January 10, 2026 - Red Dot Security

Header image for the Red Dot Weekly Cyber Security News https://reddotsecurity.news

Hello all,

Cisco had a bad week, first with an actively exploited flaw in ISE, and then a switch and router boot loop due to a DNS bug . CISA went nostalgic on us and alerted to a PowerPoint flaw from 2009 for some reason. And a host of other vendors and issues made the news this week. Let’s get to some details.

Headline NEWS:

Cisco Identity Service Engine flaw in how XML is parsed in the web-based management interface of their ISE and ISE Passive Identity Connector (ISE-PIC). Successfully exploiting this defect could allow an attacker to read files from the underlying operating system. A patch is available to fix this flaw. Cisco also addressed multiple IOS XE vulnerabilities this week. Check your Cisco gear for updates.
D-Link DSL Gateway Routers have a newly discovered command injection vulnerability. An unauthenticated threat actor can execute remote commands, altering DNS configurations. There are at least four router models that are affected. Although there could be more. All of the known affected units are end-of-life (EOL) and D-Link has said that they will not receive any support or updates. It is highly recommended that you immediately replace any EOL D-Link routers you may have.
GNU Wget2 is a tool used to download from the web via command line. It has been found that if a threat actor can convince a victim to access a specially crafted link, then GNU Wget2 can write output to filesystem locations that are unintended. This could allow an attacker to replace vital system files and libraries with compromised or malicious versions. No patch was available at the time of this publication.
Open-source workflow automation platform n8n has a maximum severity defect in both the on-premises and cloud-hosted versions that can result in remote code execution (RCE). Several additional defects were revealed this week that also can enable RCE. There is mitigation guidance for these defects, if you’re unable to update. But the most effective way to protect yourself or your users is to update to the latest patched versions.
Trend Micro Apex Central web-based management console (on-premises) has a critical defect that can allow an unauthenticated threat actor RCE access. Trend Micro has released a patched version that fixes this defect along with two denial-of-service (DoS) flaws. Proof-of-Concept (PoC) code is in the wild, so don’t wait to patch this vulnerability.
Veeam has released updates to their Backup and Replication software to fix multiple defects. All of them involve unwanted or undesired elevation of privileges. Users are urged to upgrade to the latest patched versions and to follow the vendors’ recommended security guidelines.
Zoom for Windows has released an updated version to address a defect in how Zoom loads DLL files. In the unpatched version, the Zoom executable could be tricked in using a malicious DLL file instead of the legitimate one from Zoom. Update immediately to patch this vulnerability.

In Ransomware, Malware, and Vulnerabilities News:

Palo Alto Networks security-intel boss calls AI agents 2026’s biggest insider threat. In what I consider to be an excellent forward-thinking statement, Wendi Whitmore, Palo Alto Networks Chief Security Intel Officer, recently spoke with The Register about AI and what 2026 will bring. Understanding that AI Agents are now being integrated into nearly every aspect of our infrastructures, she correctly warned that these largely unmonitored and oft misunderstood quasi-users are frequently given excessive permissions. Most organizations are ignorant of the power they’re placing into the digital hands of an entity that has been demonstrated to be malleable in allegiance and intention, which is readily swayed based upon how and when it is asked to perform an action. This makes the agentic AI “a very attractive target to attack”. As we begin to employ these new “workers” it is vital that we continue to put into practice zero-trust and least access privilege. Anything more puts an organization at tremendous risk.

In Other News Events of Note and Interest:

Microsoft to enforce MFA for Microsoft 365 Admin Center sign-ins. About time! Why hasn’t this already been enforced, is what I’m left wondering? We’ve seen several years of massive account take-over happening in the M365 world. This is a good first step that should have happened five years ago. And additional step needs to be enabling device-bound tokens across all of Microsoft’s applications and infrastructure. If your login cannot be cloned and spoofed, much of the current account takeover attacks would immediately cease to exist.

Musings

Is it just me, or are people becoming more helpless and demanding? In my day job, I manage a team of cybersecurity professionals that receive a large number of requests from organizations and people from all walks of life. But some of the requests show a total lack of initiative on the part of the requestor. I’ll often copy and paste the exact text of a request into a search engine, and the first result that comes up is usually correct. Why didn’t the person who sent the request in do that? It would have saved them, and my team time. And then there’s the feeling that it is often an adversarial relationship, whereby my people are being blamed for causing an error or adverse software interaction on their workstation or network, as if we want to create problems for them. Most of my team is too young to remember the early days of computer support, when those of us that had a good grasp of how technology worked were almost venerated as minor deities. We were the heroes that would swoop in and save the day. I fondly recall one lady named Linda that always referred to me as “resident genius”. Nowadays we fix an issue, and the response is often, “Why wasn’t this done sooner?” But alas, whether the person has trouble spelling Google, or they are miffed and impatient, or are genuinely grateful, I must remind myself and my team, and never forget, that we’re here to help, to educate, to defend, to stand between the darkness and the light. And we must ever…

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: