Cisco Zero-Day Under Active Attack, Conduent Breach Swells to 25M, and AI Fuels Ransomware Surge

New information confirms the Conduent data breach affected over 25 million individuals across the U.S., including 10.5 million in Oregon, in addition to the previously reported 15.4 million in Texas. The attack's dwell time has been precisely identified as October 21, 2024, to January 13, 2025. The incident also highlights scrutiny on clients like Blue Cross Blue Shield of Texas. This update provides more concrete details on the scope and timeline of the Safepay ransomware attack.

Cisco has confirmed CVE-2026-20127 has a critical CVSS score of 10.0. Threat actors are actively chaining this authentication bypass vulnerability with CVE-2022-20775 (privilege escalation) to achieve root access and persistence on affected Cisco Catalyst SD-WAN Manager and Controller products. CISA has issued Emergency Directive 26-03, mandating federal agencies to take immediate action. Evidence suggests this vulnerability may have been exploited as a zero-day since 2023. New IOCs, such as specific log patterns in `/var/log/auth.log` for `vmanage-admin` authentication, and enhanced detection guidance have been provided.