Threats Day Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, Click Fix Tricks, JS Backdoors & 20+ New Stories

Summary: Cisco released fixes for a high-severity SSRF flaw in Unified Communications Manager (CVE-2026-20230, CVSS 8.6) that lets an unauthenticated remote attacker write files to the underlying OS and potentially elevate to root, addressed in Unified CM and Unified CM SME releases 14SU6 and 15SU5, with proof-of-concept exploit code available but no evidence of active exploitation. Separately, researchers reported a WordPress malware campaign using invisible Unicode characters to hide payloads in Steam Community profile comments, detected on roughly 1,980 sites since July 2025, and a commercial tool called FalkonC2 whose enterprise version Rotemelli2 runs in memory, rotates command-and-control domains every 72 hours, and abuses ScreenConnect, Datto, and SimpleHelp.
What's compelling: FalkonC2's telemetry points to active enterprise infections across the U.S., Australia, the Netherlands, and Poland, and the tool checks infected machines for QuickBooks and Sage50 data - meaning the accounting systems your finance team relies on are the stated target.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2026-20230
Related: Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public Cyber Risks ·
⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More Cyber Risks ·
CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability Known Exploited Vulnerabilities · Jun 25, 2026