Week in Review: F5 BIG-IP Rootkit, Exploited Cisco FMC Flaws and More
Summary
The week’s security developments include active exploitation of flaws across major products, a rootkit on compromised F5 BIG-IP APM devices, confirmed data breaches, and reports of AI agents helping attackers exploit PaperCut at 395 organizations.
Key points
- Attackers are actively exploiting a critical Cisco FMC authentication bypass, according to the roundup.
- Sophos reported a rootkit on compromised F5 BIG-IP APM devices that hides a web shell in memory.
- Mathspace confirmed attackers used an unpatched Metabase vulnerability to access data belonging to more than a million students, parents, and school staff.
- IDScan confirmed unauthorized access to customer data after reports of a dark-web database containing more than 153 million driver’s license scans.
- Google fixed an actively exploited Chrome zero-day; N-able released an emergency hotfix for a pre-authentication N-central RCE flaw.
- GreyNoise reported that AI agents helped exploit PaperCut flaws at 395 organizations.
- A shipping-partner breach exposed personal information of roughly 67,000 additional Trezor customers, increasing their phishing risk.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering actively exploited vulnerabilities, malware activity, phishing, and data breaches.
- Impact
- Reported activity includes exploitation of flaws in Cisco Secure Firewall Management Center, N-central, and Chrome; attacks affecting ScreenConnect, MikroTik RouterOS, and PaperCut; and a Linux rootkit on F5 BIG-IP APM devices. Reported breaches exposed data belonging to more than a million Mathspace students, parents, and school staff, and IDScan confirmed unauthorized access to customer data. Trezor customers were also reported at heightened risk of phishing after a shipping-partner breach.
MITRE ATT&CK
T1014 · RootkitSophos reportedly found a Linux rootkit on compromised F5 BIG-IP APM devices.T1190 · Exploit Public-Facing ApplicationAttackers are reported to be exploiting internet-accessible vulnerabilities, including flaws in Cisco Secure Firewall Management Center, N-central, and Chrome.T1528 · Steal Application Access TokenStolen session tokens are reported as part of attacks against Microsoft 365 and other SaaS accounts.T1566.004 · Spearphishing VoiceThe roundup describes vishing calls impersonating IT help-desk staff to obtain access to Microsoft 365 accounts.
CVE
CVE-2026-20079Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)CVE-2026-20316Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)CVE-2026-86218N-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218)CVE-2026-87491Google fixes yet another actively exploited Chrome zero-day (CVE-2026-87491)
People
Threat Actors
Vendors
CiscoIt also highlights active exploitation of flaws in Cisco FMC, N-central, Chrome, ScreenConnect, MikroTik RouterOS, and PaperCut, along with phishing, data breaches, and ransomware-related tactics.ConnectWiseScreenConnect Remote Access Support and Access sessions affects both Cloud and On-Premise deployments, ConnectWise confirmed. Until a fix is available, ConnectWise recommends that partners disable file transfers forF5Hackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memoryGoogleMandia to its Board of Directors on September 8. Mandia founded Mandiant and served as its CEO before Google acquired the firm in September 2022, and he has worked against cyber threats in the public and privateMikroTikIt also highlights active exploitation of flaws in Cisco FMC, N-central, Chrome, ScreenConnect, MikroTik RouterOS, and PaperCut, along with phishing, data breaches, and ransomware-related tactics.N-ableN-able patches critical N-central zero-day exploited in the wild (CVE-2026-86218)
Products
BIG-IP APMHackers deploy Linux rootkit on F5 BIG-IP APM devices, hiding web shell in memoryCisco Secure Firewall Management Centeractively exploiting CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC), which is used for centrally managing multiple Cisco Secure Firewall devices across aConnectWise ScreenConnectA file transfer flaw in ScreenConnect Remote Access Support and Access sessions affects both Cloud and On-Premise deployments, ConnectWise confirmed. Until a fix is available, ConnectWise recommends that partnersGoogle ChromeIt also highlights active exploitation of flaws in Cisco FMC, N-central, Chrome, ScreenConnect, MikroTik RouterOS, and PaperCut, along with phishing, data breaches, and ransomware-related tactics.MetabaseMathspace has confirmed that attackers broke into its internal reporting system through an unpatched Metabase vulnerability and stole data belonging to more than a million students, parents, and school staff. TheMicrosoft 365 Apps for EnterprisePhishing and social engineering campaigns are targeting Trezor users and Microsoft 365 accounts.MikroTik RouterOSIt also highlights active exploitation of flaws in Cisco FMC, N-central, Chrome, ScreenConnect, MikroTik RouterOS, and PaperCut, along with phishing, data breaches, and ransomware-related tactics.N-centralIt also highlights active exploitation of flaws in Cisco FMC, N-central, Chrome, ScreenConnect, MikroTik RouterOS, and PaperCut, along with phishing, data breaches, and ransomware-related tactics.PaperCutIt also highlights active exploitation of flaws in Cisco FMC, N-central, Chrome, ScreenConnect, MikroTik RouterOS, and PaperCut, along with phishing, data breaches, and ransomware-related tactics.