Hackers shoveled snow for company, were rewarded with network admin access

A batch of recent The Register security stories highlights a broad wave of active threats and systemic risks: exploited Cisco vulnerabilities (notably CVE-2026-20230) and other SD-WAN 0-days, supply-chain attacks (npm poisoning by the Miasma campaign, booby-trapped Git repos targeting AI coding assistants), and public releases of 0-day exploit collections. Crimeware and access-brokering activity is prominent: a self‑destructing Mistic backdoor tied to an access broker, an advanced EvilTokens device‑code BEC/phishing kit, and evidence of insiders leaking information to ransomware actors. Large‑