SatoshiLabs

Nation-state and financially-motivated attackers are exploiting the same Cisco FMC authentication bypass

Two actor classes are using CVE-2026-20079 against the console that manages every Cisco Secure Firewall behind it. The same week brought a Linux rootkit planted on F5 BIG-IP APM appliances, with the installation route unreported.