CYBER THREATCAST

Patch on-premises Microsoft SharePoint Server for CVE-2026-45659 immediately, using Microsoft’s late-May out-of-band update, and treat any unpatched authenticated exposure as a compromise candidate. CISA has added the deserialization RCE flaw to KEV after confirming active exploitation, and observed activity includes Velociraptor, Cloudflare Tunnels, Zoho Assist, custom malware, security-tool disabling, lateral movement, privilege escalation, and data-exfiltration risk. Organizations running affected SharePoint versions should review Site Member-level access, hunt for remote-access tooling and disabled security controls, and prioritize containment where suspicious post-exploitation activity appears.

Deploy Google’s Android security update to managed Android 14, Android 15, Android 16, and Android 16 QPR2 devices without delay, and flag high-risk users for accelerated patch compliance. Google fixed 124 Android vulnerabilities, including CVE-2025-48595, an Android kernel privilege-escalation flaw with evidence of limited targeted exploitation before patching. CISA has also added the vulnerability to KEV, so mobile device teams should verify update status through MDM and treat lagging devices as higher-risk endpoints.

Lock down exposed Langflow and Nacos deployments, then review cloud credentials and configuration stores for signs of JADEPUFFER activity. Researchers describe an autonomous ransomware operation that exploited CVE-2025-3248 in Langflow, stole cloud credentials, pivoted through exposed services, abused CVE-2021-29441 to create rogue Nacos admin access, and encrypted 1,342 Nacos service configuration items before deleting originals and leaving a Bitcoin extortion note. Organizations running exposed, unpatched Langflow instances should prioritize patching, credential review, and recovery testing for Nacos configuration data.

Remove paperclip2, vps-maintenance, and vps-maintenance-paperclip-adapter from developer environments and CI systems, then inspect package manifests, lockfiles, and process history for postinstall execution. OX Research reported that these npm packages abuse package.json postinstall scripts to launch a reverse shell to 185.112.147.174:7007, with paperclip2 containing no JavaScript files and the related packages using the same payload. Development teams should hunt for suspicious processes using port 7007 and assume affected workstations may have exposed secrets accessible from the build environment.

Audit legacy REDCap environments and email content compliance rules at research, medical, academic, and military health organizations. Google Threat Intelligence Group reported that Chinese-nexus UNC6508 compromised REDCap environments at North American research institutions, deployed InfiniteRed malware and web shells, stole credentials and emails, and abused email content compliance rules for stealthy exfiltration. Teams operating REDCap should review web server artifacts, credential exposure, and unusual compliance-rule changes, especially in environments supporting research centers, clinical providers, regulators, advocacy groups, and military health institutions.