CYBER THREATCAST

Patch SonicWall SonicOS for CVE-2024-40766 immediately and audit any exposed management and SSLVPN interfaces for compromise. SANS ISC says Akira and Fog ransomware operators have exploited this improper access control flaw since 2024, and many Gen 5, Gen 6, and Gen 7 firewalls remain unpatched despite an available fix. Because the issue affects firewall management and SSLVPN exposure—and reporting also notes downstream risk from the separate MySonicWall breach—SonicWall customers should verify patch status, reduce unnecessary internet exposure, and review affected devices for unauthorized access.

Upgrade the Gravity SMTP WordPress plugin to version 2.1.5 or later now, and rotate any API keys or tokens that may have been exposed. Attackers are actively exploiting CVE-2026-4020 through an unauthenticated REST API endpoint in versions before 2.1.5 to harvest sensitive connector data from vulnerable WordPress sites. Defiant reported exploitation since early May and more than 17 million blocked attempts, so site owners using Gravity SMTP should treat exposed connector secrets as potentially compromised until proven otherwise.

Lock down payment-approval workflows that rely on WhatsApp or executive identity alone, and require out-of-band verification for urgent transfer requests. India’s I4C warned that attackers are hijacking WhatsApp Web sessions, sending malware in ZIP files, and using compromised executive accounts to pressure finance staff into fraudulent payments. Reporting also says some variants alter contact lists so the attacker’s number appears under the CEO’s name and install ManageEngine Endpoint Central for remote access, making this a direct risk for finance teams, executives, and Windows users handling company payments.

Rotate credentials on FortiGate and Fortinet VPN environments, terminate active sessions, enforce MFA, and restrict public management access immediately. The FortiBleed operation is actively harvesting credentials from FortiGate devices by abusing FortiOS diagnostic commands alongside SSH brute force and credential stuffing, including extraction of secrets from RADIUS, NTLM, Kerberos, and LDAP traffic. Agencies have already advised these steps, and the campaign has been tied to large-scale impact claims and at least one confirmed defense-contractor breach, so internet-facing Fortinet deployments should be treated as at heightened risk now.

Update Dify to version 1.14.2 where available and review tenant exposure, tracing-provider settings, and stored chat or document data for unauthorized access. Researchers disclosed four DifyTap vulnerabilities in Dify that could expose cross-tenant AI chats, files, and internal data, including some unauthenticated attack paths and one flaw that could redirect tracing data to an attacker-controlled provider for persistent exfiltration. Organizations running Dify should prioritize the fixed issues in 1.14.2 and assess whether sensitive AI application data may have been exposed across tenants.