Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

The document is a BleepingComputer security-news feed containing reports of active exploitation, zero-days, malware deployment, and major data breaches. Notable items include exploitation of Cisco Catalyst SD-WAN authentication bypass CVE-2026-20127 to deploy KeyDrift malware, a Cisco ASA/FTD denial-of-service zero-day affecting SSL VPN devices, exploitation of Linux and PHP vulnerabilities in PHP2Shell attacks, Volt Typhoon stealth operations, and scanning for a critical Oracle E-Business Suite flaw.