Cisco’s Catalyst SD-WAN Manager is being taken as admin
Cisco patched CVE-2026-76504 on Wednesday after confirming active exploitation that its PSIRT first saw in September. The bug is an authentication bypass in Catalyst SD-WAN Manager’s API session handling, scored 9.8. A remote attacker who never logs in can send a crafted HTTP request and land on a restricted API endpoint as the admin user.
The root cause is improper handling of URI encoding. Cisco’s indicators point to a percent-encoded character in the j_security_check login-handler path, so the rule meant to guard that endpoint fails to match and the request goes through. Every deployment is affected. There is no configuration toggle and no workaround. Fixed releases are 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Trains older than 20.9 have to migrate. CISA added the flaw to the Known Exploited Vulnerabilities catalog on September 30.
Operators should treat internet-exposed managers as already probed. Cisco is telling customers to review serviceproxy-access.log and vmanage-server.log for unexpected source addresses and admin API calls that never had a matching login. SD-WAN managers sit on the control plane of the WAN. Admin API access is a short step from policy changes, tunnel manipulation, and a pivot into branch networks.
More than half a million GitHub secrets still work
A study circulating widely today found 543,699 unique credentials that still authenticated when researchers tested them on July 27 and 28. Those secrets appeared across 1,103,438 exposures, counting files and forks. The median credential had sat on a public default branch for 784 days. Ten percent were at least 6.3 years old. One database credential last touched in June 2009 still logged in 16.1 years later.
GitHub’s default push protection, on since February 2024, did not close the gap. Truffle Security found 199,843 of the working credentials, about 36.8 percent, were exposed after that date, and 51.8 percent sat in categories the default rules do not block. Validity depends on the issuer. Only one of 101,886 exposed npm tokens still worked, and only 260 of 73,048 GitHub tokens. By contrast, 69,041 of 126,963 Google Cloud service-account credentials remained valid, as did 11,465 of 12,985 PostgreSQL connection strings.
The operational point is simple. Secret scanning finds the leak. It does not rotate the key. Anything that can still authenticate from a public repo should be treated as compromised, especially cloud service accounts and database strings, which this dataset shows are revoked far less often than package tokens.
Bitget ties a $387.5 million theft to a vendor zero-day
Bitget confirmed Wednesday that the September 24 theft of $387.5 million used a zero-day in third-party security products, citing interim work from SlowMist and Mandiant. The earliest malicious activity in those findings is August 31, on a node of an unnamed “Product A.” The attacker ran a hidden script under a service process, read a database password from an environment variable, and later used a custom withdrawal tool. Keys to cold wallets were not taken. Hot and warm wallets across 11 chains were, including Ethereum, XRP Ledger, TRON, Arbitrum, and others. The haul includes a large XRP position. Bitget says IP behavior and on-chain overlap point to North Korean actors. Elliptic and TRM Labs have reported wallet overlap with prior laundering. Circle, Tether, and NEAR Intents have frozen only about $1.1 million. On October 1, MistTrack was still watching DAI move to Tron and bitcoin enter Wasabi CoinJoin.
The same morning, MetaMask disclosed an ongoing infrastructure security incident and said it is remediating with outside advisors. The wallet maker has not published a loss figure. Together the two notes are a reminder that exchange and wallet blast radius now often sits in a vendor control plane, not in a stolen seed.
An AI agent rooted a vulnerability nonprofit in seconds
The Dutch Institute for Vulnerability Disclosure says the September 21 intrusion on its own network was an agentic attack that chained two Zammad zero-days. DIVD named the bugs on September 30. CVE-2026-102489, scored 9.4, lets an unauthenticated attacker leak sessions and run code as the Zammad user on versions 6.3.0 through 6.5.4. CVE-2026-102490, also 9.4, is a local privilege escalation to root that hits every version, including the latest alpha. DIVD says the agent stitched session hijack, remote code execution, and root in seconds. Access to DIVD infrastructure was cut and Dutch authorities were notified.
That report landed as other researchers described AI agents probing government sites, including a Canadian government web property, with officials saying nothing was compromised. The pattern is the same either way. An agent that can find, chain, and exploit in one pass compresses the window between disclosure and compromise to something a human change-control process will not beat. Zammad operators should patch both flaws and assume any internet-facing ticket system is in scope for automated chaining, not just for a patient human attacker.
Edge software is in the same bucket this morning. CISA warned on a critical pre-authentication MikroTik RouterOS flaw that can yield root code execution or a denial of service, and TeamViewer shipped fixes for five high-severity bugs that can lead to code execution through a remote session. If the device terminates a tunnel, accepts remote support, or holds a ticket queue, it is on today’s patch list.