Cisco SD-WAN Zero-Day Exploited Months Before Patching

The feed highlights a widely exploited Cisco SD‑WAN zero‑day (CVE-2026-20245) that was abused for months before disclosure and patching, indicating active in-the-wild exploitation and delayed remediation. Other notable stories include a coordinated disruption of hundreds of Amadey/StealC C2 servers, critical Ubiquiti flaws enabling remote unauthenticated changes, macOS attack chains that can silently disable endpoint security from a non-admin account, the emergence of the Mistic RAT used by initial access brokers feeding multiple ransomware families, exploitable CI/CD weaknesses that threaten