CISA says attackers are already using flaws in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder. Patches exist, so check whether you run them.
A US government agency says hackers are already using two software flaws in real attacks, and fixes exist for both. The Cybersecurity and Infrastructure Security Agency (CISA) added flaws in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its exploited list on Tuesday.
CISA keeps a public list called the Known Exploited Vulnerabilities catalog. A flaw goes on it when the agency has evidence that attackers are using it in the wild. That is a higher bar than a flaw that could merely be abused. Federal civilian agencies must apply the patches by November 24, 2026.
Organizations that run either product are the ones at risk. If your business uses neither, you can relax on these two. Many small businesses do not know exactly what software they run, so your IT team or provider is the right person to ask. The steps in the alert box above cover what to do.
Details are thin. Nobody has said how the flaws are being used in attacks, and no named hacking group has been tied to them. Cisco's own advisory does not mention the flaw being used maliciously.
Late last month, Cisco also said two other flaws were being exploited, one in Catalyst SD-WAN and one in Secure Firewall ASA and FTD software. Those are separate problems from the two named here.
If your business runs Cisco BroadWorks or Openwave Messaging Webtop Media Transcoder, ask your IT provider to install the patches soon.
Breach Secure Now has launched a connector that lets people ask ChatGPT, Claude or Microsoft Copilot about their security training data, and it is available now.
Read more: Security training data can now be asked about in ChatGPT or ClaudeRiskified, which sells fraud-spotting software to online stores, reports earnings, and investors want to see how AI is changing the field.
Read more: Riskified reports earnings as online fraud fighting turns to AIFingerprint launched Fraud Score, which learns from a business's own confirmed fraud cases and, in one customer test, caught nearly 50% more fraud.
Read more: Fingerprint's new fraud tool learns from each business's own cases
