Cisco Firewall Console Bug Is Under Attack By Three Crews

Cisco Talos confirmed this week that CVE-2026-20079, an authentication bypass in Cisco Secure Firewall Management Center, is being exploited by three separate clusters, some tied to ransomware, some to state-sponsored intrusion sets. FMC is the console that pushes policy to the firewalls themselves, so a bypass there does not compromise one box. It compromises whatever the console manages. Cisco's advisory frames this as a vulnerability disclosure with a patch attached. The Talos telemetry frames it as a vulnerability already being run in production by three unrelated operators before most customers finished reading the bulletin.

For a Hong Kong or Singapore bank, FMC sits inside the perimeter control set that HKMA's TM-G-1 and MAS's Technology Risk Management Guidelines both expect to be patched on a defined cycle, not a best-effort one. BIS said this week that routine patching schedules are inadequate against AI-accelerated exploitation and that banks should accept planned downtime for urgent fixes. A management-plane bypass under active three-way exploitation is exactly the scenario that guidance was written for. Any firm running FMC needs to confirm patch status today, not at the next change window, and check whether its own vulnerability management policy has a carve-out for CVSS 9-plus flaws with confirmed in-the-wild use.

The read-across for Check Point customers is not comfort. Check Point patched two 9.8-rated VPN certificate flaws (CVE-2026-16232 among the family) the same week, both unauthenticated RCE paths into firewall and management products. Two vendors, two management-plane compromises, one pattern: the control plane for the firewall estate is now the thing under attack, not the traffic it filters. The fix is not a firewall change. It is confirming FMC and SmartConsole are patched and that management interfaces are not reachable from anywhere they don't need to be.

Taiwan sent a senior official to Europe this week, and no European government canceled the meeting to appease Beijing. That is the entire story before any spokesman in either capital says a word about it. Beijing's isolation campaign runs on a simple mechanism: capitals that host Taiwanese officials get a formal protest, sometimes a downgraded trade talk, sometimes a canceled leader visit. The mechanism only works while every capital calculates the protest costs more than the meeting is worth. This week at least one European government ran that calculation and hosted the visit anyway.

Prediction markets now price an invasion of Taiwan by December 31, 2027 at 11.5% YES, a number that moves on exactly this kind of test. Beijing's Taiwan Affairs Office, run since 2023 under a mandate to punish "separatist" contacts abroad, has spent years building the assumption that European capitals would rather avoid the confrontation than host the visit. A European government breaking that pattern does not end the isolation campaign. It tells every other capital watching that the cost of hosting Taipei is lower than advertised, and the next visit gets easier to schedule.

China Coast Guard vessels fired flares at a Philippine aircraft near Scarborough Shoal this week, days after Beijing's foreign ministry summoned attention to a diplomatic note it accused Manila's defense secretary of leaking, calling the disclosure "grandstanding and lying." The flare incident and the note dispute are not the same event filed twice. One is the operational tempo the Coast Guard sets in disputed waters; the other is the messaging discipline the foreign ministry tries to hold in Manila, Washington and, not incidentally, in Beijing's own domestic press. Those two tempos used to move together. This week they did not.

The foreign ministry's complaint about the leaked note is a discipline problem, or, more precisely, it is what a ministry says when a script it wrote for controlled escalation has been read aloud by the other side before Beijing chose the moment. The Coast Guard does not answer to that script in real time; its flare discipline over Scarborough Shoal answers to the China Coast Guard's own operational calendar, which has run hotter through 2026 regardless of what the foreign ministry's spokesperson is managing that week. Manila's decision to make the note public took the sequencing choice away from Beijing's Ministry of Foreign Affairs, and a ministry that loses sequencing compensates with volume, not resolution. The Coast Guard's flare crews do not read the transcript before their next patrol.

Two guys broke into an MTR depot this week, tagged up some trains, and then did what every genius criminal does after a big night: went straight to the airport. Police were waiting. They got arrested there, hours after the break-in, before either of them made it through security. So the plan was "vandalise a train depot, then hop on a flight," and the gap between those two steps was apparently not long enough to even get a bag checked in.

Look, breaking into an MTR depot is not nothing. Those places have fences, cameras, staff, the works, and these two still got in and out with paint. That part is almost impressive. But the getaway is where it falls apart. Sham Shui Po uncles plan a noodle delivery better than this. You want to disappear after a stunt like that, you don't leave a trail straight to a departure gate with your name on a boarding pass. The trains get cleaned, the fence gets patched, and these two get to explain the whole thing to a magistrate instead of whoever they were flying to see.