Suspicious Polyfill login prompts pop up on Toshiba, Muji websites

Multiple active and high-impact incidents reported: a Cisco Catalyst SD‑WAN Manager zero-day (CVE-2026-20245) is being exploited for root privilege escalation; attackers are actively exploiting a recently patched high‑severity SolarWinds Serv‑U flaw to crash servers; a Chinese APT (UNC5221) is using Brickstorm and new implants (Plenet, AgentPSD) to maintain access to Microsoft 365 environments; supply‑chain compromises include 36 npm packages infected with IronWorm and the Hola Browser for Windows delivering a cryptominer; a new Magecart campaign is abusing Stripe to host skimmers and stolen P