CYBER THREATCAST

Patch Check Point Security Management deployments immediately, prioritizing internet-exposed management interfaces on R81.10, R81.20, and R82, and verify remediation on Management Server, Multi-Domain Management, Multi-Domain Security Management, Multi-Domain Log Server, and firewall management components. CVE-2026-16232 is being exploited in the wild and can enable administrator access to firewall management; CISA added it to KEV and requires rapid federal remediation. Check Point customers should treat suspicious administrator activity on affected management systems as potentially hostile until reviewed.

Identify WordPress Core 6.8.x, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1 sites and hunt for wp2shell activity using Elastic’s published IOCs and behavioral detections. The wp2shell chain enables pre-authenticated remote code execution through the WordPress REST batch endpoint, and public proof-of-concept tools plus scanning activity are already present. WordPress operators should prioritize externally reachable sites and review host telemetry for the footprints Elastic observed in customer environments.

Patch Microsoft SharePoint Server for CVE-2026-50522 and rotate SharePoint machine keys and credentials after updating. The flaw is a critical CVSS 9.8 deserialization remote code execution vulnerability, and reports say exploitation began after public proof-of-concept release. Admins should assume stolen machine keys may support long-term access and should review SharePoint environments for signs of post-exploitation persistence rather than treating patching alone as cleanup.

Remove or remediate Langflow 1.7.3 and earlier where exposed, and prioritize any Linux-hosted instances because CVE-2026-0770 can allow unauthenticated access to unsafe code execution logic and remote code execution as root. CISA added the vulnerability to KEV after active exploitation reports, so teams running Langflow should verify version exposure, review access paths, and investigate affected systems for unauthorized execution.

Upgrade Windmill to version 1.603.3 or later and check exposed instances for unauthorized file reads through the get_log_file endpoint. Attackers are exploiting CVE-2026-29059 in Windmill before 1.603.3 to perform unauthenticated path traversal and read arbitrary server files; VulnCheck reported exploitation attempts, and about 170 exposed vulnerable systems were identified across 24 countries. Operators should treat exposed vulnerable servers as candidates for secret and configuration review.