Thirty-Six Days Head Start

Amazon Threat Intelligence confirmed that the Interlock ransomware group exploited CVE-2026-20131 (CVSS 10.0) in Cisco Secure Firewall Management Center as a zero-day for 36 days before Cisco's March 4 patch — gaining unauthenticated root access on enterprise firewalls. Amazon's MadPot honeypot network caught the exploitation and a misconfigured server exposed Interlock's complete attack toolkit. This is the second Cisco management plane zero-day confirmed exploited by a different threat actor in three weeks, reinforcing that the network management layer is the highest-value target. Also covered: GlassWorm supply chain campaign returns across GitHub, npm, and VS Code; Apple's first silent Background Security Improvement for a WebKit flaw; and a critical unpatched telnetd RCE vulnerability (CVE-2026-32746, CVSS 9.8).