CYBER THREATCAST

Patch Microsoft SharePoint Server 2016, 2019, and Subscription Edition on-premises systems for CVE-2026-50522 immediately, then treat exposed servers as potentially compromised. The critical 9.8 unauthenticated RCE is under active exploitation after public exploit code appeared, and reports say attackers are stealing SharePoint/IIS machine keys to impersonate users and preserve access even after patching. Operators should investigate for machine-key theft and persistence, not stop at applying the update.

Upgrade WordPress Core sites affected by CVE-2026-63030 and CVE-2026-60137 to fixed releases and hunt for post-exploitation artifacts. Public exploit code is driving mass scanning and compromise attempts against the wp2shell vulnerability suite, with honeypots already seeing activity. Site owners should look for malicious plugin uploads, webshells, rogue admin users, user enumeration, harvested admin usernames or emails, local file inclusion attempts, and credential-theft activity.

Update SonicWall SMA1000 6210, 7210, and 8200v appliances to patched versions 12.4.3-03453 or 12.5.0-02835 and begin forensic review. BSI warns the appliances are being actively exploited through CVE-2026-15409 and CVE-2026-15410; CVE-2026-15409 is a CVSS 10.0 SSRF flaw in the Appliance WorkPlace Interface. Remote-access appliances are high-value entry points, so organizations should combine immediate mitigation with evidence collection and compromise assessment.

Take exposed Langflow servers offline or restrict access while remediating CVE-2025-3248, then inspect AI infrastructure for ENCFORGE ransomware activity. JADEPUFFER is exploiting Langflow to gain unauthenticated Python code execution through the validate endpoint’s exec_globals parameter. Reported payloads target model checkpoints, vector indexes, datasets, embeddings, ML pipeline files, FAISS indexes, Hugging Face safetensors, and other AI assets, encrypting files and appending a .locked extension.

Patch PAN-OS portal and gateway components for CVE-2026-0257 and review perimeter logs for Qilin ransomware intrusion activity. Qilin affiliates are exploiting the now-patched flaw for initial access, then using remote administration, tunneling, and file-transfer tools for lateral movement and exfiltration. Incidents have included both encryption-only attacks and double-extortion operations, so affected organizations should pair patching with investigation for AnyDesk, LogMeIn, Ngrok, PsExec, and related attacker tooling noted in the reports.