CISA flags new SD-WAN flaw as actively exploited in attacks

Multiple high-risk security incidents and actively exploited vulnerabilities reported: CISA issued an urgent four-day remediation directive for a Catalyst SD‑WAN Manager flaw being actively exploited; Shadowserver found over 6,400 public Apache ActiveMQ servers vulnerable to an ongoing high‑severity code‑injection exploit; a former ransomware negotiator pleaded guilty for BlackCat/ALPHV attacks; NGate Android malware is trojanizing the HandyPay NFC app to steal payment card data; KelpDAO suffered a ~$290M DeFi heist likely tied to North Korean Lazarus actors; 26 malicious crypto‑wallet apps (e