CYBER THREATCAST

Patch or isolate internet-facing Oracle E-Business Suite, on-premises Microsoft SharePoint Server, Adobe ColdFusion, and Citrix NetScaler ADC/Gateway systems now. CVE-2026-46817 in Oracle E-Business Suite is reportedly being exploited against roughly 950 exposed instances, SharePoint Server CVE-2026-45659 is in CISA’s KEV catalog, ColdFusion CVE-2026-48282 is under active exploitation with hundreds of exposed instances reported, and NetScaler CVE-2026-8451 is seeing coordinated scanning and exploitation attempts after proof-of-concept details were published. Organizations running these products should treat exposed unpatched servers as potentially compromised and prioritize investigation as well as remediation.

Remove exposed Langflow instances from direct internet reach and remediate CVE-2025-3248 before restoring access. Sysdig described a JadePuffer ransomware intrusion in which attackers exploited CVE-2025-3248 in Langflow for initial access, then an LLM agent automated reconnaissance, credential harvesting, lateral movement, privilege escalation, data theft, and encryption after a human supplied victim selection, infrastructure, and credentials. Teams using AI development environments should review cloud and API credential stores, Nacos, MySQL, and cryptocurrency wallet access for signs of theft or misuse.

Patch unpatched Roundcube webmail instances and hunt for stolen sessions, MFA inputs, webshells, and Go backdoor activity. Proofpoint reported a likely China-linked espionage group targeting U.S. and Canadian universities by phishing Roundcube users, exploiting chained vulnerabilities on unpatched systems, stealing logins, cookies and MFA inputs, triggering deserialization with stolen session data, and deploying persistent PHP webshell and Go backdoor malware. Universities, especially engineering and physics departments, should prioritize Roundcube exposure and credential-reset workflows for affected users.

Find and update unpatched Ruckus wireless routers, then inspect them for LONGLEASH, DOGLEASH, and JARLEASH-related compromise. Cisco Talos reported that China-nexus UAT-7810 is exploiting known vulnerabilities in unpatched Ruckus wireless routers while expanding an Operational Relay Box network used by other threat actors. Organizations with Ruckus gear on ARM, MIPS, or x64 platforms should prioritize exposed or unmanaged devices because compromised routers can become relay infrastructure rather than just local footholds.

Restrict remote access to Rockwell Automation Allen-Bradley PLCs and verify CompactLogix, Micro850, HMI, and SCADA project integrity. A CISA-led advisory warned that nation-state-linked actors are actively targeting internet-exposed Rockwell/Allen-Bradley PLCs with legitimate engineering tools rather than zero-days, and scanning data showed thousands of exposed hosts globally, mostly in the United States. Critical infrastructure operators should review whether PLC project files or HMI/SCADA data were tampered with, because altered control data can mislead operators and create operational or financial disruption.