CYBER THREATCAST

Patch Cisco Catalyst SD-WAN Manager immediately and treat exposed or recently administered systems as potentially compromised, not just vulnerable. Mandiant reported in-the-wild intrusion at a communications service provider in which attackers escalated from a compromised admin account to root, used a malicious CSV upload to add a root user named troot, and performed anti-forensic cleanup. Organizations running Cisco Catalyst SD-WAN Manager should urgently review administrator accounts and SD-WAN audit trails for suspicious CSV uploads, unauthorized root-level changes, and signs of cleanup activity, because the observed tradecraft went beyond initial access and into durable server compromise.

Update Check Point Remote Access VPN for CVE-2026-50751 right away and investigate for post-compromise access, not just attempted exploitation. The flaw is a critical authentication bypass, CISA took emergency action, and reporting says Qilin affiliates have exploited it since early May against dozens of organizations worldwide. Any organization exposing Check Point VPN should assume attackers may have had unauthenticated entry before patching, prioritize log review around the affected window, and validate that patching did not leave attacker persistence in place.

Upgrade UniFi OS to Ubiquiti’s fixed versions immediately, especially on internet-exposed deployments. CISA added CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 to the KEV catalog, and reporting says attackers are actively chaining these flaws from authentication bypass into command injection for possible unauthenticated remote code execution. Organizations running UniFi OS or UniFi OS Server should prioritize external-facing systems first and verify that no exposed management instance remains on vulnerable builds.

Hunt immediately for exposed secrets in Laravel Livewire environments and rotate any .env-derived credentials that could have been accessible from vulnerable applications. Reporting says attackers are exploiting a critical Laravel Livewire RCE flaw at scale, stealing .env secrets, database dumps, API keys, Stripe keys, and AWS credentials, with researchers finding thousands of stolen files, more than 1,850 database dumps, 188 live Stripe keys, and 381 AWS credentials. Teams running Laravel Livewire should assume credential exposure can outlast the initial exploit and prioritize cloud, payment, and database credential rotation alongside application remediation.

Reset credentials tied to FortiGate VPN and review FortiOS SSL-VPN appliances for signs of sniffer deployment or credential harvesting. Researchers say the active FortiBleed campaign has targeted Fortinet FortiGate devices since at least February 2026, using mass scanning, credential stuffing, brute force, and custom tooling; compromised devices are then used to sniff traffic and harvest additional credentials. Organizations running FortiGate VPN should prioritize password resets, MFA enforcement, FortiOS patching, and log review because a stolen password may be only the start of a wider credential-loss cycle.