker identity or attack timeline details. CISA has since added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 12 to patch.
bleepingcomputer.com
· 2026-09-09
Cisco Talos researchers identified two separate ClickFix-style social engineering campaigns that trick victims into executing malicious code themselves, one aimed at stealing cryptocurrency and another designed to gain persistent enterprise network access. One campaign uses a publicly shared Google Sheet to distribute malicious browser code that hijacks Chrome transaction interfaces, while both operations abuse legitimate cloud services and trusted software to disguise malicious activity as normal user behavior.
darkreading.com
· 2026-09-08
A longtime Cisco employee describes being made redundant after 25 years with the company, detailing the abrupt phone call that ended his tenure and the emotional aftermath. He recounts the standardized, almost clinical nature of the layoff process and his own struggle to process the loss, including delaying telling his wife out of shame.
ipv6.hanazo.no
· 2026-09-02
The Equal Employment Opportunity Commission determined in June that there is reasonable cause to believe Cisco subjected Muslim and Middle Eastern employees, as well as other workers who voiced pro-Palestinian views, to a hostile work environment. The finding stems from a complaint alleging that advocacy related to Palestine led to workplace mistreatment at the tech giant.
fastcompany.com
· 2026-08-31
Incident responders at Sygnia say the China-linked group Fire Ant has expanded from compromising VMware hypervisors to hijacking Cisco routers, TACACS authentication servers, and Linux management hosts. Investigators found a hidden GRE tunnel on a Cisco IOS XR router that didn't match its configuration history, leading to discovery of custom malware that hides its activity from administrators and runs only during set hours. The attackers used their router access to capture network traffic and exfiltrate it to external FTP servers, then pivoted through a hidden tunnel into a Linux server to probe further into connected high-value networks, including ones tied to critical infrastructure.
bleepingcomputer.com
· 2026-08-31
The Australian Federal Police announced the arrest of two men from Western Australia on 14 charges related to alleged membership in TeamPCP, a hacking collective linked to widespread supply chain attacks. Authorities say the group's malware, known as Shai-Hulud, spread through compromised open source packages and infected more than 1,000 organizations globally by exploiting CI/CD development pipelines.
arstechnica.com
· 2026-08-28
GoKawiil