CYBER THREATCAST

Audit Cisco Catalyst SD-WAN and related Cisco SD-WAN systems immediately for signs of compromise, including unexpected web shells and suspicious bash command execution. State-nexus threat actors have reportedly targeted these systems since early 2026 by chaining authentication-bypass and privilege-escalation issues, with government, enterprise, telecom, and critical infrastructure environments cited as targets. Treat exposed or high-value SD-WAN management planes as priority assets for containment review, credential rotation, and hardening.

Upgrade official Gitea Docker images to 1.26.3 or later and review any internet-facing Gitea instance using reverse proxy authentication. CVE-2026-20896 affects Gitea Docker image v1.26.2 and earlier when reverse proxy authentication is enabled, and attackers are actively exploiting it to impersonate users, including administrators, when login names are known or guessable. Repository operators should assume exposed code, CI/CD configuration, deploy keys, and secrets may be at risk after successful compromise.

Patch Adobe ColdFusion to ColdFusion 2025 update 10 or ColdFusion 2023 update 21 and check whether any exposed server has RDS enabled with authentication disabled. Attackers are exploiting CVE-2026-48282, a path traversal issue affecting ColdFusion 2025.9, 2023.20, and earlier, and exposed RDS-enabled systems with disabled authentication may face remote code execution risk. CISA added the vulnerability to its KEV Catalog based on evidence of active exploitation, so internet-facing ColdFusion servers should move to emergency remediation.

Take internet-facing Langflow deployments offline for review or restrict access while validating exposure to CVE-2025-3248 and rotating secrets reachable from Langflow-connected environments. Researchers reported that JadePuffer used CVE-2025-3248 in Langflow for initial access, then extracted secrets from PostgreSQL, MinIO, and configuration files, established cron-based persistence, pivoted to a production database server, and carried out an automated extortion workflow. Organizations running Langflow should treat compromised instances as potential entry points into databases and storage systems.

Close or tightly restrict exposed Docker, Kubernetes, Redis, etcd, Kubelet, and Ray services, then hunt for stolen cloud tokens, API keys, credentials, and cryptomining activity. The CAI cloud worm is actively scanning exposed cloud and developer services, and researchers report both exploitation attempts and successful compromises. Because the malware kills competing malware and monetizes access through cryptomining while stealing secrets, cloud and developer infrastructure operators should pair exposure reduction with credential revocation and workload inspection.