Daily · 2026-06-24
🔴 Cisco CUCM exploited, 🎯 Klue/LastPass widens, 🤖 Mythos cracks classified systems, 🏭 Tata breached, 🎥 FFmpeg PixelSmash RCE
Cisco Unified CM CVE-2026-20230 exploited in attacks (SSRF→root, recon payloads); Klue supply chain widens — LastPass and BeyondTrust confirm Salesforce data theft; Anthropic's Mythos model finds vulnerabilities in classified US government systems under Project Glasswing; Tata Electronics confirms cyberattack as WorldLeaks leaks Apple iPhone manufacturing data; FFmpeg PixelSmash (CVE-2026-8461, CVSS 8.8) enables RCE via crafted media files across all platforms; Samsung KNOX eight-year-old UAF (CVE-2026-20971) affects Galaxy S9–S25; Arctic Wolf reverse-engineers FortiBleed credential pipeline; Lazarus deploys memory-only malware against financial sector; macOS.Gaslight Rust backdoor weaponizes prompt injection against analysts; Zscaler details Edgecution browser-extension malware; Unit 42 finds persistent malicious skills on OpenClaw marketplace; DOJ seizes Huione Group infrastructure; Five Eyes warns of AI-powered cyberattacks.
Cisco's Unified CM SSRF, CVE-2026-20230, is the day's defining story: actively exploited, reaching root through the WebDialer component's file:// handling, with public PoC and no KEV listing yet. Cisco Unified CM exploitation targets internet-facing voice infrastructure that enterprises treat as crown jewels; patch immediately and hunt for file:// URIs in WebDialer requests and unexpected writes under /tmp.
Anthropic's Mythos model found vulnerabilities in classified US government systems within hours during the Project Glasswing exercise, confirming that offensive AI capability is a present-tense reality. The same day, the Klue supply chain breach added LastPass and BeyondTrust to a victim list that now spans a dozen security vendors, with the Icarus group's leak deadline having passed without a published dump. Klue supply chain breach
Lazarus is running a memory-only, DPAPI-keyed toolset against financial targets, and the WorldLeaks extortion group leaked Apple iPhone manufacturing schematics stolen from Tata Electronics. DOJ seized Huione Guarantee's backend cloud infrastructure while Treasury sanctioned the Prince Group network, a coordinated strike at the scam-center economy that funds much of the region's cybercrime.
Watchlist: Unified CM patch status, Klue-issued OAuth token rotation, and Samsung KNOX UAF coverage across Galaxy fleets (CVE-2026-20971, fixed in the January 2026 SMR update).