CISA and the UK NCSC published a joint malware analysis report on April 24 detailing FIRESTARTER, a custom backdoor discovered on a Cisco Firepower device running ASA software at an unnamed US federal civilian agency. The malware was deployed by threat actor UAT-4356, which Cisco Talos assesses as a China-nexus APT group previously connected to the ArcaneDoor campaign that targeted Cisco ASA devices via zero-days in 2024. The initial access occurred in September 2025 through exploitation of two Cisco ASA vulnerabilities, CVE-2025-20333 and CVE-2025-20362, which were patched by Cisco that same month. However, devices compromised before the patches were applied retained the implant. FIRESTARTER was not removed by the firmware updates. Cisco's standard shutdown, reboot, and reload CLI commands also do not clear the implant. Only a hard power cycle, physically unplugging the device, removes it from memory. FIRESTARTER achieves persistence by modifying the CSP_MOUNT_LIST boot configuration file, ensuring it relaunches on every startup. It stores a copy of itself in the device's log directory and restores it automatically if terminated. The implant embeds into LINA, the core Cisco ASA network processing engine, by installing a hook that intercepts XML handler functions. When it receives a specially crafted WebVPN authentication request containing a hidden trigger sequence, it executes attacker-supplied shellcode directly in memory. In the federal incident, attackers first deployed a separate implant called Line Viper to harvest device credentials and VPN configuration data, then installed FIRESTARTER as the persistence layer. After the agency patched its systems in September, FIRESTARTER kept the door open. The attackers used it to redeploy Line Viper in March 2026, nearly six months after initial compromise. CISA discovered the activity through continuous monitoring and initiated forensic engagement. CISA has published two YARA rules for detecting FIRESTARTER on disk images or core dumps, and has issued updated guidance requiring federal agencies to assume potential compromise and perform hard power cycles on affected device models by April 30.

Sysdig published research this week documenting active exploitation of CVE-2026-33626, a server-side request forgery vulnerability in LMDeploy, an open-source toolkit from Alibaba's ModelScope team widely used to compress, deploy, and serve large language models at scale. The vulnerability exists in the vision-language module's load_image() function, which fetches arbitrary URLs without validating whether the destination is an internal or private IP address. An attacker can supply a malicious URL as an image input and the server will make the request on their behalf, giving them access to anything reachable from the model server's network position. Sysdig's honeypot detected the first exploitation attempt 12 hours and 31 minutes after the vulnerability was published on GitHub on April 22. The attacker did not simply confirm the bug. Over a single eight-minute session, they used the SSRF as a generic network scanning primitive to probe the AWS Instance Metadata Service to attempt credential theft, enumerate Redis and MySQL database ports, reach a secondary HTTP administrative interface, and exfiltrate data to an out-of-band DNS endpoint. The attacker rotated between different vision language models during the session to avoid detection patterns. All versions of LMDeploy with vision language support at 0.12.0 and prior are affected. A patch is available in version 0.12.1.

CISA added two widely deployed enterprise tools to the KEV catalog this week, each with confirmed active exploitation. CVE-2023-27351 is an improper authentication vulnerability in PaperCut NG and MF, the print management software used across education, healthcare, and enterprise environments. The flaw allows an attacker to bypass authentication on affected installations through the SecurityRequestFilter class. Exploitation of this vulnerability was linked to the Lace Tempest threat group in April 2023, which used it to deliver Cl0p and LockBit ransomware. CVE-2024-27199 is a relative path traversal vulnerability in JetBrains TeamCity that allows an attacker with no administrative credentials to perform limited administrative actions through a crafted request. TeamCity is a CI/CD platform widely used by development teams to automate build, test, and deployment pipelines. A separate TeamCity flaw, CVE-2024-27198, was added to KEV in March 2024. It is not yet confirmed whether the two flaws are being exploited together by the same actor. Federal remediation deadline for both is May 4, 2026.