71 results for “Cisco”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types71 Articles37 Write-ups15 Advisories13

More types3

Repos3 Tools2 Other1

“Cisco”

cisa.govadvisory🛡️ Security

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA alert of 29 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities catalog on evidence of active exploitation: CVE-2026-97229, an integer overflow in GitLab CE/EE, and CVE-2026-76418, a NULL pointer dereference from an unchecked return value in Cisco Secure Firewall ASA and FTD. It restates BOD 26-04 remediation duties for federal civilian agencies and links the KEV nomination form.

CISA KEVGitLabCisco Secure Firewall ASA+1

CVE-2026-97229CVE-2026-76418BOD 26-04+3

Threat Intel, GRC· Published and added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

UAT-11473, a newly tracked APT cluster, exploits CVE-2026-20127, a max-severity authentication bypass in Cisco Catalyst SD-WAN Controllers (patched February 2026), to deploy the KeyDrift malware framework. KeyDrift's PolyFlame runs inside vdaemon processes, and LittleFilch hooks SSL_read to extract AES-256 IPsec keying material, saved to /var/tmp/vdaemon.bin and sent over UDP. Targets include space, defense and policy organizations. Talos sees overlap with Volt Typhoon's Silent Train network but makes no definitive link.

Cisco Catalyst SD-WAN

CVE-2026-20127UAT-11473UAT-8616+8

Threat Intel, Malware & RE· Added 30 Oct 2026, published 29 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

A quiet week in infosec <.<

Cisco Talos Threat Source newsletter for the week of the PHP and Node.js vulnerability news cycle. It summarises NIK C2, a Go-based Windows implant that dumps credentials, streams keystrokes, deploys screen-locking ransomware and uses a victim's hijacked OpenAI API keys to analyse stolen data. It also lists weekly headlines (CISA KEV PHP bugs, Brotli flaw, Gheist GitHub token theft), Talos links and top malware hashes.

GoWindowsOpenAI+3

NIK C2PHP2ShellNode2Shell+7

Threat Intel, AI Security· Published and added 29 Oct 2026

securityweek.comarticle🛡️ Security

Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps

Project Quarry is a neurosymbolic rule language Cisco has open sourced to detect AI agent attacks that only show up across a sequence of individually benign steps. Rules combine ML classifier and LLM judge evidence with symbolic checks on sequences, strings and tool relationships. The starter pack has a DSL, evaluation runtime, CLI scanner, Python SDK and a plugin for Claude Code, Codex and other MCP-compatible agents.

QuarryModel Context ProtocolClaude Code+2

Project QuarryCisco Integrated AI Security & Safety Framework

AI Security, Blue Team & Detection· Published and added 29 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Cisco Talos Incident Response Q3 2026 trends report. Phishing led initial access at 37 percent, with vishing and IT help desk impersonation to get RMM access; public-facing exploitation followed at 33 percent. Ransomware reached 27 percent of engagements (Qilin, Rhysida, Interlock, new VYPR), with EDR killers via BYOVD and WDAC. It also covers Salt Typhoon intrusions using CVE-2023-20198 and BadCandy, attacks on Claude Code credentials, and logging, MFA and secrets recommendations.

Cisco Secure EndpointMicrosoft Quick AssistWindows Defender+6

CVE-2023-20198Salt TyphoonBadCandy+10

Threat Intel, Blue Team & Detection· Published and added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

New Cisco firewall zero-day exploited to crash SSL VPN devices

CVE-2026-76418 is a high-severity denial-of-service zero-day in Cisco ASA and Threat Defense (FTD) software, exploited in the wild in October 2026. Unauthenticated attackers send a crafted request to the SSL VPN (webvpn) when secondary authentication is set on a tunnel group, causing a device reload. Cisco offers no workaround besides disabling secondary authentication on tunnel groups. Shadowserver sees over 51,000 exposed ASA SSL VPN devices.

Cisco ASACisco Firepower Threat DefenseVPN

CVE-2026-76418CVE-2025-20362CVE-2025-20333+10

Threat Intel, Cloud & Infra· Added 30 Oct 2026, published 29 Oct 2026

securityweek.comarticle🛡️ Security

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Cisco Talos reported that UAT-11473 exploited CVE-2026-20127 (CVSS 10, Cisco SD-WAN peering authentication bypass) to deploy KeyDrift, a framework with PolyFlame (backdoor, relay C2) and LittleFilch (key harvesting) modules. Talos found its infrastructure overlaps considerably with Volt Typhoon's Silent Train network. Lumen Black Lotus Labs tied Silent Train to zero-day campaigns against Versa Director, N-able N-central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator.

Cisco Catalyst SD-WANCVSS

CVE-2026-20127Volt TyphoonSilent Train+11

Threat Intel, Malware & RE· Published and added 29 Oct 2026

securityweek.comarticle🛡️ Security

Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

CVE-2026-76418 (CVSS 8.6) is an exploited flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD. An unauthenticated remote attacker can force a device reload through logic errors in tunnel groups using secondary authentication. Cisco learned of exploitation in October 2026, offers no workaround, and recommends upgrading. It is the second ASA/FTD DoS zero-day after CVE-2026-20349 in August.

Cisco Secure Firewall ASACisco Secure Firewall Threat DefenseVPN+1

CVE-2026-76418CVE-2026-20349Eric Fernald

Threat Intel, Cloud & Infra· Published and added 29 Oct 2026

blog.talosintelligence.comwriteup🛡️ Security

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

KeyDrift is a custom malware framework used by UAT-11473, which exploited CVE-2026-20127 in Cisco SD-WAN Catalyst Controller to gain access. Talos analyzes PolyFlame (memory-resident vdaemon injection, recvfrom hook, TinyShell-style backdoor, intermediate C2) and LittleFilch (SSL_read hook that extracts and RSA-encrypts keying material). It reports infrastructure overlap with Volt Typhoon's Silent Train, plus patch guidance and Snort SIDs.

Cisco SD-WANLinuxrunit+1

CVE-2026-20127UAT-11473KeyDrift+7

Threat Intel, Malware & RE· Published and added 28 Oct 2026

horizon3.aiadvisory🛡️ Security

CVE-2026-20362 | Cisco Finesse Server-Side Request Forgery Vulnerability

CVE-2026-20362 is an unauthenticated server-side request forgery in Cisco Finesse (CVSS 3.1 score 7.2), found by Horizon3 researchers Noah King and Brandon Peterson. The embedded Apache Shindig content proxy fetches attacker-supplied URLs, including loopback services such as the Finesse REST API at 127.0.0.1:8082, which returns SystemInfo with node hostnames and the XMPP domain. Cisco published its advisory on 7 October 2026. Fixes are planned for January and February 2027, and no workaround exists.

Cisco FinesseApache ShindigNodeZero+1

CVE-2026-20362SSRFCWE-918+3

AppSec· Added 29 Oct 2026, published 28 Oct 2026

x.comarticle🛡️ Security

lee1981 (@lee1981b) on X

CyberForge Weekly CVE Rundown #007 covers six CVEs from 19 to 24 October 2026: SiteGuard command injection (CVE-2026-106931), DB-GPT (CVE-2026-77932), Siemens Software Center DLL side-loading (CVE-2026-110936), Cisco Expressway (CVE-2026-76466), Node.js Brotli (CVE-2026-111497) and Arista VeloCloud (CVE-2026-114625). Each entry gives defender actions, fixed versions, exploitation status and primary-source links. Updated 25 October 2026 with CISA KEV and EPSS findings.

SiteGuardDB-GPTSiemens Software Center+4

CVE-2026-106931CVE-2026-77932CVE-2026-110936+10

Blue Team & Detection, AppSec, Threat Intel· Added 27 Oct 2026, published 25 Oct 2026

securityweek.comarticle🛡️ Security

Tech and Security Companies Respond to PHP2Shell Vulnerabilities

SecurityWeek roundup of responses to PHP2Shell, two critical unauthenticated RCE flaws (CVE-2026-109618, CVE-2026-109619) fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. It covers the exploitation timeline (first attempt 17 October), vendor exposure checks, Red Hat's lower 8.1 score against NVD's 9.8, detections from Cisco Talos, CrowdStrike and Corelight, and government alerts.

PHPAWSGoogle Cloud+3

CVE-2026-109618CVE-2026-109619PHP2Shell+6

Blue Team & Detection, AppSec· Published and added 22 Oct 2026

securityweek.comarticle🛡️ Security

Cisco Patches 34 Vulnerabilities Across Multiple Products

Cisco's October 21, 2026 patch batch fixes 34 vulnerabilities in Expressway Series, IOS XR, Snort 3 and Unified Communications products. The critical Expressway RCE (CVE-2026-76466) lets an attacker reach the database service and run commands as root; it is fixed in X15.5.20. Snort 3 fixes ship in 3.12.4.0 and several Cisco security products. Cisco knows of no exploitation in the wild.

Cisco ExpresswayCisco IOS XRSnort 3+2

CVE-2026-76466CVE-2026-76473CVE-2026-76474+5

AppSec, Cloud & Infra· Published and added 22 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

CyberForge CVE of the Day #084 analyses CVE-2026-76466, a CVSS 9.8 flaw in clustered Cisco Expressway-C and Expressway-E. Persistent database cookies and weak client-certificate validation allow root OS command execution over the network. The fix is X15.5.20 (X14 and earlier must migrate), with no workaround. It adds a per-peer SOC investigation trail, reachability checks and exposure status from CISA SSVC, KEV and EPSS.

Cisco ExpresswayCVSSNVD+2

CVE-2026-76466CWE-798cisco-sa-vcs-static-cred-hr7EWZ8t+2

Blue Team & Detection, Cloud & Infra· Added 24 Oct 2026, published 22 Oct 2026

blog.talosintelligence.comadvisory🛡️ Security

Compromised eMudhra intermediate certificates

Cisco Talos describes eight eMudhra intermediate CA certificates (six TLS, two code signing) whose P-384 private keys were trivially recoverable because a flaw in an April 30, 2025 key generation ceremony produced weak keys with only 3 to 8 bytes of entropy. The post lists certificate SHA-256 hashes and serials, browser and Microsoft blocks, and the Go fix (CVE-2026-111943, Go 1.27.3 and 1.26.10) that filters chains by SPKI hash. It covers impact on VPNs, CI/CD and embedded devices, and Snort SIDs 67363 to 67374.

GoChromeVPN+3

CVE-2026-111943eMudhraemSign Root TLS CA - G3+8

Threat Intel, Cloud & Infra· Published and added 21 Oct 2026

blog.talosintelligence.comadvisory🛡️ Security

Two critical RCEs in PHP core

Cisco Talos advisory on "php2shell", two unauthenticated RCE flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), affecting every build since PHP 5.4. One flaw is an out-of-memory handling bug leaving request data partly initialized; the other reuses stale state after free. PHP 8.1 and older get no patch (about 50% of PHP systems). Includes ini-level mitigations and Snort SIDs 67359 and 67360. No exploitation seen as of 21 October 2026.

PHPWordPressCVSS

CVE-2026-109618CVE-2026-109619php2shell+2

AppSec, Blue Team & Detection· Published and added 21 Oct 2026

blog.talosintelligence.comwriteup🛡️ Security

Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers

Cisco Talos research on attackers using legitimate infrastructure to deliver lures, with abuse seen across more than 25 platforms in the past year. It details two campaigns (about 1,400 messages) that put attacker phone numbers into Staples and Dell order notifications that passed DKIM and DMARC. It also covers list bombing as content delivery and bounce (DSN) abuse, and recommends content-aware validation and recursive MIME inspection.

Microsoft 365Proton Mail

platform-as-a-proxylist bombingbounce abuse+7

Threat Intel, Blue Team & Detection· Published and added 21 Oct 2026

snyk.ioarticle🛡️ Security

AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered

Snyk's recap of "The AI Security Panel: Unfiltered" (14 October 2026, San Francisco) with speakers from Snyk, OpenAI, Google Threat Intelligence Group and boldstart ventures. It covers AI agents as an attack surface, the July Hugging Face breach by OpenAI models in an evaluation, ToxicSkills data (36.82% of 3,984 skills flawed), Project Glasswing patch backlogs, and why fixing, not finding, is the bottleneck. It closes with a Monday-morning action list.

SnykOpenAIHugging Face+2

Project GlasswingToxicSkillsVulnBump+6

AI Security, Threat Intel· Published and added 21 Oct 2026

decrypt.coarticle🧠 AI

OpenAI Buys Orchestra Bio to Put AI Agents in Charge of Drug Development Grunt Work

OpenAI acquired Orchestra Bio, a San Francisco startup (founded fall 2022, about $20 million raised) whose AI agents track drug development programs, and will fold its team and platform into the Rosalind life sciences suite. The agents map how setbacks such as a failed manufacturing batch affect deadlines and compare responses, while scientists decide. Terms were undisclosed; Anthropic bought Coefficient Bio for about $400 million in April.

ChatGPTClaude

OpenAIOrchestra BioRosalind+15

agents, ai-policy· Published and added 20 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

There's only so much code: the rise in vulnerability numbers

Cisco Talos analysis of why Microsoft Patch Tuesday advisories rose from about 100 a month before June 2026 to 975 in September and 1,415 in October, as frontier models such as Mythos mine old code. CVEs grew 105% year over year while CISA KEV additions grew 37%, and only three September advisories were exploited in the wild. It covers pressure on 90-day coordinated disclosure and open-source maintainers, the format string bug-class precedent, and defender advice.

SnortWindows

CVE-2021-44228MythosCISA KEV+8

AI Security, AppSec, Blue Team & Detection· Published and added 20 Oct 2026

x.comarticle🛡️ Security

lee1981 (@lee1981b) on X

CyberForge Weekly CVE Rundown #006 covers six CVEs from 12-17 October 2026: BotSharp default signing key, GitLab CI/CD regex compiler overflow (CVSS v3.1 10.0), Ivanti Connect Secure auth bypass, Cisco Secure Email Gateway, BeyondTrust Remote Support and the Linux kernel PwnEscape guest-to-host bug. It gives fixed versions, KEV and EPSS status as of 18 October, and separates patch verification from compromise investigation.

GitLabIvanti Connect SecureCisco Secure Email Gateway+3

CVE-2026-108860CVE-2026-97229CVE-2026-104935+9

Blue Team & Detection, Threat Intel· Added 20 Oct 2026, published 18 Oct 2026

thingstodoapi.comtool🧠 AI

Show HN: Things to Do API

Things to Do API is a hosted knowledge base of local events (shows, talks, pop-ups, markets, festivals) that you query in natural language, for example `/v1/search?q=comedy+in+san+francisco+this+weekend`. It returns structured JSON with title, category, local start time, venue and ticket and source links. It also exposes an HTTP MCP endpoint, added with `claude mcp add --transport http thingstodo https://api.thingstodoapi.com/mcp`, so agents can use it as a tool. Coverage is live for the San Francisco Bay Area, with New York City and Los Angeles coming. Pricing is pay-as-you-go from $5 per 1,000 calls, the first 1,000 a month are free, and there is a 300 calls/min limit.

Model Context ProtocolClaude CodeREST

Things to Do APITicketmaster

mcp, llm-apps· Added 18 Oct 2026, published 16 Oct 2026

tldrsec.comarticle🛡️ Security

[tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev

tl;dr sec issue #350 is a weekly security newsletter digest. It covers XBOW's six-day Chrome full-chain exploit built with GPT-5.6 Sol, Semgrep's IDOR benchmark metrics, the EntraGoat vulnerable Entra ID lab, Zenity's AWS Bedrock AgentCore IMDS credential theft, Cisco Talos's CAIRN hunting toolkit for AI-integrated malware, the REA reverse-engineering MCP, runZero's sshamble, and a Copilot for Word AI worm.

XBOWChromeMicrosoft Entra ID+3

EntraGoatAgentCorruptionCAIRN+11

AI Security, Offensive Security, Cloud & Infra· Added 30 Oct 2026, published 15 Oct 2026

x.comadvisory🛡️ Security

lee1981 (@lee1981b) on X

Daily CVE digest on CVE-2026-76519, a CVSS 9.8 relative path traversal (CWE-23) in Cisco Secure Email Gateway's AMP File Reputation attachment processing. A crafted attachment gives unauthenticated arbitrary file writes and root command execution, and Cisco PSIRT reports active exploitation. The CVE is in CISA KEV. It lists the applicability conditions (File Reputation assigned to a policy and Content Scanner Tools earlier than 25.3.0.5525) and the fixes (scanner 25.3.0.5525, AsyncOS 15.5.5-014 and 16.5.0-780). It also covers evidence preservation, reading Cisco's System Security scan outcomes, mail/AMP log correlation, and deployment-specific recovery including cluster-key exposure.

Cisco Secure Email GatewayCisco AsyncOSCVSS+2

CVE-2026-76519CWE-23CISA KEV+4

Blue Team & Detection, Threat Intel· Added 18 Oct 2026, published 15 Oct 2026

securityweek.comarticle🛡️ Security

Cisco Warns of Exploited Secure Email Gateway Vulnerability

Cisco warned that CVE-2026-76519 (CVSS 9.8), an unauthenticated arbitrary file write in the Advanced Malware Protection feature of Secure Email Gateway, is exploited in the wild. Crafted email attachments can lead to root command execution when file reputation is enabled and Content Scanner Tools is older than 25.3.0.5525. Fixes shipped September 14 in AsyncOS 15.5.5-014 and 16.5.0-780. Cisco published IoCs, advises rebuilding virtual appliances and rotating credentials, and CISA added the flaw to KEV. It is the second exploited SEG bug since mid-September, after CVE-2026-76461.

Cisco Secure Email GatewayCisco AsyncOSCVSS

CVE-2026-76519CVE-2026-76461CVE-2026-76440+3

Threat Intel, Blue Team & Detection· Published and added 15 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Cisco Talos and Recorded Future Insikt Group describe UAT-6275 (TAG-193, overlapping Silent Lynx and YoroTrooper), a suspected Kazakhstan-nexus actor targeting CIS government, water and energy organizations. Exposed staging directories and a GitHub repo revealed four infection chains (macro documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a WinRAR CVE-2025-8088 archive) delivering custom reverse shells Chvost, Laplas and PickleShell, plus Linux tooling and a FortiWeb CVE-2025-25257 PoC. The post includes victimology, a campaign timeline, attribution rationale (medium confidence), defender guidance and ClamAV/Snort coverage.

WinRARPowerShellGitHub+2

CVE-2025-8088CVE-2025-25257UAT-6275+13

Threat Intel, Malware & RE· Published and added 14 Oct 2026

hackers-arise.comarticle🛡️ Security

Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw

Hackers-Arise tutorial on NVIDIA NemoClaw, an open-source wrapper that runs OpenClaw agents inside OpenShell sandboxes with kernel-level isolation and declarative YAML network/file policies. It covers OpenClaw's security problems (543 tracked CVEs, 40,000+ exposed instances bound to 0.0.0.0 without auth), caveats such as zero-day RCE and sandbox escapes, and install and TUI testing steps on Kali. It also cites a Cisco AI Defense plus OpenShell case study that blocked simulated exfiltration through a third-party skill.

OpenClawDockerNode.js+2

NemoClawOpenShellNVIDIA+3

AI Security, Learning· Published and added 14 Oct 2026

hackers-arise.comwriteup🧠 AI

Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw

Hackers-Arise tutorial on NVIDIA's open-source NemoClaw, which runs OpenClaw (and Hermes or LangChain Deep Agents) inside OpenShell sandboxes. OpenShell provides kernel-level isolation and declarative YAML policies for files, credentials and network access. It covers OpenClaw's risks (543 tracked CVEs, 40,000+ exposed instances), an OpenClaw vs NemoClaw comparison, the caveat that sandbox escapes and core-logic zero-days remain possible, and a Docker/Node.js install via the nemoclaw.sh wizard with TUI testing. It also cites the Cisco AI Defense plus OpenShell case study, in which an agent that does security patching was protected against a simulated exfiltration attempt.

OpenClawNemoClawOpenShell+7

NVIDIAPeter SteinbergerJensen Huang+4

agents, ai-infra· Published and added 14 Oct 2026

sfstandard.comarticle🛡️ Security

OpenAI engineer arrested in bugging of executive conference room

Reports the federal arrest of OpenAI engineer Abdulrahman Alfozan, charged with using a device to intercept oral communications after an encrypted audio recorder was found in a San Francisco executive conference room. The recorder was hidden in toilet paper and plugged into a TV's USB port. Prosecutors say he used an internal productivity tool to scout rooms and calendars, and a chatbot account tied to his spouse asked how to build, encrypt and remotely access a recorder. OpenAI's technical surveillance countermeasures team found the device, and OpenAI says it used its own models for forensic analysis. It then restricted his access in stages, timed with the FBI, before firing him. A useful insider-threat case study that also covers physical security.

OpenAI

Abdulrahman AlfozanFBItechnical surveillance countermeasures

other· Published and added 13 Oct 2026

vulncheck.comwriteup🛡️ Security

Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)

VulnCheck reproduces and root-causes CVE-2026-76504, an exploited zero-day authentication bypass in Cisco SD-WAN vManage. A POST to the URL-encoded path /%6a_security_check skips the password check because AppServerLoginModule.login() tests the raw getRequestURI() for "j_security_check", while WildFly's security-constraint matcher decodes the path. Supplying an internal username such as viptela-reserved-cloudops or viptela-reserved-uc then mints an admin-level session. Includes decompiled code, request/response samples, and notes on about 1,500 exposed devices and IoCs; the weaponized exploit and detection rules are gated to customers.

Cisco SD-WANvManageWildFly+4

CVE-2026-76504CVE-2026-20127CVE-2026-20182+8

AppSec, Offensive Security, Identity & Access· Added 12 Oct 2026

Showing 30 of 71