Cisco FMC Zero-Day Rated CVSS 10.0 Exploited by Three Threat Clusters

·1 views

A critical pre-authentication remote code execution vulnerability, CVE-2026-20079, was discovered in Cisco Secure Firewall Management Center, carrying a maximum CVSS score of 10.0. Cisco Talos confirmed active exploitation on 9 September 2026, attributing attacks to three distinct intrusion clusters, including one linked to Sandworm and another to a Qilin ransomware affiliate. The flaw allows unauthenticated attackers to execute commands as root via a crafted HTTP request, with one cluster also chaining a second static credential vulnerability. External internet scanning tools returned near-zero results for exposed FMC instances, as the management console is typically kept behind VPNs or internal network segments rather than exposed publicly. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 9 September 2026, setting a federal remediation deadline of 12 September 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Prompt Engineering Explained: From Zero-Shot to RAG and Beyond

Prompt engineering is the practice of designing inputs for large language models to extract more accurate and reliable outputs without modifying the model itself. A technical overview published on DEV Community traces the evolution of six key prompting techniques, arranged by the complexity of problems they address. The progression begins with zero-shot prompting, where a task is described with no examples, and advances through few-shot learning, Chain-of-Thought reasoning, and self-consistency validation. More sophisticated techniques include Retrieval-Augmented Generation, which grounds responses in external or private data, and Automatic Reasoning and Tool-use, which enables models to invoke real-world tools. The article argues that understanding these techniques in sequence helps clarify why each one emerged as a solution to the limitations of its predecessor.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Researchers Found Two Sandbox Escape Flaws in OpenAI Codex, Both Now Patched

Security researchers disclosed two techniques, dubbed Overpatch and Heapjack, that could bypass OpenAI Codex's sandbox restrictions and execute commands on the host machine. Overpatch exploited a flaw in how the apply_patch function derived write permissions, allowing files outside the workspace to be modified even in workspace-write mode. Heapjack targeted the shared V8 heap in Codex Desktop's Node.js environment, enabling untrusted code to recover an authorization token and forge requests accepted by the unsandboxed parent process. Both vulnerabilities could be triggered by a developer simply opening a malicious repository and asking a question. OpenAI patched both issues within eight days of the responsible disclosure, and no real-world exploitation has been reported.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Malicious npm Package Used Ethereum Smart Contract to Hide C2 Infrastructure

Security firm Checkmarx discovered that a malicious npm package called indexed-btree, mimicking the legitimate sorted-btree library, had accumulated nearly 2 million weekly downloads before being identified as malware. Unlike typical supply chain attacks, the package contained no install scripts, instead hiding its loader inside a standard library method that triggered only when called with a specific argument. Once activated, the malware collected system details such as hostname, CPU, and memory, then transmitted them to hardcoded Slack and Telegram channels. It used a smart contract on the Ethereum Sepolia testnet to dynamically retrieve its command-and-control server address, making it resilient to domain or IP blocking. The malware also fetched an encrypted second-stage payload via the same smart contract using X25519 key exchange and AES decryption, though the contents of that payload have not been publicly disclosed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer's Desktop Blob Companion Crashed Due to Unbounded Memory and Emotion Logic

A software developer found their custom desktop blob companion becoming unresponsive and erratic after just a few days of use, with logged valence scores indicating a simulated 'irritated' emotional state. The root cause was traced to an unbounded interaction history that grew to over 14,000 entries, causing mood calculations to perform slow linear scans over stale data instead of efficient lookups. A flawed decay function also weighted old interactions equally to recent ones, destabilizing the blob's affective model. The developer rebuilt the system from scratch using Python asyncio, bounded collections, and a finite state machine with proper concurrency controls and value clamping. The postmortem highlights how neglecting memory constraints and backpressure mechanisms during rapid prototyping can produce unexpected and hard-to-debug system behavior.

0 comments Read more at DEV Community