CYBER THREATCAST

Cisco Unified Communications Manager operators should immediately find internet-exposed WebDialer services, remediate CVE-2026-20230, and hunt for JSP webshells and automated access from Tor exit nodes. Rescana reports the CUCM flaw was weaponized within 24 hours of disclosure and PoC release, and CISA lists it as actively exploited; government agencies, hospitals, education environments, and large enterprises face the highest risk where WebDialer is reachable.

Oracle customers should review exposed PeopleSoft and E-Business Suite Oracle Payments systems now, prioritizing PeopleSoft CVE-2026-35273 and E-Business Suite CVE-2026-46817 on versions 12.2.3 through 12.2.15. CVE-2026-35273 allowed unauthenticated remote code execution and was exploited against Nissan, while CVE-2026-46817 enables unauthenticated HTTP attackers to take over susceptible Oracle Payments instances; teams should also look for MeshCentral agents, lateral movement, zstd-based exfiltration, and ransom notes where PeopleSoft endpoints were exposed between May 27 and June 9, 2026.

SimpleHelp RMM administrators should rapidly remediate CVE-2026-48558 and examine affected deployments for pre-remediation compromise, especially authenticated technician sessions obtained through vulnerable OIDC configurations. Attackers are abusing the authentication bypass to deploy TaskWeaver and Djinn Stealer, with reported theft targeting cloud, developer, and AI-tool credentials; organizations using SimpleHelp should treat technician-session compromise as a high-impact access path into enterprise environments.

Fortinet FortiGate operators should remove management interfaces from the internet, force PBKDF2 re-authentication, enforce MFA, upgrade FortiOS, rotate administrator and SSL VPN credentials, and check whether their domain, IP, or CIDR appears in the FortiBleed dataset. Picus reports working credentials were exposed for about 75,000 internet-facing FortiGate firewalls across 194 countries, and the issue stems from stolen configuration files, password reuse, and offline cracking of legacy SHA-256 hashes rather than a single CVE fix.

Software teams using npm and GitHub Actions should audit recent dependency installs and workflow activity for Miasma indicators, with special attention to malicious binding.gyp execution during npm installs and suspicious GitHub-based persistence or C2. Miasma operators reportedly compromised more than 57 npm packages, targeted GitHub Actions users, harvested credentials from AWS, Azure, GCP, 1Password, and HashiCorp Vault, and caused 73 Microsoft GitHub repositories to be disabled on June 5, 2026; exposed build, cloud, and secret-management credentials should be rotated where compromise is suspected.