FIRESTARTER Backdoor Hit Federal Cisco Firepower Device, Survives Security Patches

A broad set of high‑impact cyber incidents and vulnerabilities was reported: a FIRESTARTER backdoor compromised a federal Cisco Firepower (ASA) device and survived patches; multiple supply‑chain compromises and malicious packages were observed (Bitwarden CLI/Checkmarx campaign, malicious checkmarx/kics Docker images and VS Code extensions, and a self‑propagating npm worm stealing developer tokens); active exploitation of LMDeploy (CVE-2026-33626, SSRF) within hours of disclosure; a high‑severity sandbox escape in Cohere Terrarium (CVE-2026-5752) enabling root code execution and container break