CYBER THREATCAST

Patch on-premises Microsoft SharePoint Server for CVE-2026-45659 immediately and treat any exposed, unpatched server as a potential compromise candidate. CISA added the unsafe deserialization remote-code-execution flaw to its Known Exploited Vulnerabilities catalog after evidence of in-the-wild exploitation and set a short remediation deadline; Microsoft patched the issue in May 2026. Organizations running on-premises SharePoint should prioritize remediation over routine maintenance windows and review affected servers for signs of unauthorized code execution.

Upgrade self-hosted Gitea to 1.26.3 and rotate credentials that may have been exposed through affected instances. The critical flaw, tied to default Docker reverse-proxy trust, is reportedly being targeted in the wild and allows attackers to spoof authentication headers and impersonate users on exposed self-hosted Git servers. Administrators running Gitea 1.26.2 or earlier should patch first, then review access paths and account activity for signs of impersonation.

Apply Adobe’s emergency ColdFusion fixes for CVE-2026-48282 without delay, especially on internet-facing ColdFusion 2023.20, 2025.9, and earlier deployments. Attackers are actively exploiting the maximum-severity unauthenticated remote-code-execution flaw shortly after disclosure, and Adobe urged immediate patching. Teams responsible for ColdFusion applications should also examine affected hosts for post-exploitation activity because the vulnerability does not require authentication.

Audit JavaScript builds for @mastra packages and remove any poisoned versions introduced through npm dependency updates. North Korea-linked Sapphire Sleet, also known as BlueNoroff or APT38, allegedly used a stolen npm maintainer account to republish more than 140 @mastra packages with a malicious dependency that targeted cryptocurrency wallets and contacted command-and-control infrastructure. Mastra users and CI pipeline operators should inspect dependency histories, rebuild from trusted package versions, and rotate secrets exposed to affected build environments.

Hunt SysAid environments for software-update abuse and DLL side-loading associated with Cavern Manticore activity. The Iran-linked, MOIS-associated group is using a previously undocumented modular Cavern/Cav3rn C2 framework against Israeli organizations, including IT providers and government-sector entities. The framework supports reconnaissance, file and database operations, Active Directory discovery, network scanning, tunneling, lateral movement, and exfiltration, so affected organizations should examine SysAid update activity and follow-on internal movement, not just the initial host.