Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access

A wave of high‑severity incidents and disclosures: Russian group Turla has refactored its Kazuar backdoor into a modular P2P botnet for stealthy persistent access, while multiple high‑impact vulnerabilities across enterprise infrastructure are being disclosed and actively exploited. Notable issues include a critical authentication‑bypass in Cisco Catalyst SD‑WAN (CVE‑2026‑20182) now on CISA's KEV list and under active exploitation, an Exchange Server XSS/spoofing exploit (CVE‑2026‑42897) used in the wild, Exim Dead.Letter BDAT code‑execution (CVE‑2026‑45185), an 18‑year NGINX rewrite module RⱯ