Oracle legacy server breach prompts CISA advisory on credential reuse. SonicWall SMA flaw actively exploited, CISA mandates patching. Agent Tesla returns with fileless multi-stage delivery. TA427 (Kimsuky) and TA450 (MuddyWater) adopt ClickFix for state-sponsored phishing.