CYBER THREATCAST

Patch Microsoft SharePoint Server against CVE-2026-45659 immediately and treat exposed servers as potentially compromised until reviewed. CISA added the critical unsafe-deserialization RCE to KEV and ordered federal remediation by July 4, 2026, while exploitation is already linked to financially motivated and ransomware activity including Storm-2603. Hunt for post-exploitation signs involving Velociraptor, Cloudflare Tunnels, Zoho Assist, SSH via Visual Studio Code, custom malware, and attempts to disable security tools.

Remove internet-exposed Langflow systems from direct access and remediate CVE-2025-3248 before restoring service. JADEPUFFER reportedly used the unauthenticated Langflow RCE for initial access, stole API keys and cloud credentials, pivoted into exposed infrastructure, accessed MinIO storage with default credentials, abused CVE-2021-29441 in Alibaba Nacos to create rogue admin accounts, and encrypted 1,342 Nacos configuration items. Rotate credentials from affected environments and review Nacos, MinIO, MySQL, and cloud access paths for unauthorized changes.

Audit developer workstations, CI/CD pipelines, GitHub repositories, npm, Packagist, Go module dependencies, and Chrome extensions for exposure to the North Korean PolinRider campaign. Rescana reports at least 108 malicious packages and browser extensions tied to Lazarus Group and APT37 activity, with compromised maintainer accounts, fake polyfill/Rollup-related tooling, force-pushed obfuscated loaders, and anti-dated commits. Developers and cryptocurrency workers should verify package provenance, review recent repository history, and rotate credentials where maintainer accounts or build systems may have been touched.

Deploy Google’s June 2026 Android security update quickly, especially for managed fleets, executives, journalists, and other targeted users. The update fixes 124 Android vulnerabilities, including CVE-2025-48595 in the Android framework, which reportedly allows privilege escalation without user interaction and is being exploited in limited targeted attacks. Organizations should verify patch levels on Android 14, Android 15, and Android 16 QPR2 devices and prioritize devices using affected MediaTek and Qualcomm components where applicable.

Government agencies and electric power operators in Russia, Kazakhstan, and Brazil should prioritize hunting for Armored Likho spear-phishing and BusySnake Stealer activity. Kaspersky attributes the active campaign to Armored Likho and says malicious archives deliver malware that harvests passwords, session cookies, OTP codes, and Telegram data. Patch CVE-2025-9491 where present, review scheduled tasks for persistence, and tighten handling of archive attachments in targeted mailboxes used by operational and administrative staff.