InfoSecBulletin Cybersecurity for mankind
The Interlock ransomware group has been exploiting a remote code execution (RCE) flaw in Cisco’s Secure Firewall Management Center (FMC) software in zero-day attacks since late January.
Cisco fixed the security issue (CVE-2026-20131) on March 4. They warned that this flaw could let attackers run any Java code as root on devices that have not been updated.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The Amazon security team said on Wednesday that the Interlock ransomware group had been using the Secure FMC problem to target company firewalls for over a month before it was fixed.
The attack process sends special HTTP requests to a certain point in the affected software to run any Java code. After this, the hacked system sends an HTTP PUT request to an outside server to show the attack worked. Once this is done, commands are sent to get an ELF binary from a remote server, which has other tools related to Interlock.
“While looking for any current or past exploits of this vulnerability, our research found that Interlock was exploiting this vulnerability 36 days before its public disclosure, beginning January 26, 2026,” said CJ Moses, CISO of Amazon Integrated Security.
“This wasn’t just another vulnerability exploit, Interlock had a zero-day in their hands, giving them a week’s head start to compromise organizations before defenders even knew to look.”
“On March 4, 2026, Cisco issued a security advisory disclosing a vulnerability in the web interface of Cisco Secure Firewall Management Center Software,” Cisco told BleepingComputer on Wednesday in an email statement after publishing. “We appreciate Amazon’s partnership on this, and we have updated our security advisory with the latest information. We strongly urge customers to upgrade as soon as possible and reference our security advisory for more details and guidance.”
Since the start of the year, Cisco has worked on fixing many security problems that were used by hackers. For example, in January, it fixed a serious Cisco AsyncOS flaw that was used to break into secure email devices since November and fixed an important Unified Communications RCE that was also used in attacks.
Last month, Cisco fixed a serious flaw that was used as a zero-day to get around Catalyst SD-WAN login. This let attackers take control of controllers and add harmful rogue peers to specific networks.
