CYBER THREATCAST

Restrict access to PAN-OS management interfaces and apply the available fixes immediately. Attackers are actively exploiting CVE-2026-109618 and CVE-2026-109619 against exposed interfaces, chaining PHP remote code execution with Linux privilege escalation to obtain root access.

Install fixed GitLab Community Edition and Enterprise Edition releases, then investigate affected systems for compromise. Attackers are exploiting CVE-2026-97229 for unauthenticated remote code execution, nearly 2,800 internet-facing instances were reportedly exposed, and an attempted exploit against Alpine Linux caused worker crashes and downloaded a container image.

Apply Ivanti’s additional Connect Secure patches, prioritize internet-exposed appliances, and assess affected systems for compromise. UTA0576 chained CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 to execute root commands without authentication, extract credentials, and query Active Directory for sensitive account, LAPS, and BitLocker data.

Deploy vendor-approved Linux kernel fixes for CVE-2026-46300 and investigate affected systems for compromise. The actively exploited skb_try_coalesce() flaw can permit modification of protected page-cache data and may support privilege escalation when chained with other vulnerabilities.

Remove public exposure from Docker API endpoints or secure them against unauthorized access, then inspect hosts for unknown Swarm membership, Alpine containers, dynamic-linker hijacking, hidden processes, and cryptominers. Attackers are using exposed or improperly secured APIs to seize Docker hosts, probe Kubernetes kubelet APIs and SSH servers, disable defenses, and deploy mining software.