CYBER THREATCAST

Patch or remove internet exposure for Langflow 1.7.3 and earlier immediately: CISA says CVE-2026-0770 is being actively exploited for unauthenticated remote code execution, including code execution as root through Langflow’s validate endpoint. Teams running exposed Langflow instances should assume scanning or exploitation is plausible, review systems for command checks, malware downloads, and credential-access attempts, and prioritize this ahead of routine maintenance because the flaw is already in CISA’s KEV catalog.

Upgrade affected WordPress Core sites now and monitor for compromise: CISA added CVE-2026-63030 and CVE-2026-60137 to the KEV catalog after confirmed exploitation, and affected releases include WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress administrators should move to fixed releases quickly, give internet-facing and high-traffic sites priority, and review logs and site integrity for signs of exploitation because CISA warned the chained core flaws are already being used against unpatched sites.

Patch and harden Palo Alto Networks GlobalProtect VPN and PAN-OS systems without delay: Qilin ransomware affiliates are actively exploiting a critical GlobalProtect VPN/PAN-OS vulnerability for initial access to corporate networks, and Arctic Wolf investigated multiple June incidents where attackers used the flaw before ransomware deployment. Organizations with exposed GlobalProtect services should verify May patches are applied, reduce exposure where possible, and hunt for pre-ransomware intrusion activity because exploitation continues against unpatched systems and CISA added the issue to KEV after ransomware use was confirmed.

Patch on-premises Microsoft SharePoint Server and rotate machine keys and exposed credentials: attackers are exploiting CVE-2026-50522 for unauthenticated remote code execution, and stolen machine keys can enable forged authentication tokens and persistence even after patching. Administrators running SharePoint Server 2016, 2019, Subscription Edition, or other internet-exposed on-premises deployments should treat patching alone as insufficient, hunt for compromise, and rotate keys and credentials as part of recovery, especially because public PowerShell proof-of-concept code is available.

Remove internet exposure from OT management paths and inspect PLC, HMI, and SCADA environments for tampering: CISA, FBI, and EPA warned that Iran-affiliated actors are targeting internet-facing OT environments, including Schneider Electric, Siemens, Rockwell Automation, and Allen-Bradley PLCs. Critical infrastructure operators should check project files, PLC programs, and HMI/SCADA displays for unauthorized changes, tighten remote access, and prioritize monitoring for operational disruption because federal agencies say the activity has already caused disruption and financial loss across several U.S. critical infrastructure sectors.