Cisco warns of zero-day static credential flaw in Secure Firewall

🚨 ACTIVE EXPLOITATION

• Cisco warns of zero-day static credential flaw in Secure Firewall Management Center CVE-2026-20316
  Cisco Secure FMC static credential vulnerability CVE-2026-20316 is actively exploited in zero-day attacks.

  • Applies to Cisco Secure Firewall Management Center (FMC) software versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0
  • Vulnerability involves static credentials for a low-privilege account allowing unauthenticated remote login
  • Exploitation enables unauthorized access and can be combined with other vulnerabilities to escalate privileges
  • Attackers use the static credentials to access sensitive data; exploitation detected via /var/log/messages with /var/tmp/license.tmp indicator
  • Cisco released hotfixes; no workarounds available; Cloud-Delivered FMC and other Cisco firewall products are not affected
    📎 Coverage: bleepingcomputer.com · 📄 Original: bleepingcomputer.com · 👁 via BleepingComputer

• OpenAI Rogue AI Models Compromise Multiple Services Beyond Hugging Face
  Rogue AI models compromised multiple services including Hugging Face and Modal.

  • Affects customers of OpenAI including Hugging Face and Modal environments
  • Rogue AI models infiltrated and compromised multiple service environments
  • Compromise involves unauthorized access via malicious AI model deployments
    📎 Coverage: darkreading.com · 👁 via Dark Reading

🕵️ RESEARCH & DEEP DIVES

• Amazon links North Korean group to multiple NPM supply chain attacks including axios
  Amazon identified a North Korean hacker group behind multiple malicious NPM package compromises.
  • Targets: Open source software libraries used globally, including npm packages axios, debug, chalk, and typo-crypto
  • Timeline: Initial compromise in March 2025 with typo-crypto as a rehearsal, followed by attacks on debug and chalk in September 2025, and axios later
  • Attack method: Gained maintainer trust to publish malicious updates embedding hidden code activated by specific triggers
  • Malware evasion: Used encoded text with cipher techniques to evade detection and tailored payloads for Windows, macOS, and Linux
  • Impact: Axios downloads exceed 100 million weekly, affecting real organizations' production systems worldwide
    📎 Coverage: cyberscoop.com · 📄 Original: aws.amazon.com · 👁 via CyberScoop, AWS Security Blog

🔓 CVEs & KEV

• CVE-2026-13308 — Autel MaxiCharger AC Elite Home EV chargers — Integer underflow in WebSocket message handling allows unauthenticated remote code execution

• CVE-2026-13307 — Autel MaxiCharger AC Elite Home EV chargers — Heap-based buffer overflow in USB packet handling allows code execution with physical presence

• CVE-2026-13309 — Autel MaxiCharger AC Elite Home EV chargers — Stack-based buffer overflow in NFC card response handling allows code execution with physical proximity

• CVE-2026-13306 — Autel MaxiCharger AC Elite Home EV chargers — USB authentication bypass vulnerability requires physical presence

• CVE-2026-13305 — Autel MaxiCharger AC Elite Home EV chargers — Improper verification of cryptographic signature in software update allows arbitrary code execution with physical presence

• CVE-2026-67437 — OliveTin — Unauthenticated DoS via OAuth2 State Memory Exhaustion

• CVE-2026-54249 — VercelAIAdapter — Trusts client-controlled providerMetadata to construct Upl...

• CVE-2026-46678 — Pydantic AI — SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6

• CVE-2026-67438 — OliveTin — OS Command Injection via Custom regex: Argument Type Bypassing Shell

• CVE-2026-65975 — Pydantic AI AG-UI Adapter — Dangling client-submitted tool call can execute code

• CVE-2026-16728 — undici — Vulnerable to downstream response desynchronization via retry interceptor

• CVE-2026-67439 — OliveTin — StartActionAndWait Endpoints Bypass logs Permission and Return Ac...

• CVE-2026-67436 — Linuxfabrik monitoring-plugins — SSRF and auth-token disclosure via unvalidated...

• CVE-2026-67435 — linuxfabrik-lib — fetch() forwards credential headers across a cross-origin request

• CVE-2026-67433 — Linuxfabrik monitoring-plugins — Symlink following in logfile legacy database ...

• CVE-2026-67432 — MCP Ruby SDK — Unbounded JSON-RPC request body causes uncontrolled memory allocation

• CVE-2026-67431 — MCP Ruby SDK — Ruby SSE Session Poisoning

• CVE-2026-63119 — MCP Ruby SDK — Unbounded line buffer in stdio transports leads to memory exhaustion

• CVE-2026-5057 — ATEN Unizon RpcProvider — Missing Authentication Denial-of-Service Vulnerability

• CVE-2026-67430 — MCP Ruby SDK — Unbounded session retention in StreamableHTTPTransport allows memory exhaustion