New details have been revealed on how hackers exploited a Cisco Catalyst SD-WAN vulnerability tracked as CVE-2026-20245 in zero-day attacks to create rogue root accounts on targeted devices.

The CVE-2026-20245 vulnerability is a high-severity command injection flaw in Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond) that allows authenticated attackers to execute arbitrary commands as root by uploading a crafted file.

Cisco said the vulnerability stemmed from insufficient validation of user-supplied input and could be exploited by authenticated attackers with local access to affected devices.

When Cisco disclosed the flaw earlier this month, the company warned that it had been exploited in a limited number of attacks but did not provide any details.

Cisco only stated that successful exploitation allowed attackers to gain root privileges and that some incidents involved unauthorized configuration changes being pushed to edge devices.

The company released security updates and urged customers to upgrade to fixed software versions, stating that no workarounds were available.

New exploitation details emerge

In a report published today, Mandiant revealed that CVE-2026-20245 was exploited as a privilege-escalation vulnerability after attackers had already gained access to targeted SD-WAN devices.

According to the researchers, the intrusion began with unauthorized SD-WAN peering connections observed on a service provider’s infrastructure.

Beginning in March 2026, the threat actor established new rogue peer connections and authenticated to affected SD-WAN Manager devices using the vmanage-admin account.

Mandiant believes the rogue peering may have been created by exploiting previously disclosed Cisco SD-WAN authentication bypass zero-days, CVE-2026-20127 and CVE-2026-20182, though the exact method remains unclear.

After gaining access, the attackers changed the default admin account password, logged in to the SD-WAN Manager web interface, and extracted configuration information for edge devices, controllers, and SD-WAN templates.

Mandiant says the attackers subsequently restored the admin account to its original password after completing their activity, likely to reduce detection.

The researchers say the attackers then exploited CVE-2026-20245 through a tenant-upload feature in the SD-WAN command-line interface by uploading a malicious CSV file named “evil_tenant.csv.”

“CVE-2026-20245, a vulnerability reported to Cisco by Mandiant, exists in the command-line interface (CLI) of Cisco Catalyst SD-WAN Controllers that could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system,” explains Mandiant.

Mandiant says the malicious payload first created backups of system configuration files, including /etc/passwd and /etc/shadow, before creating a new account named “troot” with root-level privileges.

The attackers then used the Linux “su” command to switch from the compromised administrative account to the newly created root account, giving them full control over the device.

Mandiant says the attackers heavily relied on anti-forensic tactics to evade detection.

This includes backing up configuration files before modifying them and then restoring them after exploitation. They also cleaned up traces of exploitation by deleting the malicious CSV payload, removing temporary files created during the attack, and erasing evidence of the rogue root account.

The researchers also observed the execution of a validation script to confirm that all traces of the compromise had been removed from the device. 

Mandiant says some rogue peering activity observed in March 2026 occurred on systems that were not vulnerable to any of the previously disclosed authentication-bypass flaws.

Cisco told the researchers that the breach did not involve CVE-2026-20182 and said it was possible the attackers used certificates stolen during a previous compromise to regain access to devices.

Mandiant has published indicators of compromise, attacker IP addresses, and guidance to help organizations determine whether they were compromised.

Organizations should collect diagnostic data from SD-WAN devices, check for signs of unauthorized peering connections, and upgrade to the latest software releases if they have not already done so.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Zoox just released a new version of their autonomous robotaxi, and the vehicle retains its original no-nonsense purpose-built design, but with a few important modifications derived directly from real-world experience on the streets of Las Vegas, San Francisco, Austin, and Miami. More than half a million cyclists had already completed the route, and they had clearly made their stamp on the most recent round of changes.

The basic layout stays same; you still have the familiar boxy shape that allows you to move forward or in reverse. That design allows the large sliding doors to swing wide open on both sides, resulting in a perfectly symmetrical and comfortable cabin within. That cabin can accommodate four people, with two pairs of seats facing inwards, allowing you to either converse with your fellow passengers or relax on your own for a while.

Sale

Hiboy S2 Pro Electric Scooter, 500W Motor, 10″ Solid Tires, 25 Miles Range, 19 Mph Folding Commuter…

• Product Note: Max speed and range per charge vary based on several factors, including: rider weight, riding surface, incline, ambient temperature…
• Powerful Motor & Long Battery Life – The 500W powerful electric brushless hub motor allows for speeds up to 19mph. High capacity battery (36V/11.6AH…
• Upgrade Your Commuting – Hiboy S2 Pro Electric Scooters Front And Rear Wheel Equipped With 10-Inch Solid Tires And Rear Dual Shock Absorbers Provide…

Inside, you’ll see that the color scheme has lightened slightly, with the seats now a soft green and the floor and trim a subtle grey. It all gives the car a relaxed atmosphere and is intended to assist people remember things that would otherwise slip their memory. They’ve added extra cushioning and softer edges to the seats and headrests to make them more comfortable on all of the twists and turns, all in response to rider comments on how to make the car more comfortable for longer excursions.

Daily use has now become easier, with much larger cupholders to keep your drink from dripping everywhere. They’ve also added microscopic ridges to the phone tray to prevent your phone from sliding around when you’re on the road. The screen is also considerably brighter now, allowing you to swiftly glance over and see all of your flight information.

Outside, the reflectors have been updated, changing color to indicate which end of the car is in front. Handy for bikers, pedestrians, and emergency personnel who may need to know which direction your car is facing, plus they’ve added a mic and speaker to the door area so you can have a clearer conversation with anyone who needs to communicate with you when you stop.

However, the core technology remains unchanged, since all of the cameras, sensors, and other devices continue to provide a detailed picture of what is going on around you. Four-wheel steering is still beneficial for maneuvering through tight city streets, and the maximum speed remains around 75 mph, with the cabin seating up to four passengers as before.

Now, the primary focus is on getting this thing ready for production. The final design is complete, and they will produce 100 automobiles per week at the Hayward factory in California. If they keep up that pace, they should be able to produce around 10,000 units per year. The first replacement cars will arrive in existing fleets later this year, once all formalities (government approval) have been completed.
[Source]

A 21-year-old using the alias “Snoopy” was sentenced to 18 months in prison for his role in hacking DraftKings accounts in the November 2022 cyberattack.

In December 2025, the man, Nathan Austad of Minnesota, pleaded guilty to conspiracy to commit computer intrusion, admitting that he and co-conspirators compromised 60,000 DraftKings user accounts.

During the attack, the hackers added payment methods under their control to 1,600 accounts and stole $600,000.

DraftKings is a fantasy sports and sports betting platform where users can build teams of real-world athletes and compete for cash prizes based on their performance in actual sporting events.

In November 2022, DraftKings disclosed that hackers accessed customer accounts through credential stuffing attacks that exploited weak passwords or reused login credentials.

At the time, DraftKings reported that less than $300,000 had been stolen from affected customers. A month later, the company disclosed that 67,995 customer accounts had been compromised in the attack.

In May 2023, U.S. authorities charged Joseph Garrison for his role in the scheme, accusing him and his co-conspirators of selling access to hacked DraftKings accounts through online marketplaces such as the “Goat Shop.”

In January 2024, prosecutors charged additional suspects for the cyberattack, including Kamerin Stokes (“TheMFNPlug”) and Nathan Austad (“Snoopy”).

Austad reportedly operated his own shop where he sold access to stolen accounts and also used other platforms for the same purpose.

“AUSTAD directly controlled and profited from his own shop, which was named after the character Snoopy from the Peanuts comic strip,” the U.S. Department of Justice says.

The DoJ’s press release does not disclose the amount the hackers earned from selling access to the compromised accounts, but notes that Austad’s cryptocurrency accounts received approximately $465,000 in assets.

The U.S. DoJ also mentions direct messages that Austad sent to his co-conspirators, in which he openly admitted to perpetrating fraudulent activity and warned others to prepare.

Joseph Garrison received an 18-month imprisonment sentence in January 2024, while Kamerin Stokes received a 30-month sentence in April 2026.

In addition to the prison sentence, Austad received three years of supervised release and was ordered to pay $463,684 in forfeiture and $1,327,061 in restitution.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Micron Technology posted fiscal third-quarter revenue of nearly $42bn, quadrupling from just over $9bn a year earlier and beating Wall Street estimates by a wide margin. The results, reported on Tuesday, confirm that the company riding the AI memory boom hardest is the one whose stock has already climbed roughly 700 percent over the past year.

Adjusted earnings came in above $25 a share, compared with analyst expectations of roughly $21. GAAP net income exceeded $28bn, or nearly $25 a share, up from just under $2bn in the year-ago quarter. Gross margins hit above 81 percent, up from 69 percent in the prior quarter and 27 percent a year earlier.

The headline number is revenue growth. Micron brought in nearly $42bn against a consensus estimate of roughly $36bn, driven almost entirely by surging demand for high-bandwidth memory, the stacked DRAM chips that sit next to GPUs inside AI accelerators built by Nvidia and Google. HBM has become the binding constraint on AI infrastructure expansion, and Micron is one of only three companies in the world that can make it.

CEO Sanjay Mehrotra said Micron can currently fulfil only between half and two-thirds of customer demand for HBM. The company’s entire 2026 HBM supply is sold out under multi-year contracts, and it has collected $22bn in customer cash deposits, essentially prepayments from hyperscalers desperate to lock in supply.

Micron’s next-generation HBM4 chips are ramping what the company described as twice as fast as the previous HBM3E generation. HBM4 revenue has already exceeded one billion dollars. The technology is essential for the latest accelerators from Nvidia and Google, where memory bandwidth rather than raw compute increasingly determines inference throughput.

The forward guidance was equally aggressive. Micron projected fiscal fourth-quarter revenue of approximately $50bn, plus or minus one billion, against analyst estimates of roughly $44bn and a year-ago figure of just over $11bn. The company raised its full-year capital expenditure forecast to more than $25bn, up from a previous target of $20bn, to expand production capacity for HBM and advanced DRAM.

Micron’s market capitalisation crossed one trillion dollars on 26 May, making it the latest memory chipmaker to reach that threshold as the AI-driven memory supercycle reshapes valuations across the semiconductor industry. The stock’s roughly 700 percent gain over the past year reflects a market that is pricing memory not as a cyclical commodity but as structural AI infrastructure.

The company said it expects the total addressable market for HBM to grow at a compound annual rate of roughly 40 percent through 2028, rising from approximately $35bn in 2025 to around $100bn. Micron plans to return 100 percent of excess free cash flow to shareholders, a commitment enabled by the cash deposit programme that reduces the capital risk of its expansion.

There are caveats worth noting. Micron remains the smallest of the three HBM suppliers, behind SK Hynix and Samsung, and its share of Nvidia’s HBM4 allocations is the thinnest of the trio. The broader memory market is also shifting, with Chinese manufacturers like CXMT expanding aggressively into consumer DRAM segments that the Big Three have deprioritised in favour of AI chips.

Memory pricing is cyclical by nature, and the current supercycle depends on hyperscaler capital expenditure continuing at its current pace. If AI infrastructure spending slows or HBM supply catches up with demand, the margins that Micron reported this quarter would compress rapidly. The 81 percent gross margin is historically extraordinary for a memory company and reflects shortage economics as much as product superiority.

For now, the numbers speak for themselves. Revenue that quadruples in a year, margins that triple, and a guidance print that exceeds estimates by more than $6bn are not normal results for any company, let alone one that was losing money two years ago. Micron’s earnings confirm that the AI memory shortage is intensifying, not easing, and that the companies making the chips inside AI accelerators are capturing value at a rate the market is still recalibrating to price.

Anthropic has accused Alibaba of waging the largest distillation campaign yet against a US AI company, telling senators and White House officials that operators linked to Alibaba’s Qwen AI lab used nearly 25,000 fraudulent accounts to extract Claude’s capabilities between April and June. The letter, a copy of which was seen by Bloomberg, described nearly 29 million exchanges with Claude targeting software engineering and agentic reasoning, the model’s most commercially valuable skills.

The accusation marks the first time Anthropic has named a major Chinese technology conglomerate as the source of a distillation attack. Previous allegations in February targeted smaller Chinese AI startups, including DeepSeek, MiniMax, and Moonshot AI, which Anthropic said had collectively generated more than 16 million exchanges through about 24,000 fake accounts. The Alibaba campaign alone exceeded the combined volume of all three earlier efforts.

Distillation is the practice of feeding carefully constructed queries to a frontier AI model, collecting its responses, and using those responses to train a cheaper rival system that approximates the original’s capabilities. The White House flagged the technique as a national security concern in April, when OSTP Director Michael Kratsios published a memo committing the government to share intelligence with US AI labs about foreign distillation campaigns. Anthropic said in its letter that the Alibaba campaign took place after the Kratsios memo, in defiance of the administration’s warnings.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Alibaba had no comment on the allegations. An Anthropic spokesperson declined to discuss specifics but emphasised the importance of combating distillation through coordinated action between government and industry.

Alibaba’s American depositary receipts fell more than three percent on the news, dropping below $100 in afternoon trading on Wednesday. The stock decline adds to a difficult period for the company in Washington, where it faces pressure on multiple fronts.

The Pentagon added Alibaba to its Chinese military companies blacklist on 8 June, a designation Anthropic cited in its letter. Alibaba sued the Defense Department this week to win removal from that list, calling the label baseless and arguing it has no military affiliation. The distillation accusation now opens a second front, framing Alibaba not just as a company with alleged military ties but as an active participant in what Anthropic calls the systematic theft of American AI capabilities.

In its letter, Anthropic warned that adversarial distillation lets Chinese labs replicate frontier AI at a fraction of the training cost, and that models built this way often lack safety guardrails. The company urged the Trump administration to clarify antitrust guidelines so US labs can share more information about distillation attempts, reiterated its support for export controls on advanced AI chips, and called for penalties against firms that use the technique.

Lawmakers are moving in parallel. Senators Bill Hagerty and Andy Kim plan to introduce an amendment to must-pass defence legislation that would blacklist or sanction any Chinese firm found to be improperly accessing US AI model output. A related bipartisan bill in the House, backed by Representatives Bill Huizenga and Sydney Kamlager-Dove, is also being considered, though whether either proposal survives to the final version of the defence bill is uncertain.

The timing is sensitive for Anthropic as well. The company, now valued at $965bn after a $65bn Series H round, filed confidentially for an IPO this month and is preparing for a listing that could come as soon as this autumn. US officials have estimated that unauthorised distillation costs Silicon Valley labs billions of dollars, and the threat of cheaper imitation products from China that siphon away customers is a material risk for a company heading to public markets.

Anthropic’s calls for government support may not find a fully receptive audience, given that the company is embroiled in a separate dispute with the Trump administration over export controls imposed on its Fable 5 and Mythos 5 models less than two weeks ago. Commerce Secretary Howard Lutnick signed an order blocking foreign nationals from accessing those models, citing security concerns, and Anthropic disabled them to comply. Even after meetings between the company’s technical staff and White House officials, little progress has been made to restore service.

The result is a company caught between two fronts of its own. Anthropic needs the government to crack down on Chinese labs extracting its technology, but it is simultaneously fighting the same government’s decision to restrict its own products. The letter to senators is an attempt to separate the two issues, arguing that protecting US models from distillation and allowing those models to be deployed commercially are complementary rather than contradictory goals.

Whether Washington agrees will shape both the regulatory environment for US AI companies and the competitive dynamics of the industry’s most consequential rivalry. Anthropic has now named four Chinese labs as distillers of its technology, with the Alibaba accusation by far the largest in scale. If the legislative proposals gain traction, the consequences could extend well beyond Anthropic’s models to the broader question of how the US enforces an intellectual property border around AI systems that exist as software, not hardware, and that can be copied over the internet through nothing more than a well-crafted prompt.

Looking for the most recent Mini Crossword answer? Click here for today’s Mini Crossword hints, as well as our daily answers and hints for The New York Times Wordle, Strands, Connections and Connections: Sports Edition puzzles.

Need some help with today’s Mini Crossword? It’s not terribly tough, though I always hate it when two clues rely on each other, like 4-Across and 7-Across do today. Read on for all the answers. And if you could use some hints and guidance for daily solving, check out our Mini Crossword tips.

If you’re looking for today’s Wordle, Connections, Connections: Sports Edition and Strands answers, you can visit CNET’s NYT puzzle hints page.

Read more: Tips and Tricks for Solving The New York Times Mini Crossword

Let’s get to those Mini Crossword clues and answers.

Mini across clues and answers

1A clue: Texter’s “Wow!”
Answer: OMG

4A clue: With 7-Across, something often marked with a star in elevators
Answer: FIRST

7A clue: See 4-Across
Answer: FLOOR

8A clue: Currency of Ireland and Italy
Answer: EURO

9A clue: Went illegally fast
Answer: SPED

Mini down clues and answers

1D clue: Not working
Answer: OFF

2D clue: A marathon has a little over 26
Answer: MILES

3D clue: Airline boarding section
Answer: GROUP

5D clue: Feeling it the next day
Answer: SORE

6D clue: Walked
Answer: TROD

I’ve been using the Nintendo Switch 2 since its launch week, playing practically every title released for the platform either as part of my work covering games here at TechRadar Gaming or my own personal enjoyment.

I’ve spent hours in everything from big new entries in first-party franchises like Mario Tennis Fever and Mario Kart World to groundbreaking ports such as Cyberpunk 2077 Ultimate Edition. I’m not just playing the big hitters either, and have invested loads of time in getting to grips with underrated gems including Kunitsu-Gami: Path of the Goddess and Raidou Remastered: The Mystery of the Soulless Army.

• View all of Amazon’s current prices and deals on Nintendo Switch 2 games this Prime Day

While many of these games will be discounted over the course of the ongoing Amazon Prime Day deals, every title that I’ve included is well worth your time and attention regardless of its price.

Amazon Prime Day game deals

Amazon Prime Day – the best Nintendo Switch 2 games I’d buy right now

Grand Theft Auto 6 preorders started at midnight your local time after publisher Rockstar Games finally confirmed the new installment’s price. The likely Game of the Year winner for 2026 will cost $80 when it releases on Nov. 19 for PS5 and Xbox Series X|S consoles, according to a statement from Rockstar. 

Along with the standard edition, Rockstar is also offering an Ultimate Edition of the game that comes with more content, including exclusive vehicles and cosmetics, for $100.

Calling GTA 6 a highly anticipated game doesn’t do it justice. It’s been more than a decade since the release of GTA 5, and after multiple delays, the latest entry in the GTA franchise is finally on its way. Will GTA 6 be the greatest game ever created? Who knows, but the excitement has already hit a fever pitch with three months left before launch.

What is the release date for GTA 6?

GTA 6 is currently slated to be released on Nov. 19, 2026. The game was initially scheduled for a 2025 release, but was twice delayed, to a May 2026 release, then to November. 

How much will GTA 6 cost? 

The standard edition for GTA 6 will cost $80. This makes it one of the few games with a price tag above the typical $70. Mario Kart World for the Switch 2 was the first game with a regular price tag of $80 when it launched last year. 

A GTA 6 Ultimate Edition is also available for $100. This version comes with a collection of vehicles, weapons, apparel and customizations. Here’s what comes in the Ultimate Edition: 

• ’67 Vapid Dominator Buggy & Paradise Garage
• ’95 Grotti Cheetah
• Dinka Enduro motorcycle & Crest Kayak
• Exclusive Vapid Ganado Retro Build mods
• Rideout Customs & One-Eyed Willie’s mod shops
• Classic Car Collection missions
• Shitzu Squalo boat
• Hawk & Little Morgan Revolvers
• Personalized weapon variants
• PTT Youngin$ Compound activities
• Exclusive clothing, hairstyles, tattoos, and customization options for Jason and Lucia

Rockstar says the content will unlock for players who own the Ultimate Edition as they play through the single-player campaign.

Is GTA 6 available for preorder? 

GTA 6 preorders started on June 25 at midnight local time for PS5 and Xbox Series X|S consoles. Those who preorder will receive the Vintage Vice City pack that includes: 

• ’55 Vapid Stanier
• Shore Court Garage near Ocean Beach
• Exclusive Vice City-inspired outfits and hairstyles for Jason and Lucia 
• A tropical weapon pattern inspired by Tommy Vercetti’s iconic look

Which platforms will GTA 6 be available for? 

So far, GTA 6 is coming to the PS5 and Xbox Series X and S consoles. GTA 6 will likely come out on PC, but it won’t be at launch. There is currently no word on GTA 6 coming to the Switch 2. 

Will there be a physical edition of GTA 6?

Not really. Rockstar confirmed there will be a physical edition of GTA 6 sold at retailers, but it won’t include a disc. Instead, it will just have a code to download the game. Some gamers have expressed their disappointment with the lack of a physical disc on social media sites like Reddit.

Rockstar did say that pre-loading for GTA 6 will take place starting Nov. 12. 

Where does GTA 6 take place? 

GTA 6’s setting is the state of Leonida, the fictional version of Florida. It’ll include some time in the big city and surrounding areas, including the coasts and swamplands. The star of the game will be the return to Vice City, a fictitious version of Miami. GTA 6 takes place in a modern setting, so don’t expect the ’80s version players first experienced in GTA: Vice City. 

What is GTA 6’s story? 

Jason Duval and Lucia Caminos are two criminals in love. Jason has been working for drug runners, and in the opening, he’s on his way to pick up Lucia from the Leonida Penitentiary. She was serving time for an unknown crime, but it involved protecting her family. The two will work together to improve their lives one crime at a time. 

What else is new in GTA 6? 

The big innovation coming to GTA 6 is the dual protagonists. This system will be similar to the three-protagonist setup from GTA 5, but expect Jason and Lucia to be playable in certain missions. Rockstar includes RPG elements that let the protagonists customize their bodies based on the food they eat and the exercises they do. There will also be a wealth of changes that modernize the gameplay, such as making melee attacks more realistic and improving gun controls. 

Will there be a new GTA Online? 

Rockstar has yet to confirm that there will be a new GTA Online with GTA 6 at launch. It is likely that the online mode will be made available sometime after launch, which is what the studio did with the launch of the original GTA Online, as well as Red Dead Online. 

8BitDo is celebrating the Nintendo 64’s 30th anniversary with new versions of two of its most popular accessories. It is giving the Retro 87 Mechanical Keyboard and Ultimate 2 Wireless Controller a translucent blue makeover inspired by the classic console.

The new “Clear Blue” editions were initially announced in China. However, both products are also heading to the US, where they’re priced at $99.99 and $59.99 respectively.

The Retro 87 Mechanical Keyboard leans heavily into Nintendo 64 nostalgia. Alongside its translucent blue shell, it features yellow arrow keys modelled after the N64 controller’s iconic C-buttons. Meanwhile, the A, B and Start keys borrow the same blue, green and red colour scheme as the original gamepad.

Beyond the retro styling, the keyboard retains the same feature set as the standard model. That includes an aluminium plate, hot-swappable PCB and 8BitDo’s Cloud Gray linear switches. These were developed in partnership with HUANO. It supports Bluetooth, 2.4GHz wireless and wired connectivity. Moreover, it works with Windows and Android, and can be customised through the company’s Ultimate Software V2.

Today only, B&H Photo is selling Samsung’s 32-inch M8 4K monitor for $299.99 via a $400 in-cart coupon.

Beating Amazon’s Prime Day price by $85, B&H Photo has dropped the Samsung M8 display to just $299.99 during its 24-hour Deal Zone event.

Save $400 on Samsung M8 monitor

The $400 discount, which is in the form of an in-cart coupon, delivers the lowest price anywhere on the 32-inch monitor. Equipped with both HDMI and USB-C ports, this monitor, now at a budget-friendly price, pairs well with modern Macs.

Along with the robust discount, B&H is throwing in free 2-day shipping within the contiguous U.S. on the M80F monitor in Warm White, so you can begin using it quickly.

If you’re looking for a budget-friendly MacBook to pair with the monitor, B&H is offering AppleInsider readers an exclusive deal on a closeout M4 13-inch MacBook Air with 512GB of storage, bringing the price down to $899.

You can also browse our roundup of the top Apple Prime Day deals throughout the last days of the sale.