CYBER THREATCAST

Progress Software customers should immediately shut down on-premises Windows servers hosting ShareFile Storage Zone Controllers, as Progress instructed. The company identified a credible external security threat involving those controllers but had not disclosed a CVE, patch, threat actor, indicators, or evidence of unauthorized access when the notice was issued. ShareFile customers using Storage Zone Controllers should preserve relevant server and access logs, limit any restart to vendor-directed recovery steps, and watch Progress communications for technical guidance before bringing systems back online.

WordPress and Joomla site operators should audit for webshells and remove outdated plugins or components, with immediate attention to the WordPress Breeze caching plugin and CVE-2026-3844. WP-SHELLSTORM used known website vulnerabilities to plant webshell backdoors for resale; researchers validated 25,195 compromises, observed thousands of active webshells, and said CVE-2026-3844 was used against more than 45,000 targets. Treat exposed CMS sites as potentially compromised until file integrity, plugin inventory, and server-side scripts are reviewed.

Gitea administrators should identify self-hosted deployments using the official Gitea Docker image and restrict unauthenticated access while investigating exposure. Attackers are actively exploiting a critical authentication bypass that lets unauthenticated clients impersonate arbitrary users via the X-WEBAUTH-USER header; Sysdig observed exploitation in the wild and Singapore’s Cyber Security Agency warned about active use. Review access logs for suspicious use of that header and prioritize affected Git services because compromise can expose source code and CI/CD secrets.

Citrix NetScaler ADC and NetScaler Gateway operators should treat CVE-2025-5777, known as CitrixBleed 2, as an active intrusion risk and investigate appliances for session hijacking. Threat actors are exploiting the pre-authentication memory-overread to steal session tokens and bypass MFA, and Huntress reported intrusions that ended in DragonForce ransomware deployment. Prioritize exposed NetScaler systems, review active sessions and authentication activity, and escalate any signs of token theft or ransomware staging.

Joomla site owners should update affected CMS extensions, especially JCE, Page Builder CK, and SP Page Builder, and search web root and template directories for injected files such as cox.json and cox.svg. Belgium’s Centre for Cybersecurity warned that Trenggalek Cyber Army is running a worldwide mass defacement campaign against public-facing CMS sites, especially Joomla installations, by exploiting extension file-upload flaws that can lead to remote code execution. Patched versions are available for affected extensions, so exposed public sites should be remediated before they are defaced or used for deeper compromise.