CYBER THREATCAST

Patch Cisco Catalyst SD-WAN Manager for CVE-2026-20245 immediately and treat exposed vManage, vBond, and vSmart systems as potentially compromised if they handled tenant CSV uploads before disclosure. Cisco says attackers exploited the command-injection flaw as a zero-day for at least two months, used a crafted tenant CSV to gain root, created rogue accounts, changed admin credentials, erased traces with anti-forensics scripts, and exfiltrated SD-WAN fabric configuration data. Review admin account changes, rotate credentials tied to the management plane, and investigate for unauthorized data access because the reported intrusion reached a service provider management plane at root level.

Apply PTC’s fixes for CVE-2026-12569 on Windchill, Windchill/PDMlink, and FlexPLM now, then hunt for JSP web shells using PTC and CISA indicators before returning systems to normal operations. CISA added the flaw to the KEV catalog because attackers are actively exploiting it, and PTC says threat actors are deploying persistent JSP web shells. Industrial and manufacturing organizations should prioritize internet-facing instances and align remediation with the June 28 federal deadline if they support federal environments.

Warn AWS users now that real-time adversary-in-the-middle phishing is targeting AWS console logins, and tighten monitoring for suspicious console access and MFA abuse. Researchers say the campaign uses fake AWS login pages to capture credentials and MFA codes in real time, targets active AWS sessions, and has already gone after about fifty victims, mostly U.S.-based software engineers, using legitimate email services and Cloudflare-backed phishing domains to blend in. Security teams should push immediate user reporting for unexpected AWS login prompts and review recent console access for signs of session theft.

Audit recent npm and Go dependency changes tied to LeoPlatform, RStreams, and the Verana Go module, and rotate developer and CI/CD secrets if any poisoned packages were installed or built in your environment. Researchers say the latest Miasma wave compromised multiple npm packages and a Verana Go module, published more than 20 malicious npm package versions in a short window, and used install-time execution plus GitHub Actions workflow abuse to steal developer and pipeline secrets. Prioritize systems that build from public registries or run GitHub Actions because the campaign targets software supply chains directly.

Remove internet exposure from PLCs, lock down remote access, and verify IT/OT segmentation in water and wastewater environments immediately, especially where Unitronics Vision Series PLCs are in use. CISA, EPA, FBI, and NSA-backed reporting says Iranian- and Russian-linked actors are actively breaching utilities by abusing internet-facing PLCs, weak credentials, poor segmentation, and insecure remote access. The warning cites real operational impact, including a municipal water tank overflow, as well as attacks affecting a Texas water facility and a dam.