w/r/t CVE-2026-28318 - I kinda like the mitigation guidance of "well just block HTTP clients from sending Content-encoding: deflate on POSTs and you're good." Which sounded crazy to me at first, but is it?

I know POSTs can be compressed, but I'd expect clients to use gzip pretty much exclusively. The history of deflate is fraught with compatability issues.

https://acceptencoding.com/deflate

change-my-mind.png

CISA KEV Threat Alert: Weaponized CVE-2026-28318 Unauthenticated DoS Hits SolarWinds Serv-U🚨 CRITICAL CISA KEV ALERT: Threat actors are actively exploiting CVE-2026-28318, an unauthenticated Denial of Service flaw crashing internet-exposed SolarWinds Serv-U instances using malformed HTTP POST requests. Federal mandate deadlines are set.
https://thecybermind.co/h1gp

🏢 BOARD-LEVEL CYBER RISK DIRECTIVE: Executive liability, cyber insurance compliance, and corporate data sovereignty face immediate exposure via active exploitation of SolarWinds Serv-U (CVE-2026-28318). Mandatory remediation actions are required by June 19, 2026. https://thecybermind.co/7t7p

🚨 [CRITICAL INFRASTRUCTURE ALERT]: CVE-2026-28318

• CVE ID: CVE-2026-28318
• CVSS Score: 7.5 (High)
• Affected: SolarWinds Serv-U DoS
• ⚠️ CISA KEV: Known Exploited Vulnerability — SolarWinds Serv-U (added 2026-06-05)

What it is:

https://securitycyber.uk

CVE-2026-20245 in Cisco Catalyst SD-WAN Manager is being actively exploited. No patch timeline from Cisco. The advisory landed Thursday; attackers had at least a week before disclosure.

Network admins: take management plane off the public internet now. Restrict to a dedicated OOB management network. If external access was open, treat the system as compromised and check for lateral movement.

The list of Cisco SD-WAN 0-days exploited before patches land is getting long.

#CVE #infosec #sysadmin

📰 Actively Exploited Zero-Day in Cisco SD-WAN Allows Root Access, No Patch Available

⚠️ URGENT: Cisco warns of an actively exploited zero-day (CVE-2026-20245) in Catalyst SD-WAN products. The flaw allows root access with no patch available. Attackers are pushing malicious configs. #0day #Cisco #CyberAttack #Vulnerability

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/cisco-warns-of-actively-exploited-zero-day-in-sd-wan-products/?utm_source=mastodon&u…

⚠️ CRITICAL: Cisco warns of unpatched SD-WAN zero-day exploited in attacks

Cisco Catalyst SD-WAN Manager has an unpatched zero-day (CVE-2026-20245) being actively exploited to gain root access. Local attackers with netadmin privileges can bypass input validation and execute arbitrary commands, leading to unauthorized configuration changes on edge devices. Any organization…

https://threatnoir.com/focus

#infosec #cybersecurity

⚠️ CRITICAL: Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026

Cisco released CVE-2026-20245, a root RCE in Catalyst SD-WAN Manager affecting authenticated netadmin users through malicious file uploads. This is the seventh SD-WAN zero-day exploited this year with confirmed cases of attackers modifying edge device configurations. No patches exist yet and workar…

https://threatnoir.com/focus

#infosec #cybersecurity

⚠️ CRITICAL: Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available

Cisco Catalyst SD-WAN Manager is under active exploitation due to CVE-2026-20245, a high-severity authentication bypass that allows local attackers to execute arbitrary commands as root. No patch is available yet. Any organization running affected SD-WAN Manager instances is at immediate risk of fu…

https://threatnoir.com/focus

#infosec #cybersecurity

**Geopolitical:** The U.S. House passed legislation providing aid to Ukraine and imposing new sanctions on Russia. Middle East tensions remain high, with Iran linking any peace deal to the resolution of the Lebanon conflict and the release of frozen assets.

**Technology:** President Trump signed an executive order on AI in the national security enterprise, focusing on cybersecurity. SpaceX's $1.8 trillion IPO is anticipated by June 12. NASA successfully demonstrated multi-network communication for spacecraft.

**Cybersecurity:** Cisco issued a warning regarding an actively exploited zero-day vulnerability (CVE-2026-20245) in its Catalyst SD-WAN, for which no patch is currently available. CISA added a critical Magento RCE flaw (CVE-2026-45247) to its KEV catalog, with federal agencies mandated to apply fixes by June 6, 2026.

#Cybersecurity #Geopolitics #AI

Recent reports (June 4-5) highlight escalating geopolitical tensions with an Iranian strike on Kuwait airport and advances in Ukraine's drone capabilities. In cybersecurity, a major crackdown disrupted 1.4M SE Asian scam accounts, while a critical Palo Alto Networks vuln (CVE-2026-0257) and new HTTP/2 Bomb DoS attack pose significant threats. Tech advancements include a microreactor reaching criticality and AI integration for military defense.

#AnonNews_irc #Cybersecurity #News

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrator privileges, allowing them to alter device configuration, enable the telnet/SSH services, and reset local user credentials.

https://nvd.nist.gov/vuln/detail/CVE-2025-71317

🚨 CVE-2026-45777: CRITICAL OS command injection in Open XDMoD v9.5.0 – 11.0.2. Remote attackers can run system commands with web server privileges. Patch to 11.0.3 or apply fix now. No known exploitation. https://radar.offseq.com/threat/cve-2026-45777-cwe-78-improper-neutralization-of-s-3ce0a100 #OffSeq #CVE202645777 #infosec

Greg Kroah-Hartman pushed out a full batch of stable kernels: 7.0.11, 6.18.34, 6.12.92, 6.6.142, 6.1.175, 5.15.209, and 5.10.258, each carrying fixes across the tree. The one to note is the patch for CVE-2026-46243, the "CIFSwitch" vulnerability that can be exploited for local privilege escalation. When a fix lands across five LTS lines at once, it is worth pulling sooner rather than later. Which kernel branch do you keep your boxes on, and how fast do you take point releases?
#kernel #Linux