A public proof-of-concept exploit for Cisco Unified Communications Manager. A joint CISA/FBI/NSA advisory on fuel tank monitoring systems under active attack. A 32-package npm supply chain compromise stealing credentials from build pipelines. Today’s stories share a common thread: the assets under attack are the ones organizations assume are safe because they sit behind the perimeter, inside the build environment, or in a “managed” OT network. That assumption is the vulnerability.

In the News

Cisco Unified CM Critical Flaw Gets Public PoC — Root Access Risk

Cisco disclosed a critical-severity vulnerability in Unified Communications Manager that allows an authenticated attacker to escalate to root-level access on the underlying server. Proof-of-concept exploit code is now publicly available, which compresses the exploitation timeline significantly. UCM is the backbone of enterprise voice infrastructure — it manages call routing, session management, and integration with collaboration platforms across thousands of deployments globally.

The existence of public PoC code changes the risk calculus. Organizations that treat voice infrastructure as a “set and forget” environment now face an active threat. UCM servers are often on dedicated VLANs but rarely subject to the same patching cadence as production web servers or domain controllers. Cisco has released patches for all affected branches, and defenders should verify their version and apply the fix immediately. For environments where immediate patching is not possible, network segmentation and restricting administrative access to UCM management interfaces are the primary compensating controls.

What defenders should do: Verify UCM version against the Cisco advisory, apply the patch, and restrict management interface access to a dedicated admin VLAN. Monitor for anomalous authentication attempts against UCM servers.

CISA, FBI, NSA Warn of Attacks Targeting Fuel Tank Monitoring Systems

A joint advisory from CISA, FBI, and NSA warns that threat actors are actively targeting internet-exposed automatic tank gauge (ATG) systems. These OT devices monitor fuel levels, temperature, and pressure at gas stations, airports, military fuel depots, and pipeline distribution points. The advisory identifies specific ATG models from multiple manufacturers that are deployed with default credentials and no network segmentation.

ATG systems represent a class of OT device that was never designed for network exposure. Many were deployed decades ago with serial interfaces and later connected to IP networks for remote monitoring. The advisory calls for immediate network isolation, disabling remote access where operationally feasible, and changing default credentials. For organizations with large distributed OT footprints — fuel distributors, airport operators, military logistics — passive asset discovery is the prerequisite: you cannot segment devices you have not inventoried.

This is the kind of advisory that resonates in executive briefings. A joint CISA/FBI/NSA warning carries regulatory weight, particularly for organizations subject to TSA security directives or NERC CIP requirements. The advisory is actionable today: identify ATG devices on the network, isolate them, and disable unnecessary remote access.

What defenders should do: Inventory ATG devices on the network using passive OT discovery. Isolate them from enterprise IT networks. Disable remote access or restrict it to VPN with MFA. Change default credentials on all ATG management interfaces.

npm Supply Chain Attack “Miasma” Compromises 32 Packages

Microsoft and Red Hat jointly disclosed a coordinated supply chain attack targeting the npm ecosystem. Dubbed “Miasma,” the campaign compromised 32 npm packages with a combined 117,000 weekly downloads. The malicious code — injected during the build process — harvested credentials, API tokens, and environment variables from CI/CD runners and exfiltrated them to attacker-controlled servers.

This is the second major npm supply chain attack in a single week, following the OpenAI Codex token theft campaign. The pattern is clear: build environments are treated as trusted by default, and attackers are exploiting that trust systematically. CI/CD runners typically have broad network egress, access to secrets managers, and elevated permissions — making them high-value targets for credential theft. The Miasma campaign specifically targeted packages used in Node.js backend services, maximizing the likelihood that harvested credentials would grant access to production cloud infrastructure.

Microsoft’s analysis includes YARA rules and network indicators for detecting Miasma activity. Defenders should audit npm dependencies against the published list of compromised packages, rotate any credentials that were accessible to CI/CD environments running those packages, and implement DNS-layer filtering on build infrastructure to block exfiltration to known malicious domains.

What defenders should do: Audit npm dependencies against the Miasma package list. Rotate credentials accessible to affected CI/CD environments. Implement egress filtering and DNS-layer controls on build systems. Adopt software composition analysis tooling and generate SBOMs for all build pipelines.

Stock Exchange Executive’s Mailbox Breached for 150 Days

Threat actors maintained persistent access to a stock exchange executive’s Outlook mailbox for approximately 150 days, exfiltrating sensitive data through Dropbox and OneDrive. The cloud-native exfiltration technique blended with legitimate business traffic, evading network-layer detection. The campaign is attributed to an espionage-motivated operation targeting financial sector leadership.

A 150-day dwell time in an executive mailbox is not a detection gap — it is an observability failure. Traditional email security monitors inbound threats (phishing, malware attachments) but rarely provides visibility into persistent mailbox access patterns or data movement to cloud storage. The attackers exploited this gap by using the executive’s own authorized cloud services as exfiltration channels. Detecting this pattern requires correlation across Microsoft 365 audit logs, cloud storage API activity, and mailbox rule changes — the kind of cross-source analysis that SIEM platforms and XDR solutions are designed to perform.

What defenders should do: Enable and monitor Microsoft 365 unified audit logs for executive mailboxes. Alert on new mailbox forwarding rules, OAuth app grants, and bulk downloads to cloud storage services. Enforce step-up authentication on executive accounts from new devices or locations.

Defender Action Items

  • Cisco UCM: Verify version against advisory, patch immediately, restrict management interface access to dedicated admin VLAN
  • ATG/OT devices: Inventory all internet-exposed ATG systems, isolate from enterprise networks, disable remote access or enforce VPN with MFA, change default credentials
  • npm supply chain: Audit dependencies against Miasma package list, rotate CI/CD credentials, implement DNS-layer egress filtering on build infrastructure, generate SBOMs
  • Executive mailbox monitoring: Enable M365 unified audit logging, alert on forwarding rule changes and OAuth grants, enforce device posture checks on privileged accounts
  • CVE-2026-45247 (Magento): Patch Mirasvit Cache Warmer or disable the plugin; deploy WAF rules for PHP deserialization attacks
  • CVE-2025-48595 (Android): Apply June Android security patch; enforce device posture via MDM or ZTNA

Detection Queries

The following Splunk SPL query detects anomalous OAuth application grants on Microsoft 365 executive mailboxes — a common persistence mechanism in the type of mailbox compromise described in today’s stock exchange breach. Tune the executive_users lookup to your organization’s privileged mailbox list.

index=o365 sourcetype="o365:management:activity" Operation="Consent to application."
| lookup executive_users UserPrincipalName OUTPUT is_executive
| where is_executive="true"
| stats count by UserPrincipalName, AppId, AppDisplayName, _time
| where count > 0
| sort - _time

This query surfaces OAuth consent events for executive accounts. Any new application grant on an executive mailbox should trigger a manual review — legitimate grants are infrequent and typically coordinated with IT. False positive rate is low when scoped to a defined executive list.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.