CYBER THREATCAST

Patch Zimbra Collaboration Suite immediately to 10.0.18 or 10.1.13, or apply the advised workarounds if you cannot patch at once. LAUNDRY BEAR, a Russian state-backed espionage group, is exploiting CVE-2025-66376 through a zero-click email-viewing attack in the Zimbra Classic UI against Western government and commercial organizations. Treat exposed Zimbra mailboxes as potentially compromised: review for email theft, persistence, password theft, session-token abuse, and MFA bypass because agencies say attackers can use the flaw for all of those outcomes.

Install Check Point hotfixes for CVE-2026-16232 on Security Management and Multi-Domain Security Management systems, especially R81.10 and R81.20 deployments with exposed management interfaces. Attackers are actively exploiting the authentication bypass to obtain an application login token and gain unauthenticated SmartConsole administrative access. Restrict Internet exposure for management environments and review administrative access activity because CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirmed exploitation.

Remove Siemens, Schneider Electric, and Rockwell Automation PLC/ICS environments from direct Internet exposure and verify controller logic, HMI displays, and SCADA data feeds. U.S. agencies warn Iranian-linked actors are actively accessing Internet-connected PLCs in water, energy, local government, and other critical infrastructure environments, using legitimate engineering tools and foreign-hosted infrastructure. Operators of Allen-Bradley, CompactLogix, BMX P34, EcoStruxure Control Expert, and related environments should prioritize segmentation and inspection for unauthorized project-logic changes.

Audit GitHub repositories, GitHub Actions workflows, and Packagist package dependencies for unauthorized workflow changes, then rotate exposed secrets if cPanel or WHM servers may have been touched. Attackers compromised repositories for ten Packagist packages tied to a legitimate maintainer and planted malicious GitHub Actions workflows that scanned for and exploited CVE-2026-41940 in cPanel and WHM servers. The payload exfiltrated credentials, cloud keys, SSH material, and database access, so affected DevOps and hosting teams should treat both CI/CD secrets and server credentials as in scope.

Patch affected PAN-OS and Prisma Access systems tied to Palo Alto Networks GlobalProtect and investigate recent VPN-originated activity for credential theft, domain access, exfiltration, and ransomware staging. Threat actors are exploiting CVE-2026-0257, an authentication bypass in GlobalProtect, for initial access. Reported intrusions progressed from access to credential theft, lateral movement, data exfiltration, and Qilin ransomware deployment, making delayed remediation a ransomware-risk decision rather than a routine VPN patch.