Summary: The Interlock ransomware gang acquired CVE-2026-20131, a CVSS 10.0 remote code execution vulnerability in Cisco Secure Firewall Management Center, and exploited it actively from January 26, 2026—a full 45 days before Cisco's public disclosure and 47 days before patches were broadly applied. During the entire exploitation window, the enterprise defender community had zero visibility. The vulnerability was independently discovered by Amazon's MadPot threat sensor network, which notified Cisco, but the notification-to-patch cycle still left nearly seven weeks of uncontested access for Interlock operators. This incident reframes the zero-day problem: the danger is not merely that a vulnerability exists, but that sophisticated ransomware actors now systematically acquire and sit on critical-severity bugs, timing public disclosure to maximize damage and complicate incident response.

Key Findings: The 45-day exploitation window represents a structural failure in the vendor-disclosure-patch pipeline for network security infrastructure. Organizations running Cisco FMC that have not audited access logs from January 26 onward may already have active Interlock footholds. The incident also highlights the under-appreciated role of third-party sensor networks (Amazon MadPot, Cisco Talos telemetry) as compensating controls for vendor disclosure lag.

View Full Research Note

Summary: The GlassWorm/ForceMemo threat actor executed a coordinated supply chain assault against 400+ code repositories and extensions simultaneously across GitHub, npm, the VSCode Marketplace, and OpenVSX in mid-March 2026. Unlike typical supply chain attacks targeting a single registry, this campaign struck every layer of the modern developer toolchain in a single wave: version control, package management, and IDE extensions. The attack surface is uniquely dangerous because VSCode extensions and npm packages are consumed automatically by CI/CD pipelines—malicious code injected into a popular extension propagates silently to thousands of enterprise builds before any detection signal emerges. This follows ForceMemo's documented activity earlier in March 2026 and represents a significant escalation in both scope and coordination.

Key Findings: The simultaneous multi-registry strike is a novel escalation. Previously, supply chain attacks chose a single high-value registry; GlassWorm has demonstrated operational capability to execute across all four simultaneously, overwhelming the response capacity of any single platform's security team. Enterprise security teams that rely solely on package manager security notifications will have been behind the detection curve by days to weeks.

View Full Research Note

Summary: BeyondTrust disclosed on March 17, 2026 that Amazon Bedrock AgentCore Code Interpreter's sandbox—explicitly marketed as providing “no network access”—permits outbound DNS queries sufficient to establish interactive shells and command-and-control channels. Simultaneous disclosures revealed analogous DNS exfiltration flaws in LangSmith and SGLang AI execution environments. This represents an emerging attack class specific to AI agent infrastructure: vendors implement compute isolation but systematically fail to model DNS as a network egress vector. The CVSS 7.5 rating understates the operational impact. In an environment marketed to enterprises as air-gapped, the discovery of an interactive C2 channel is a fundamental trust violation, not a moderate severity finding.

Key Findings: The three simultaneous disclosures confirm this is a systemic architectural blind spot, not an isolated implementation error. Any managed AI code execution environment should be assumed to have DNS egress unless explicitly and verifiably controlled at the network layer. Enterprises running agentic workflows in cloud-hosted AI sandboxes should audit their DNS egress posture immediately.

View Full Research Note