Daily · 2026-05-15
🔥 Cisco SD-WAN 6th Zero-Day, 📦 TeamPCP Supply Chain Wave, 🐧 Fragnesia Linux LPE, 🤖 Kazuar Turla Botnet, 🏭 Foxconn Nitrogen Ransomware
Cisco SD-WAN faces its 6th exploited zero-day of 2026 with CISA Emergency Directive. TeamPCP's supply chain campaign widens to include OpenAI and node-ipc. Fragnesia becomes the third Linux kernel LPE in two weeks. Microsoft reveals Turla's Kazuar evolving into a modular P2P botnet.
The Cisco SD-WAN zero-day is the day's defining story. CVE-2026-20182 is a CVSS 10.0 authentication bypass in the peering handshake that hands unauthenticated attackers administrative control of NETCONF and the entire fabric, and it is under active exploitation by a sophisticated actor plus ten additional clusters. CISA issued Emergency Directive 26-03 with a May 17 remediation deadline, making this a compliance matter as much as a technical one. Cisco SD-WAN zero-day CVE-2026-20182: 6th exploited flaw in 2026, CISA emergency directive issued
The TeamPCP supply chain assault keeps widening. OpenAI confirmed two employees' devices were compromised through the TanStack packages, forcing code-signing certificate rotation across all platforms, and node-ipc, a package with 822,000 weekly downloads, was compromised through a dormant maintainer account with DNS TXT exfiltration. A BreachForums contest now pays for the biggest open-source compromise, gamifying capability diffusion and lowering the barrier for new participants. TeamPCP supply chain assault widens: OpenAI breach confirmed, node-ipc compromised
Sandworm's documented pivot from IT into operational technology relies on known vulnerabilities rather than new tools, and telemetry shows an average of 43 days of warning signs before escalation. Detection is possible; the finding is that it goes unheeded. Exim's Dead.Letter gained reliable exploitation analysis, and Pwn2Own Berlin's first day paid out $523,000 across 24 zero-days, a preview of what attackers will adapt next.