Cisco Battles Critical Zero-Day as Massive Breaches at Conduent & Canadian Tire Expose 63M+

Further details have emerged regarding the 'ClawJacked' vulnerability in the OpenClaw AI agent. A new patch, version 2026.2.25, has been released, superseding the previously mentioned version. This update explicitly clarifies that the flaw allows malicious websites to bypass password protection when hijacking a local AI agent via WebSocket. The vulnerability was publicly disclosed by Oasis Security, highlighting the critical need for users to update to the latest patched version to prevent unauthorized control and potential data exfiltration from connected enterprise systems.

The Conduent data breach, attributed to Safepay ransomware, now confirms additional affected clients including Humana and Volvo Group North America, expanding the scope beyond Blue Cross Blue Shield. New technical analysis provides a comprehensive list of likely MITRE ATT&CK techniques, such as T1190 for initial access and T1041 for exfiltration. Crucially, the update introduces specific cyber observables for detection, including monitoring Windows Security Event Logs for anomalous logons, 'vssadmin.exe' commands, and unusual outbound network traffic patterns. This enhances understanding of the attack's methodology and provides actionable intelligence for defenders.

Cisco has updated its patching guidance for CVE-2026-20127, now recommending version 20.9.1 or later for all affected Catalyst SD-WAN Manager instances, superseding previous specific branch recommendations. The critical CVSS 10.0 zero-day, actively exploited by UAT-8616 since 2023, allows unauthenticated attackers to gain full admin access, often chained with CVE-2022-20775 for root. New details reveal attackers are also deleting logs (T1070.003) post-compromise to erase their tracks, emphasizing the need for immediate patching and thorough post-incident forensics.