Security Bulletin

Affected by the vulnerability, which stems from the availability of static user credentials for root accounts during development, were Cisco Unified CM and Unified CM SME Engineering Special releases 15.0.1.13010-1 to 15.0.1.13017-1.

Threat actors behind the intrusion had leveraged breached client credentials to infiltrate C&M's systems and services, according to C&M Commercial Director Kamal Zogheib, who noted that an investigation into the incident alongside Brazil's central...

Additional details regarding the possible political bent of the intrusion were not provided by a Columbia spokesperson, who noted an ongoing investigation into the attack's connection to the display of President Donald Trump's photo on multiple...

Investigation into the extent of the intrusion, which has not yet been claimed by a known threat actor, as well as efforts to recover other systems, are still underway following the restoration of critical systems, said Surmodics in a filing with the...

Many of the fake extensions were trojanized open-source versions of cryptocurrency wallets that contain code facilitating the exfiltration of wallet keys and seed phrases, which could be leveraged for subsequent cryptocurrency asset draining...

Cisco Hybrid Mesh Firewall provides advanced security for hybrid cloud environments, remote workforces, and AI-powered innovations.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Russia-based bulletproof hosting (BPH) service offers no-questions-asked access to servers.

Passengers' personal information was likely accessed via a third-party platform used at a call center, but didn't include passport or credit card info.

Look back at the Cisco Customer Experience team’s services demos from Cisco Live 2025.

Attackers can abuse malicious extensions to access critical data, including credentials, but organizations can reduce the risks by raising awareness and enforcing strict policy controls.

AI models may fail to recognize social engineering content in training data and searches.