CYBER THREATCAST

Patch Splunk Enterprise immediately if you run versions 10.0.0 through 10.0.6 or 10.2.0 through 10.2.3, and treat exposed instances as potentially compromised until you verify otherwise. CVE-2026-20253 is under active exploitation and is listed in CISA KEV; the flaw lets unauthenticated attackers create or truncate arbitrary files through PostgreSQL Sidecar Service endpoints and may be chained to remote code execution as the Splunk user. Prioritize internet-facing deployments, restrict access to affected services where patching will lag, and investigate for unexpected file creation or truncation tied to Splunk hosts.

Upgrade Gravity SMTP to version 2.1.5 now and rotate any third-party API keys or tokens that may have been exposed through the plugin. Wordfence says attackers are actively exploiting CVE-2026-4020, an unauthenticated information-disclosure flaw affecting about 100,000 WordPress sites, to leak server details, plugin and theme data, and API credentials; it also reports blocking more than 17 million exploit attempts. Any organization using the plugin for mail delivery should assume reconnaissance and secret exposure are plausible until the site is patched and dependent credentials are reviewed.

Audit your build pipelines and developer environments for compromised @mastra packages, then rotate exposed cloud credentials, LLM API keys, and cryptocurrency wallets if those packages were installed. Microsoft attributes the supply-chain intrusion to Sapphire Sleet and says a compromised maintainer account was used to publish malicious updates to more than 140 @mastra npm packages. Any team using Mastra AI components should review dependency locks and package histories immediately, because the reported impact includes credential and wallet exposure rather than a routine package bug.

Review Salesforce integrations that rely on Salesloft Drift OAuth tokens, revoke and reissue tokens where appropriate, and hunt for bulk exports of support cases, contacts, accounts, and opportunities. Reporting says UNC6395’s Icarus campaign abused compromised OAuth tokens tied to the Salesloft Drift Salesforce integration after attackers pushed unauthorized code and collected tokens, leading to data theft from more than 700 organizations. Organizations using Salesforce integrations should treat third-party OAuth connections as a live exposure point, especially if they depend on shared integration infrastructure.

Force password resets for reused credentials, invalidate active web sessions where feasible, and accelerate infostealer-response playbooks if your users or admins may be affected. Researchers reported a publicly accessible Elasticsearch cluster holding roughly 24 billion stolen credential records, plaintext passwords, session cookies, and infostealer logs aggregated from at least 36 sources, creating immediate credential-stuffing risk. Organizations with weak password hygiene or long-lived sessions should assume attackers can operationalize this data quickly and prioritize accounts with elevated privileges or exposed remote access.