CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited

A broad set of active threats and notable security developments: CISA added multiple vulnerabilities to its KEV catalog (including CVE-2021-22054 and high‑severity CVE-2017-7921), and Cisco confirmed active exploitation of Catalyst SD‑WAN Manager (CVE-2026-20122). Researchers reported supply‑chain and malware activity — a malicious npm package (@openclaw-ai/openclawai) delivering a RAT and stealing macOS credentials, multi-stage VOID#GEIST deliveries (XWorm/AsyncRAT/Xeno RAT), Chrome extensions turned malicious after ownership transfer enabling code injection and data theft, and the ClickFix/”