Daily · 2026-06-05
🚨 Cisco SD-WAN Zero-Day, 🛡️ Comodo ComoDoS, 🎯 VerdantBamboo BRICKSTORM, ⚠️ Triple npm Onslaught, 🔴 DentaQuest 2.6M Breach
Cisco's 7th SD-WAN zero-day in 2026 (CVE-2026-20245) actively exploited with no patch available. Comodo ComoDoS zero-day goes unpatched — Marcus Hutchins discovers remote IPv6 crash. VerdantBamboo APT shows 18-month dwell time via network appliances. Triple npm supply chain onslaught (IronWorm, Phantom Gyp/Miasma, Shai-Hulud wave) hits 100+ packages. DentaQuest breach exposes 2.6M accounts. Key actions: patch adjacent Cisco SD-WAN CVEs, audit network appliance access, rotate npm tokens, and monitor for WSL2 payload staging blind spots.
The seventh Cisco SD-WAN zero-day of 2026 is the day's defining story. CVE-2026-20245 is actively exploited to push unauthorized configuration changes to edge devices, no patch exists, and the likely chain starts with the CVSS 10.0 authentication bypasses in the SD-WAN Controller that Cisco Talos has tracked since 2023. Internet-exposed SD-WAN Manager instances are priority incidents, and the mid-May bypass patches break the chain.
The npm ecosystem absorbed a triple supply chain onslaught in 48 hours. IronWorm, Phantom Gyp, and the Shai-Hulud wave compromised 100+ packages, with the Phantom Gyp variant weaponizing binding.gyp to run code during npm install and recover masked CI secrets from runner memory. Every npm token should be rotated and maintainer accounts audited for impossible commit timestamps.
VerdantBamboo's BRICKSTORM campaign holds the longest dwell of the day: 18 months of access through compromised network appliances, a pfSense beachhead that survived remediation, and a pivot through a Synology NAS when the first foothold was isolated. The browser is also an attack surface: extensions like Urban VPN exfiltrate AI chat conversations, Gemini's voice assistant fell to indirect prompt injection through notifications, and Zapocalypse shows how five individually reasonable weaknesses compose into platform-wide takeover. A Comodo firewall driver can be crashed remotely with a single IPv6 packet.
Watchlist: SD-WAN bypass patches, npm token rotation, appliance and MSP credential audits, and extension allowlists.