CYBER THREATCAST

Push the June 1 or June 5, 2026 Android patch level to managed Android fleets now, prioritizing Android 14, Android 15, Android 16 QPR2, and devices with MediaTek or Qualcomm components. Google’s June update fixes 124 vulnerabilities, and CVE-2025-48595 in the Android framework is reportedly under limited targeted exploitation, making delayed mobile patch cycles a direct exposure for executives, field staff, and other high-risk users.

Upgrade WatchGuard Firebox appliances running Mobile User VPN with IKEv2 to Fireware OS 2026.2.1 or 12.12.1 where fixes are available, and identify T15/T35 on 12.5.x and Fireware OS 11.x deployments that remain without a fix. CVE-2026-13368 is a CVSS 9.2 pre-authentication remote code execution flaw in the Firebox IKEv2 VPN daemon’s LDAP authentication path, so internet-facing VPN services should be treated as high-risk until patched or otherwise removed from exposure.

Hunt for JadePuffer activity in environments running Langflow, Alibaba Nacos, or MySQL, starting with evidence of CVE-2025-3248 exploitation in Langflow and CVE-2021-29441 abuse in Nacos. Researchers report the ransomware intrusion began through Langflow and later used Nacos to create rogue administrator accounts and encrypt configuration data, so teams should review Nacos admin account changes, configuration integrity, and exposed Langflow services as part of incident triage.

Patch CVE-2025-9491 and review Windows scheduled tasks in government and electric power environments, especially in Russia, Brazil, and Kazakhstan. Kaspersky identified Armored Likho, a previously unknown APT group, using spear-phishing emails, malicious archives, modular malware, and BusySnake Stealer against government agencies and electric power operators; BusySnake Stealer can collect browser cookies, passwords, clipboard data, screenshots, cryptocurrency wallet files, and session data.

Audit developer workstations, package manifests, and CI/CD secrets for malicious npm, PyPI, Packagist, Go module, Chrome extension, and VS Code extension exposure, then rotate cloud, SSH, GitHub, Kubernetes, npm, and CI/CD credentials from affected systems. North Korean Lazarus-linked packages mimicked Rollup tooling to steal developer secrets, Contagious Interview-linked actors published 108 malicious packages and extensions targeting developers and cryptocurrency workers, and the FBI warned TeamPCP poisoned developer tools and updates to steal AWS, GCP, Azure, SSH, Kubernetes, GitHub, and CI/CD credentials.