CYBER THREATCAST

Remove internet exposure from PLCs now, then verify Rockwell Automation, Schneider Electric, Siemens, HMI, and SCADA configurations for unauthorized changes. Iranian-affiliated APT actors are actively targeting exposed industrial services and vendor programming tools across U.S. critical infrastructure, including water and wastewater, energy, and local government, and have altered PLC, HMI, and SCADA behavior. Operators should restrict direct PLC access and treat unexpected logic, configuration, or service changes as potential compromise.

Patch SonicWall SMA 1000 appliances for CVE-2026-15409 and CVE-2026-15410 within CISA’s 72-hour KEV window and investigate appliances for compromise dating back at least 22 days before fixes became available. Attackers chained the two zero-days against SMA 1000 devices, and INC ransomware adoption claims make exposed business, government, and managed security provider environments high-risk targets.

Enable SafeMode on Alibaba Fastjson 1.x immediately or migrate affected applications to Fastjson 2.x while Alibaba has no patch available. CVE-2026-16723 is being actively exploited as an unauthenticated RCE in Fastjson 1.x, including common Spring Boot deployments, through crafted JSON containing a malicious @type field. Finance, healthcare, computing, and retail organizations—especially U.S. targets noted in observed attacks—should prioritize internet-facing Java services and default configurations.

Apply Oracle’s emergency and broader PeopleSoft fixes for CVE-2026-35273 and review exposed HTTP-reachable PeopleSoft systems for data theft, enumeration, and extortion activity. ShinyHunters exploited the critical 9.8 unauthenticated RCE against exposed systems, affecting more than 100 organizations, with universities especially impacted. Organizations should not assume absence of ransomware means low impact; the observed activity focused on theft and extortion.

Patch Zimbra Collaboration Suite for CVE-2025-66376 and perform credential review for users exposed during the exploitation window. Void Blizzard, a Russian state-supported espionage group, exploited the stored XSS zero-day in Zimbra Collaboration Suite, and multiple vendors observed ongoing targeting of vulnerable deployments. Because stolen credentials may remain useful after patching, affected organizations should pair remediation with account review and IOC-based investigation.