CYBER THREATCAST

Rotate all credentials on internet-facing Fortinet FortiGate and FortiOS SSL-VPN systems immediately, disable exposed VPN access where possible until reviewed, and hunt for follow-on compromise in Active Directory and affected edge devices. CISA says attackers are actively using a leaked dataset covering roughly 74,000 Fortinet devices, including plaintext usernames and passwords, and reporting ties the campaign to billions of login attempts and full compromises at multiple organizations.

Update the Gravity SMTP WordPress plugin to version 2.1.5 immediately and treat exposed sites as potentially credential-compromised by rotating any API keys or OAuth tokens that may have been stored or revealed in system reports. Threat actors are actively exploiting CVE-2026-4020, an unauthenticated REST API information disclosure flaw, and Wordfence says blocked attempts have already topped 17 million. Any WordPress site running Gravity SMTP is in scope, especially if the plugin exposed plugins, themes, server details, or authentication material.

Upgrade WinRAR on Windows endpoints to version 7.13 or later and warn users that spear-phishing emails may carry malicious RAR archives targeting CVE-2025-8088. Reporting says organized threat actors are exploiting this path traversal flaw in the wild, with archive attachments used as the delivery mechanism. Organizations that still allow older WinRAR versions on user workstations, jump hosts, or shared admin systems should prioritize those systems first.

Review every custom ICS-20 and CW20-ICS20 token contract modification before redeployment, and suspend trust in third-party bridge integrations that removed source-channel or escrow-balance checks until code and message-validation logic are reverified. Technical reporting says unsafe changes in a Secret Network Axelar integration let an attacker forge packets through a fake Cosmos chain and drain about $4.67 million in escrowed assets. Teams operating Cosmos-linked bridges or derived token contracts should assume bespoke logic around IBC packet receive paths is a high-risk area.

Pause or tightly constrain exposure to bridged DOT on Ethereum until message validation and admin-control paths are independently reviewed, and verify that proof handling cannot be replayed or separated from the originating request. Reporting says a forged-message flaw gave an attacker admin control of the Polkadot token contract on Ethereum and enabled minting of 1 billion bridged DOT tokens. The impact was limited to bridged DOT on Ethereum rather than native Polkadot, so exchanges, custodians, and DeFi operators handling the bridged asset should focus controls there first.