CYBER THREATCAST

Patch Cisco Unified Communications Manager WebDialer and PTC Windchill/FlexPLM immediately, and pull any exposed CUCM WebDialer services off the internet until fixes are verified. CISA added CVE-2026-20230 and CVE-2026-12569 to the KEV list because attackers are already exploiting them in the wild, and reporting says the CUCM WebDialer flaw was weaponized within 24 hours of disclosure and PoC release. This is especially pressing for hospitals, government agencies, education environments, and large enterprises running these widely deployed platforms.

Update SimpleHelp RMM for CVE-2026-48558 now, review internet-exposed servers for vulnerable OIDC configurations, and investigate for pre-patch compromise. Attackers are actively exploiting this authentication bypass to access exposed SimpleHelp servers and deploy TaskWeaver and Djinn Stealer, and reporting cites roughly 1,000 exposed vulnerable servers. Organizations using SimpleHelp, especially those managing developer endpoints or remote administration at scale, should treat any unpatched exposed instance as potentially accessed already.

Prioritize emergency review and remediation of internet-facing Oracle PeopleSoft and Oracle E-Business Suite deployments, with incident response checks focused on data access and exfiltration. Reporting says attackers exploited Oracle PeopleSoft zero-day CVE-2026-35273 against NAIC and activity has been linked to ShinyHunters, while CVE-2026-46817 in Oracle E-Business Suite Oracle Payments File Transmission is also under active exploitation, with Defused seeing live attacks and Shadowserver reporting nearly 200 exposed instances. Organizations running either platform should assume elevated risk to employee, payroll, and other sensitive enterprise data.

Turn on registration lock for Signal and other messaging accounts in scope, and brief high-risk staff not to share verification codes, PINs, or recovery keys under any circumstances. SSU and FBI said Russian intelligence has run a long-term campaign against officials, military personnel, politicians, activists, journalists, and other users in Ukraine, Europe, and the U.S., using SMS social engineering and QR-code device linking to steal credentials and maintain persistent access. Organizations with exposed executives, diplomats, security teams, or field personnel should treat messaging-account hardening as an immediate counter-espionage control.

Audit recent npm and GitHub Actions usage for the Miasma campaign, block affected packages from build pipelines, and rotate credentials stored or reachable from developer and CI environments. The campaign reportedly compromised more than 57 npm packages and abused GitHub Actions, using install-time code execution through a malicious binding.gyp technique to steal secrets from AWS, Azure, GCP, HashiCorp Vault, 1Password, and other developer tooling. Any organization building Node.js software or running shared CI workers should assume downstream exposure if those packages entered its dependency tree.