Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown

The collection highlights multiple high-impact active threats and supply-chain attacks: a novel Aeternum C2 botnet stores encrypted commands on the public Polygon blockchain to resist takedown; Cisco Catalyst SD‑WAN has a max‑severity zero-day (CVE-2026-20127) exploited since 2023 for unauthenticated admin access; CISA confirmed active exploitation of FileZen OS command injection (CVE-2026-25108). Researchers also disclosed widespread developer- and package-targeting campaigns (malicious NuGet/StripeApi packages, fake Next.js repos delivering in-memory malware), critical SolarWinds Serv-U 15.5