CYBER THREATCAST

Patch or mitigate Cisco Unified Communications Manager for CVE-2026-20230 immediately, and verify whether any exposed or internet-reachable deployments remain unremediated. CISA has added the flaw to the Known Exploited Vulnerabilities catalog after observing active exploitation and gave federal agencies a June 28 deadline, making this a near-term risk for any organization running affected Cisco Unified Communications Manager systems. If you also run affected PTC FlexPLM or Windchill versions, treat CVE-2026-12569 as an urgent remediation item as well.

Push Google’s June 2026 Android security update to managed devices now, prioritizing Android 14, 15, 16, and Android 16 QPR2 fleets. The update fixes 124 vulnerabilities, including CVE-2025-48595, a critical Android Framework privilege-escalation flaw that requires no user interaction and is already being exploited in limited targeted attacks. Organizations with enterprise Android deployments should fast-track patch compliance and focus first on higher-risk users whose devices hold sensitive corporate data or administrative access.

Review recent npm package installs in developer and CI/CD environments for unexpected binding.gyp and node-gyp execution, and treat impacted build hosts as potentially exposed until you confirm no tainted packages were installed. Wiz reported an active supply-chain attack in which compromised maintainer accounts published malicious npm versions that execute code during installation through binding.gyp, a path that can bypass controls focused only on preinstall and postinstall scripts. Any team consuming npm packages in automated pipelines or developer workstations is in scope.

Update IPS protections and install policy updates for affected Check Point Security Gateway deployments, then confirm internet-facing protected servers are not exposing arbitrary files. Check Point says CPAI-2026-8037 is a critical directory traversal flaw that may let unauthenticated remote attackers access or disclose arbitrary files on vulnerable servers, and the vendor specifically instructs administrators on R75, R77, R80, and R81 environments to apply IPS and policy changes. Use IPS telemetry to look for exploitation attempts while remediation is underway.

Harden Microsoft 365 monitoring around OAuth token abuse and device-code sign-ins, and brief users that MFA alone will not stop Kali365-style phishing. The FBI says Kali365 abuses Microsoft’s device-code login flow to capture legitimate OAuth tokens, bypass MFA without stealing passwords, and gain persistent access to Outlook, OneDrive, Teams, and related Microsoft 365 services. Organizations with heavy Microsoft 365 use should prioritize token-centric detections and rapid response for suspicious cloud-session activity, not just password reset workflows.