Critical Lantronix flaw actively exploited; Cisco SD-WAN zero-day; 27M credentials recovered

**High-level briefing:** Active exploitation of critical infrastructure and supply‑chain risks: CISA warns of Lantronix EDS5000 exploitation with a June 26 remediation deadline, Mandiant details Cisco Catalyst SD‑WAN zero‑day abuse to create rogue root accounts, Amadey and StealC botnets were disrupted with 27 million credentials recovered, researchers disclosed the Cordyceps CI/CD pattern impacting 300+ GitHub repositories, and a malicious Edge extension (Edgecution) uses Native Messaging to deploy a Python backdoor; immediate patching, CI/CD workflow audits, extension controls, credential resets, and IOC monitoring are recommended.