TL;DR
Cisco released patches for a critical unauthenticated root RCE in Nexus 9000 switches. HPE patched 8 critical vulnerabilities in ArubaOS-CX including two rated 9.8. Attackers compromised Coder's cloud infrastructure to inject malicious Terraform registry modules. A dark web service is selling 153M+ driver license scans from the U.S. and Canada.
Executive Summary
- Cisco has released patches for a critical Nexus 9000 vulnerability allowing unauthenticated remote attackers to execute code as root on 10 Silicon One-based switches.
- HPE patched eight critical vulnerabilities in ArubaOS-CX network operating systems, including seven umbrella CVEs with two rated CVSS 9.8 and no available workaround.
- Attackers compromised Coder's Cloudflare infrastructure and deployed unauthorized registry servers delivering malicious Terraform modules containing credential-stealing code.
- A dark web service is offering digital scans of over 153 million driver licenses from the United States and Canada; the FBI is investigating.
- An RMM phishing campaign spanning 46 countries shows 45% of observed activity targeting the United States, using tactics including Canada Revenue Agency tax form lures.
Top Threats Today
1. Cisco Nexus 9000 Unauthenticated Root RCE
Severity: CRITICAL Affected: Technology
Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root [1]. The vendor also released an IOS XR hardening release bundling seven umbrella CVEs, two of which are rated 9.8, with no available workaround ⚠[1]. Organizations running affected Nexus 9000 hardware should apply patches immediately to prevent unauthorized administrative access.
Sources:[1] The Hacker News
Recommended Action
- Immediately apply Cisco patches to all Nexus 9000 Silicon One-based switches
- Review network access logs for unauthorized administrative sessions or unexpected command execution
- Prioritize patching of Internet-facing or untrusted-network-adjacent Nexus devices
- Deploy network segmentation to isolate affected switches pending patch deployment
2. HPE ArubaOS-CX Critical Vulnerabilities
Severity: CRITICAL Affected: Technology
Hewlett Packard Enterprise has patched eight critical vulnerabilities in the ArubaOS-CX network operating system that could lead to remote code execution [1]. The eight CVE identifiers are CVE-2026-73749, CVE-2026-73750, CVE-2026-73751, CVE-2026-73752, CVE-2026-73753, CVE-2026-73782, CVE-2026-73781, and CVE-2026-73780 [1]. These vulnerabilities affect core network infrastructure and should be treated with the highest priority for remediation.
Sources:[1] BleepingComputer
Recommended Action
- Apply HPE patches to all ArubaOS-CX devices immediately
- Audit network switch configurations and access logs for signs of exploitation
- Monitor for any unusual administrative access or command execution on ArubaOS-CX systems
- Coordinate with HPE support for expedited deployment timelines if patches cannot be applied immediately
3. Coder Infrastructure Hijacked for Supply-Chain Attack
Severity: HIGH Affected: Technology
Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code [1]. Organizations using Terraform modules from Coder or related registries should assume potential compromise of deployed infrastructure credentials and rotate all secrets immediately. This incident demonstrates how supply-chain infrastructure can be weaponized to steal credentials from end-user deployments.
Sources:[1] BleepingComputer
Recommended Action
- Rotate all Terraform and infrastructure credentials that may have been deployed via Coder registry modules
- Audit Terraform state files and logs for evidence of credential exposure
- Review CloudFormation, Terraform, and other infrastructure-as-code repositories for suspicious module sources
- Enable credential scanning in all CI/CD pipelines and code repositories
- Implement registry pinning and checksum verification for all infrastructure-as-code dependencies
4. 153 Million Driver License Scans Offered on Dark Web
Severity: HIGH Affected: Finance
A new identity theft service launched on the dark web is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada [1]. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning data from public sources ⚠[1]. The FBI is investigating the service [1]. This represents one of the largest credential databases available on the dark web and poses significant risk for identity theft, account takeover, and fraud targeting both consumers and financial institutions.
Sources:[1] Krebs on Security
Recommended Action
- Monitor the FBI's public advisories and identity theft resource center for additional guidance
- Implement or enhance identity verification controls beyond static driver license data
- Monitor credit bureaus and financial account activity for signs of fraud or unauthorized account creation
- Consider offering complimentary credit monitoring services to customers if your organization holds driver license data
5. RMM Phishing Campaign Expands Across 46 Countries
Severity: HIGH Affected: Technology
An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has turned out to be part of a broader campaign spanning 46 countries [1]. Around 45 percent of observed activity was associated with the United States, making it the campaign's top target [1]. The campaign employs social engineering tactics using trusted institutional lures to drive credential harvesting and remote access tool installation.
Sources:[1] The Hacker News
Recommended Action
- Deploy email filtering rules to detect and quarantine messages impersonating tax authorities and government agencies
- Provide security awareness training emphasizing verification of unexpected tax and government communications
- Implement conditional access policies to restrict RMM tool installation to authorized IT staff only
- Monitor for unusual RMM tool deployments and command execution activity
- Enforce multi-factor authentication on all privileged accounts that could be accessed via RMM compromise
Today’s Action Checklist
- ☐ URGENT: Apply Cisco Nexus 9000 and HPE ArubaOS-CX patches to all affected network infrastructure; treat as critical priority due to remote unauthenticated access risk
- ☐ URGENT: Rotate all Terraform and infrastructure-as-code deployment credentials in case of compromise via Coder supply-chain attack
- ☐ HIGH: Audit email gateway logs for phishing attempts using tax authority and government agency lures; deploy additional filtering rules
- ☐ HIGH: If your organization uses driver license data for identity verification, review controls and consider multi-factor authentication to offset compromised credentials
- ☐ MEDIUM: Monitor CISA KEV catalog and vendor advisories for any additional Kestra, BerriAI LiteLLM, and Kludex Starlette vulnerability details requiring remediation