CYBER THREATCAST

update iCagenda installations affected in 4.x through 4.0.7 and legacy 3.x through 3.9.14, and move Balbooa Forms up to 2.4.0 to 2.4.1. CISA added CVE-2026-48939 and CVE-2026-56291 to KEV after reported active exploitation, and Australia’s ACSC says attackers are exploiting known CMS and plugin flaws to deploy webshells. Joomla and other CMS operators should also review web logs, check for webshells, isolate suspected hosts, and restore compromised systems from known-good backups.

Harden and monitor exposed Palo Alto Networks PAN-OS GlobalProtect deployments immediately for CVE-2026-0257 exploitation. Fortinet says attackers are exploiting the authentication bypass in the wild against exposed Palo Alto firewalls, and unauthenticated attackers can establish unauthorized VPN connections. Security teams using PAN-OS GlobalProtect should prioritize remediation and add detection coverage where available, including Fortinet’s NDR Cloud rules, DPI signatures, and Suricata signature.

Patch Adobe ColdFusion systems affected by CVE-2026-48282 without waiting for routine maintenance windows. The flaw is reported as actively exploited for arbitrary code execution, carries a CVSS 10.0 severity score, and CISA issued a federal agency patch deadline. Organizations running ColdFusion should treat internet-facing instances as a priority exposure and verify that fixes are applied across production and staging environments.

Remediate NetScaler CVE-2025-5777 exposure and invalidate potentially compromised sessions, including sessions protected by MFA. Active exploitation is reported against NetScaler sessions, compromised sessions include MFA-protected accounts, and DragonForce ransomware was deployed after exploitation. NetScaler operators should assume session theft may bypass normal MFA assurance and should prioritize session review and recovery before attackers move to ransomware deployment.

Lock down routers and network-device management interfaces in critical infrastructure environments, especially Cisco devices and systems using SNMP. UK NCSC and allied agencies warn that Russian FSB Centre 16 actors are scanning for default or weak SNMP credentials, stealing router configurations via TFTP, and targeting Cisco device, Smart Install, and web-portal weaknesses. Operators should move to SNMPv3, disable legacy SNMP versions, use strong unique passwords, and restrict management access.