CYBER THREATCAST

Upgrade Citrix NetScaler ADC and NetScaler Gateway appliances to fixed versions immediately, especially systems configured as SAML identity providers. CVE-2026-8451 is being exploited in the wild within 24 hours of patch release, and unauthenticated malformed requests can trigger a memory overread that may leak protected process memory. Treat exposed NetScaler appliances as high-priority internet-edge assets and review them for exploit attempts following disclosure.

Prioritize Cisco Secure Firewall Management Center and FMC Software remediation for CVE-2026-20131 and hunt for Interlock ransomware activity in affected environments. SOCRadar reports the flaw was exploited as a zero-day before disclosure, with insecure deserialization enabling arbitrary Java code execution and root access. Check for JavaScript and Java RATs, fileless webshell behavior, HAProxy use, PowerShell reconnaissance, and the published malicious domains, hashes, and IP addresses.

Remove unnecessary internet exposure for Langflow instances and remediate CVE-2025-3248 before attackers can reach adjacent databases or configuration stores. Attackers exploited a public Langflow server, used an LLM to hunt secrets and adapt payloads, pivoted into MySQL and Nacos through CVE-2021-29441 and JWT/database abuse, and encrypted 1,342 Nacos configuration items for extortion. Operators of Langflow, MySQL, Nacos, Postgres, and related database services should review exposed services and secrets access paths.

Audit developer and CI/CD environments for TeamPCP exposure, then rotate cloud credentials, SSH keys, Kubernetes secrets, and package-publishing tokens that could have been available to affected tools. The FBI warned that TeamPCP poisoned trusted developer and security tools, including activity across npm and PyPI, and modified tools harvested AWS, Azure, GCP, CI/CD, and Kubernetes secrets. Organizations using affected tools should review build pipelines and dependency changes, because at least one Vect ransomware deployment used TeamPCP-sourced credentials.

Review authoritative name server configuration and domain delegation controls for domains your organization owns or manages. SOCRadar reports the Sitting Ducks campaign has hijacked more than 35,000 domains by abusing DNS weaknesses and poor authoritative name server configurations without accessing victim registrar accounts. Hijacked domains are being used for phishing, malware delivery, and data theft, so domain owners, DNS providers, and brand-protection teams should verify delegations and monitor for unauthorized DNS changes.