Exploit / PoCcritical
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 88% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | claude.ai | s download pages before quietly moving their operation onto claude.ai's own platform, turning the trusted domain into a delivery |
| domain | gob.bo | hosted on a compromised Bolivian government website, ipelc.gob[.]bo." The payload is a Boots phishing web page hosted within |
From the original article
13 min read at thehackernews.com
The internet did not break this week. It got used exactly as designed, which is worse. Searches were siphoned through shady browser add-ons.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.