DanSec

Vendor

Cisco

In 113 briefs, most recently 5 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

102 Cisco vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 7 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Zyxel GS1900 zero-day hit nearly 1,000 switches, OpenSSH 'sshole' flaw on musl systems, and Chainalysis confirms all users' tokens exposed.
  2. Binance's $6.3B heist tied to TraderTraitor, Polymarket supply-chain hack, and critical CVEs in GitLab and Cisco SD-WAN exploited in the wild.
  3. Sony ISP breach exposes 2.5M customer records, DHS staff data leaked via Okta, and Cisco firewall VPN zero-day exploited. Covers Volt Typhoon and more.
  4. Sony's So-net breach exposing 2.58M customers, GMO Onamae ransomware breach, and Oracle PeopleSoft zero-day exploited by ShinyHunters.
  5. Railway secrets exposure, Onamae VPS malware on 26,739 servers, LiteLLM supply chain attack, and critical PHP2Shell RCE flaws under mass exploitation.
  6. Covers the UK Legal Aid Agency and CenterPoint Energy breaches, Ivanti and Cisco zero-days under exploitation, and GhostAction compromising about 1,900 GitHub …
  7. ASOS customer data theft, the FakeGit GitHub malware campaign with 17,000+ repos, and Flax Typhoon disruption by the FBI, plus new exploited flaws.
  8. Bitget $387.5M zero-day theft, Pentagon DMDC breach of 3M+ service members' records, and Zammad zero-day chain hitting DIVD, plus Citrix and Cisco exploitation.
  9. Gyazo breach exposing 23.6M records, actively exploited Orkes Conductor flaw, and a CVSS 10.0 Cisco ISE zero-day authentication bypass.
  10. Covers BigBear 2.0 phishing, Shai-Hulud malware via hijacked AI coding session, FBI seizure of NightmareStresser DDoS-for-hire domains, and Cisco ISE zero-day …
  11. Japan Digital Agency VPN breach exposes 246,000 employees; Cisco zero-day CVE-2026-76461 under active exploitation; Red Heron and Sandworm threat activity.
  12. Attackers chain JFrog Artifactory flaws for backdoors, GitLab and Check Point urge patches, and Cisco FMC flaws see ransomware exploitation.
  13. AdaptHealth breach hits 4.1M people, Trezor users targeted by phishing, Veradigm patient data leak; plus Fortinet and Cisco exploits.
  14. Manchester Airports Group ransomware leak of 8.8M people, Thomson Reuters C-Track breach, and Coder Terraform supply-chain attack.
  15. Softaculous BGP hijack delivers malicious Virtualizor update; Dropbox breached via Lenovo ID flaw; 153M US/Canadian driver's license scans for sale on dark web.
  16. Berlin city data theft by Rhysida, McKesson breach claimed by ShinyHunters, and Cronos restart after $74M Tectonic exploit.
  17. McKesson breach claimed by ShinyHunters (284M records), Berlin city ransomware by Rhysida, and ServiceNow critical code injection patches.
  18. Hasbro breach, ATF ransomware incident and Hugging Face takeover by rogue AI agents lead; also ServiceNow and PaperCut flaws.
  19. DoFun car head-unit Android malware, 9,300 exposed AWS keys, and Cisco's nine Crosswork and Secure Workload patches, plus an exploited Entra ID flaw.
  20. ClarityCheck leaks 9M face images, Operation CameraSwarm hijacks 14,000 Dahua cameras, and GitLab flaw CVE-2026-19478 is exploited.
  21. Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
  22. Polish CHP plant hacked via private cellular APN, LexisNexis and Valve/CEVA breaches, and actively exploited Progress Kemp LoadMaster flaw.
  23. Unlimited Technology breach hits 3.8M people, SharePoint flaws exploited in Swiss government attacks, and TeamPCP linked to Redis and supply chain campaigns.
  24. Oracle database hack via khunt toolkit, Snowflake data theft guilty plea, and actively exploited JetBrains TeamCity RCE.
  25. The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
  26. Coca-Cola's Fairlife ransomware halts US dairy output; 23andMe pays $18M to 43 states; Scattered Spider pair jailed over TfL hack.
  27. Polymarket $3M frontend hack via vendor, Klue-Salesforce breach hitting two dozen firms, and Signal backup-key phishing by Russian-linked hackers.
  28. Covers PTC Windchill RCE exploited in the wild, Cisco CUCM SSRF weaponized within 24 hours, and Turla's new STOCKSTAY .NET backdoor targeting Ukraine.
  29. Operation Endgame disrupts Amadey botnet and Stealc infostealer; Cisco Catalyst SD-WAN zero-day exploited for two months; Chrome 149 patches 18 flaws.
  30. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  31. Klue OAuth breach exposed Salesforce data, FortiBleed leaked ~74,000 Fortinet credentials, and law enforcement disrupted the SocGholish botnet.
  32. ShinyHunters breaches at Council of Europe and Infinite Campus, Novo Nordisk and Tchap data theft, and exploited Cisco SD-WAN Manager flaw CVE-2026-20262.
  33. ShinyHunters hit Oracle PeopleSoft and Nottingham University; Ivanti Sentry flaw exploited; Microsoft's record 206-flaw Patch Tuesday.
  34. ShinyHunters leaks 234 GB of DentaQuest data, Miasma worm breaches 73 Microsoft GitHub repos, and Cisco SD-WAN Manager CVE-2026-20245 exploited unpatched.
  35. The Hola Browser supply chain cryptominer, the DentaQuest breach of 2.6M accounts, and Cisco zero-days in Unified Communications Manager and SD-WAN Manager.
  36. Covers the IMA Diligence breach affecting 525,000 people, Acer Wave 7 mesh router zero-days, and a Microsoft 365 Android token-theft flaw.
  37. Kimwolf botmaster arrested, GitHub breach via malicious VS Code extension, and Grafana repo theft via TanStack supply chain attack.
  38. Foxconn ransomware by Nitrogen, OpenAI breach via TanStack supply chain attack, and Cisco SD-WAN zero-day CVE-2026-20182 exploited in the wild.
  39. Canvas/Instructure breach exposing up to 275M students, DAEMON Tools supply chain backdoor, and a zero-day in Palo Alto PAN-OS firewalls.
  40. ADT breach by ShinyHunters, UK Biobank medical data sold on Alibaba, and a Cisco Firepower Firestarter backdoor compromise.
  41. Bitwarden and Checkmarx supply chain attacks, Vercel breach, and actively exploited Microsoft Defender BlueHammer zero-day.
  42. Covers the France Titres government data breach, the $290M Kelp DAO crypto heist tied to North Korean actors, and over 1,500 exposed Perforce P4 servers.
  43. KelpDAO's $290M crypto theft tied to Lazarus Group, Vercel breach via compromised OAuth tokens, and a Scattered Spider leader's guilty plea.
  44. ShinyHunters leaks 13.5M McGraw Hill accounts, Rhysida ransomware breach hits 337,000 patients, and Windows zero-days are actively exploited.
  45. Bitcoin Depot $3.6M crypto theft, Signature Healthcare hospital cyberattack, and TeamPCP supply chain breach exposing Cisco source code.
  46. European Commission breach via Trivy supply chain attack, Cisco source code theft, and FortiClient EMS CVE-2026-35616 actively exploited in the wild.
  47. The EU Commission cloud breach by TeamPCP, the $280M Drift Protocol heist by North Korean actors, and Stryker's data-wiping attack.
  48. Cisco source code theft, Axios npm hijack spreading malware, and Iranian Pay2Key pseudo-ransomware campaigns.
  49. The Hightower Holding breach (130,000 affected), the TeamPCP supply chain attack added to CISA KEV, and Langflow exploitation (CVE-2026-33017).
  50. Navia breach exposes 2.7M records; Trivy GitHub Actions compromised again; Magento defacement campaign hits thousands of sites.
  51. Cisco FMC zero-day exploited by Interlock ransomware, Stryker cyberattack tied to Iranian-linked Handala, and Aura breach exposing nearly 900,000 contacts.
  52. Starbucks partner account breach, Iran-linked wiper attack on Stryker, and two Chrome zero-days exploited in the wild, plus CrackArmor Linux AppArmor flaws.
  53. The SocksEscort proxy botnet takedown, Telus Digital and Loblaw breaches, and Veeam's seven critical Backup & Replication flaws.
  54. Chinese APT campaign against Asian critical infrastructure, Cisco Catalyst SD-WAN flaw CVE-2026-20127 under mass exploitation, and DumpBrowserSecrets browser …
  55. The Wikipedia JavaScript worm, a $46M crypto theft arrest, LeakBase's takedown, and Cisco SD-WAN zero-days exploited in the wild.
  56. LexisNexis data leak, UMMC ransomware outage, and FBI/Europol seizure of the LeakBase forum.
  57. ManoMano breach hits 38M customers, Cisco SD-WAN zero-day CVE-2026-20127 exploited for three years, and US sanctions on exploit broker Operation Zero.
  58. UNC2814 espionage hit 53 orgs in 42 countries; Cisco SD-WAN flaw CVE-2026-20127 drew a CISA emergency directive; CarGurus breach hits 12M users.
  59. Covers a 149M credential leak, Fortinet FortiCloud SSO bypass exploitation, and ShinyHunters voice phishing of Okta, Microsoft and Google SSO.
  60. Under Armour ransomware breach, Fortinet FortiGate attacks, and Osiris ransomware hitting a Southeast Asian food franchisee, plus SmarterMail and Cisco …
  61. Zendesk ticket systems hijacked for global spam, Cisco zero-day CVE-2026-20045 exploited for RCE, and Fortinet FortiGate attacks via CVE-2025-59718 patch …
  62. CIRO data breach affects 750,000 people, Fortinet FortiSIEM flaw exploited in the wild, and Cisco AsyncOS zero-day patched.
  63. Grubhub and Central Maine Healthcare breaches, Microsoft-led RedVDS takedown, and a Cisco Secure Email Gateway zero-day exploited by China-linked APTs.
  64. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  65. PornHub user data stolen for extortion, 54 indicted over Ploutus ATM jackpotting, and a Cisco zero-day with no patch yet.
  66. PornHub data breach with extortion, Infy (Prince of Persia) APT resurfaces against Sweden, and DOJ indicts 54 in Ploutus ATM jackpotting scheme.
  67. The University of Sydney breach, Denmark water utility attack attributed to Russia, and actively exploited WatchGuard Fireware VPN flaw CVE-2025-14733.
  68. Ferry malware arrests in France, E-Note crypto exchange seizure, HPE OneView CVE-2025-37164 RCE, and Kimsuky's $2B crypto theft in 2025.
  69. LKQ Oracle EBS breach, Cisco AsyncOS zero-day CVE-2025-20393 exploited by China-linked APT, and Kimwolf botnet hijacking 1.8M Android devices for DDoS.
  70. React2Shell exploitation, Gladinet CentreStack hard-coded key attacks, WinRAR CVE-2025-6218 abuse, and Fortinet auth bypass patches in this security news brief.
  71. Salesforce OAuth data access via Gainsight, Italy's FS Italiane breach through Almaviva, and Operation WrtHug compromising 50,000+ Asus routers.
  72. The Oracle EBS data theft fallout, Operation Endgame takedowns, and actively exploited Fortinet and WatchGuard flaws in today's cybersecurity news.
  73. Citrix Bleed 2 and Cisco ISE zero-day exploitation, the Synnovis ransomware data breach, and a 67,000-package npm spam worm.
  74. Oracle EBS Cl0p extortion hits nearly 30 firms incl. Logitech and Washington Post; CBO confirms breach; Konni abuses Google Find Hub.
  75. Covers the CBO hack, Russian destructive attacks on Ukraine's grain sector, and LANDFALL spyware exploiting a Samsung zero-day via WhatsApp images.
  76. The SonicWall cloud backup breach, Sandworm's wiper attacks on Ukraine, Cisco UCCX patches (CVE-2025-20333), and a $128M Balancer DeFi exploit.
  77. Attacks on unpatched Cisco IOS XE devices in Australia using the BADCANDY implant, and Bronze Butler's zero-day exploit of Motex Lanscope to deploy Gokcpdoor …
  78. The Ribbon Communications breach, Cisco IOS XE webshell attacks, the Motex Lanscope zero-day exploited by Tick, and Conti extradition news.
  79. The PassiveNeuron espionage campaign, the actively exploited Oracle E-Business Suite SSRF flaw (CVE-2025-61884), and a WatchGuard Firebox RCE flaw affecting …
  80. F5 breach tied to Chinese actors, Prosper breach hitting 17.6M accounts, and Cisco IOS flaw exploited to deploy Linux rootkits.
  81. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  82. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  83. UK seizure of £5.5bn in Bitcoin, WestJet passport data breach, and Asahi cyberattack disrupting Japanese production.
  84. Co-op's £80M cyberattack loss, Shai-Hulud npm worm infecting 500+ packages, and Cisco zero-days under CISA emergency directive.
  85. Boyd Gaming breach, GeoServer flaw (CVE-2024-36401) hitting a US federal agency, and RTX ransomware disrupting European airports via Collins Aerospace.
  86. LNER breach, INC ransomware attack on Panama's finance ministry, and a critical SonicWall SSLVPN flaw (CVE-2024-40766) exploited by Akira ransomware.
  87. The npm supply chain attack, the Salesloft Drift breach hitting Salesforce, and GhostAction's theft of 3,325 CI secrets from GitHub workflows.
  88. Covers the TransUnion breach (4.4M people), MathWorks ransomware theft, and the Nx npm supply chain attack that leaked 2,300+ credentials via AI-powered …
  89. Colt Technology breach by Warlock ransomware, Apple zero-day patch, and Scattered Spider member sentenced to 10 years.
  90. Inotiv ransomware, Intel and Workhorse Software data exposures, password manager clickjacking flaws, Apple's CVE-2025-43300 zero-day, and RapperBot botnet …
  91. The WarLock ransomware attack on Colt Technology, UAT-7237 APT breaches of Taiwanese web servers, and Cisco's patched critical FMC RADIUS flaw.
  92. Pandora and Cisco data breaches, Android and Adobe AEM zero-days, and SonicWall firewall attacks by ransomware gangs in this August 2025 brief.
  93. Chanel and Northwest Radiologists breaches, Akira's suspected SonicWall zero-day, and SharePoint exploits hitting 148 organisations.
  94. The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
  95. NNSA breach via Microsoft SharePoint zero-days, Clorox's $380M suit against Cognizant, and a backdoored npm 'is' package.
  96. SharePoint zero-days under active exploitation by Chinese APTs, Cisco ISE RCE flaws, and Dell's breach by World Leaks group.
  97. The $27M BigONE crypto exchange breach, Salt Typhoon's nine-month Army National Guard intrusion, and Cisco ISE CVE-2025-20337 (CVSS 10) with other …
  98. Co-op's 6.5M member data theft, UNFI's up to $400M sales hit and Louis Vuitton breaches tied to ShinyHunters.
  99. Qantas breach hits 6M customers, Cisco Unified CM hardcoded root SSH backdoor patched, and Gamaredon spearphishing Ukraine. Plus Scattered Spider and NimDoor.
  100. Hawaiian Airlines hit by Scattered Spider, 27%+ of UK firms report cyber incidents, and Salt Typhoon targets a Canadian telecom via Cisco flaws.
  101. The UNFI and Hawaiian Airlines cyberattacks, a DOJ charge against alleged IntelBroker, and critical Cisco ISE and Open VSX flaws.
  102. Nucor's data-theft breach, a trojanized SonicWall NetExtender VPN client, Microsoft Exchange login-page injections, and APT28 Signal-based malware campaigns in …
  103. The McLaren Health Care breach (743,000 patients), Citrix NetScaler patches, and Salt Typhoon's breach of Canadian telecoms via a Cisco flaw.
  104. Kettering Health ransomware claim, AT&T breach data re-release, and BADBOX 2.0 botnet infecting over 1 million IoT devices.
  105. Play ransomware breached about 900 organizations, Lee Enterprises disclosed a breach of ~40,000 people, and Cisco ISE CVE-2025-20120 auth bypass patched.
  106. Cartier and The North Face breaches, a Chrome emergency zero-day patch, and Qualcomm Adreno zero-days exploited in targeted attacks.
  107. DOJ seizes four crypting service domains; Ubuntu, RHEL and Fedora core dump flaws expose password hashes; Cisco IOS XE WLC CVE-2025-20188 exploit published.
  108. Critical WooCommerce Wishlist flaw puts 100k+ WordPress sites at risk; AyySSHush botnet hits 9,000 ASUS routers; Interlock ransomware targets universities.
  109. Covers the 184M password exposure, $223M Cetus Protocol crypto heist, and Europol's Operation Endgame ransomware crackdown.
  110. Pearson breach, Insight Partners data theft, and Toronto school district ransom, plus SonicWall and Cisco flaws and Qilin ransomware activity.
  111. LockBit's breach, PowerSchool extortion of school districts, and the actively exploited OttoKit WordPress flaw.
  112. Harrods cyberattack amid UK retail spree, Commvault zero-day CVE-2025-3928 breach, and NullBulge's Disney Slack data theft guilty plea.
  113. SonicWall SMA VPN devices under active attack, Apple zero-days in targeted spyware attacks, and Smishing Triad toll SMS phishing in US and UK.