CYBER THREATCAST

Upgrade Langflow to 1.9.1 or later immediately, then inventory any exposed instances and review activity against the /api/v1/responses endpoint. CISA says CVE-2026-55255 is being actively exploited in Langflow versions before 1.9.1, and authenticated attackers can execute another user’s flow by supplying the victim’s flow ID. Qualys customers can use QID 5014302 to detect affected deployments.

Patch and inspect public WordPress and Joomla sites now, especially Breeze caching plugin deployments affected by CVE-2026-3844 and Joomla extensions JCE, SP Page Builder, and Page Builder CK. ACSC warned that attackers are exploiting CMS and plugin flaws to plant webshells, while researchers tied WP-SHELLSTORM to 25,195 validated compromises and thousands of active webshells. Search web roots and template directories for unexpected files, including cox.json and cox.svg, and treat unexplained file-upload, RCE, SSRF, or deserialization exposure as a likely compromise path.

Update Django applications using GeoDjango with a PostGIS backend to Django 6.0.2, 5.2.11, or 4.2.28, and prioritize systems that use raster field lookups. CVE-2026-1207 is a SQL injection flaw in Django’s GIS module and is reportedly being exploited in the wild against targeted Django instances, so teams should also review database access logs and application telemetry around affected lookup paths.

Audit Microsoft 365 tenants for suspicious device-code authentication, new passkey registrations, abnormal SSO cookie persistence, and unexpected Edge extensions. Forg365 operators are abusing Microsoft device-code and AiTM flows to hijack sessions, O-UNC-066 is using voice calls and fake Entra passkey enrollment to register attacker-controlled passkeys, and Payouts King-linked access brokers are impersonating IT staff in Teams to push malicious Edge extensions for Microsoft 365 and Outlook credential theft.

Force password resets and monitor credential abuse for accounts tied to KDDI’s shared email platform and affected Japanese ISP customers. KDDI reported that attackers exploited an unnamed third-party email software zero-day, maintained access for about a month, and exposed about 12.2 million email addresses and 7.6 million passwords; no CVE or vendor name was public at the time, so providers using comparable shared email software should also press vendors for exposure guidance and review authentication logs.