Weekly Cybersecurity Roundup Covers Space Security, AI Agent Flaw and SD-WAN Exploitation
Summary
The roundup covers India's space-security guidelines, Apple's NATO restricted-data certification, an OpenClaw WebSocket flaw, Cisco's reported long-running SD-WAN zero-day exploitation, U.S. sanctions on Operation Zero, and X's appeal of an EU fine.
Key points
- India introduced space cybersecurity guidelines from CERT-In and SIA-India covering satellites, ground systems, and supply chains.
- Apple says standard iPhones and iPads running iOS 26 and iPadOS 26 are certified to handle NATO “restricted” information after testing by Germany's Federal Office for Information Security.
- Researchers say an OpenClaw local WebSocket gateway flaw could let a malicious website hijack a locally running AI agent, including through password brute-forcing and administrative access.
- Cisco Talos reported that attackers exploited CVE-2026-20127 in Cisco Catalyst SD-WAN controllers for at least three years, gaining administrative access and using CVE-2022-20775 for privilege escalation.
- The U.S. sanctioned Russia-linked broker Operation Zero. Authorities allege Peter Williams stole eight classified exploits from a U.S. defense contractor and sold them for $1.3 million in cryptocurrency.
- X appealed a €120 million EU fine under the Digital Services Act, disputing enforcement over paid verification, advertising disclosures, and researcher access to public data.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering space cybersecurity guidance, device security certification, an AI-agent vulnerability, exploitation of a Cisco SD-WAN zero-day, sanctions related to zero-day brokering, and EU regulatory enforcement.
- Impact
- The OpenClaw flaw could let a malicious website hijack a locally running AI agent and obtain administrative access. Cisco Catalyst SD-WAN controllers were reportedly compromised for at least three years, enabling administrative access and stealthy privilege escalation. The other items concern security guidance, device certification, sanctions, and a regulatory fine appeal.
MITRE ATT&CK
CVE
CVE-2022-20775Cisco · Cisco Catalyst SD-WAN; Cisco · Cisco Catalyst SD-WAN Manager; +3 moreThreat actors exploited the authentication bypass to gain administrative access and insert rogue peers, chaining the exploit with an older vulnerability (CVE-2022-20775) to escalate privileges while avoiding detection.CVE-2026-20127Cisco · Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN controllers were exploited through a critical zero-day (CVE-2026-20127) for at least three years, enabling administrative access and stealthy privilege escalation.
People
Peter WilliamsAuthorities allege that he stole eight classified exploits from a U.S. defense contractor between 2022 and 2025 and sold them for $1.3 million in cryptocurrency.Sergey Sergeyevich ZelenyukThe U.S. Department of State targeted him in sanctions related to the Russia-linked zero-day brokerage network Operation Zero.
Vendors
Apple Inc.Apple Inc. has become the first consumer device maker approved to handle NATO “restricted” classified information on standard iPhone and iPad devices running iOS 26 and iPadOS 26.Cisco SystemsCisco Systems’ Catalyst SD-WAN controllers were compromised via a critical zero-day flaw (CVE-2026-20127) for at least three years, according to Cisco Talos.
Products
Cisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN controllers were exploited through a critical zero-day (CVE-2026-20127) for at least three years, enabling administrative access and stealthy privilege escalation.iOS 26Apple became the first consumer device maker certified to handle NATO “restricted” data on iPhone and iPad running iOS 26 and iPadOS 26.iPadApple became the first consumer device maker certified to handle NATO “restricted” data on iPhone and iPad running iOS 26 and iPadOS 26.iPadOS 26Apple became the first consumer device maker certified to handle NATO “restricted” data on iPhone and iPad running iOS 26 and iPadOS 26.iPhoneApple became the first consumer device maker certified to handle NATO “restricted” data on iPhone and iPad running iOS 26 and iPadOS 26.OpenClaw#OpenClaw #OperationZeroXlong-running SD-WAN exploits, sanctions against a Russian zero-day broker, and regulatory action targeting X.
Countries
GermanyCertification, granted following testing by Germany’s Federal Office for Information Security, allows personnel across NATO member states to use commercial devices without specialized security software.IndiaIndia released new space cybersecurity guidelines developed by CERT-In and SIA-India to secure satellites, ground systems, and supply chains.RussiaDepartment of State sanctioned Operation Zero, a Russia-linked cyber brokerage network, targeting Russian national Sergey Sergeyevich Zelenyuk and associated entities.United StatesThe U.S. sanctioned Operation Zero for brokering zero-day exploits, while X appealed a â¬120M EU fine under the Digital Services Act.