CYBER THREATCAST

Patch WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE deployments now, then remove unused themes, plugins, extensions, and other CMS components and harden writable web directories and server-side processes. ACSC says attackers are globally exploiting vulnerable CMS platforms and plugins to compromise sites and deploy webshells, with Australian small and medium-sized businesses already affected.

Prioritize June 2026 fixes on internet-facing servers, VPNs, and RDP hosts before lower-exposure systems. Recorded Future Insikt Group identified 60 high-impact vulnerabilities for priority remediation, and the report says 57 are actively exploited and 53 have public proof-of-concept exploits; affected technology includes Microsoft products, Check Point gateways, Cisco infrastructure, F5 BIG-IP, Fortinet FortiClient EMS, DD-WRT, and Microsoft Exchange. Inventory exposed assets, patch or mitigate quickly, and hunt for post-exploitation indicators.

Check Linux vendor advisories for CVE-2026-43499, GhostLock, and patch untrusted multi-user systems as soon as fixes are available for your distribution. The flaw is a Linux kernel use-after-free privilege-escalation issue that can let a logged-in user gain root on unpatched systems, and Nebula Security published exploit code it described as 97% reliable while patch availability remained uneven across Linux vendors.

Remove [email protected] from builds and developer machines, revert to a clean release, and rotate any credentials, deployment tokens, environment variables, or source-code secrets that may have been exposed during npm install. Socket reported that the compromised npm release added an undocumented preinstall hook and hidden platform-specific binaries for Windows, macOS, and Linux, creating install-time risk for projects that pulled that version.

Pause or tightly limit lending activity that depends on the affected Bonzo Lend oracle path until Bonzo Finance completes its recovery investigation, and review third-party price-oracle verification wherever SAUCE, USDC, WHBAR, Hedera, or LayerZero integrations are in scope. Bonzo Finance said an unknown attacker drained about $9 million by manipulating a third-party SAUCE price oracle and using minimal collateral to borrow large amounts of USDC and Wrapped HBAR; Bonzo paused Bonzo Lend and its points program while investigating recovery.