CYBER THREATCAST

Patch or isolate exposed N-able N-central, IBM Langflow OSS, and Apache Tomcat deployments immediately, prioritizing N-central because attackers are actively exploiting CVE-2026-18556 and CVE-2026-18577 to bypass authentication and gain full administrative console access. MSPs and N-able customers should assume compromised consoles can be used to take over accounts and pivot into managed endpoints through Take Control. Tomcat operators should also review affected 11.0.20, 10.1.53, and 9.0.116 deployments, especially clustered environments using Apache Tribes EncryptInterceptor.

Harden SonicWall SMA 1000 appliances now by applying available fixes, checking for signs of compromise, and treating suspicious access as a ransomware precursor. INC Ransomware is exploiting SMA 1000 flaws for initial access, and reported incidents include attempted data theft and encryption. SonicWall customers in the United States, Australia, Colombia, Switzerland, and the UAE should also prepare communications teams for phone and email pressure tactics used during extortion.

Remove internet exposure from PLCs used in water, wastewater, energy, and other industrial sites, then verify segmentation and access controls before reconnecting operational networks. FBI, EPA, CISA, and other U.S. agencies warned that Iran-linked actors are targeting exposed Rockwell Automation Allen-Bradley MicroLogix, Unitronics, Schneider Electric, and other programmable logic controllers, with incidents causing loss of pressure, flooding, and loss of visibility or control. Operators should inspect PLC configuration, IP addresses, passwords, ladder logic, SCADA files, and persistence mechanisms after any suspected access.

Update Coldcard firmware and stop using any recovery phrase generated on affected firmware; move holdings to wallets created from new, trusted seeds after remediation. Galaxy Research reported that a Coldcard randomness flaw made recovery phrases predictable, enabling theft of about 1,596 bitcoin from more than 7,300 wallets, and Coinkite confirmed affected firmware and released a fix. Coldcard owners should treat already compromised seeds as unsafe even after installing the update.

Audit npm dependencies and CI/CD environments for exposure to ChainDrop and Shai-Hulud-style poisoned packages, especially projects using Keyv, Cacheable, flat-cache, file-entry-cache, and related packages from compromised maintainer accounts. StepSecurity reported ChainDrop infected 444 npm packages and 2,212 versions in under four hours, while Aikido reported a compromised Keyv maintainer GitHub account publishing credential-stealing malware through GitHub Actions. Rotate GitHub tokens, npm tokens, AWS credentials, Azure credentials, and other API secrets that were present on developer machines or CI runners that installed affected packages.