CYBER THREATCAST

Audit exposed routers now for weak SNMP and Cisco Smart Install exposure, especially in communications, energy, financial services, defense, healthcare, and government environments. U.S. and allied agencies warned that Russia’s FSB Center 16/Berserk Bear is actively targeting vulnerable and poorly configured routers, exploiting weak or default SNMP credentials and community strings, and copying device configurations to attacker-controlled servers via TFTP or FTP. Treat unexpected configuration exports, exposed older SNMP versions, default community strings, and Cisco CVE-2018-0171 Smart Install exposure as immediate investigation triggers.

Patch internet-facing CMS platforms and plugins immediately, then hunt for webshells and unauthorized file creation. Australia’s ACSC warned that attackers are conducting large-scale scanning and exploitation against WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, Joomla JCE, and CMS plugins, and are deploying webshells after compromise. Administrators should remove unused plugins, review web and application logs, isolate compromised hosts, and restore from known-good backups where compromise is confirmed.

Prioritize exposed Palo Alto Networks PAN-OS portals for emergency review, focusing on Captive/User-ID Authentication Portal and GlobalProtect deployments. CVE-2026-0300 affects PAN-OS 10.2, 11.0, 11.1, and 11.2 and could allow unauthenticated remote code execution leading to firewall compromise, traffic interception, credential theft, and lateral movement; Cloud NGFW and Prisma Access are not affected. CVE-2026-0257 is also being exploited against exposed PAN-OS GlobalProtect firewalls and allows unauthenticated attackers to establish unauthorized VPN connections. Review access logs for unauthorized portal or VPN activity and apply vendor remediation as available.

Investigate Oracle PeopleSoft and PeopleTools 8.61 and 8.62 environments for signs of compromise tied to CVE-2026-35273. ShinyHunters/UNC6240 allegedly weaponized the CVSS 9.8 unauthenticated PeopleTools remote code execution flaw to breach more than 100 organizations before an Oracle advisory, with reported post-exploitation activity including MeshCentral for command and control, SSH credential spraying, and data exfiltration. Higher education and other PeopleSoft operators should review access paths, credential activity, outbound tooling, and sensitive student, payroll, immigration, and health data exposure.

Power off affected on-premises Progress ShareFile Storage Zone Controller Windows servers if Progress instructed your organization to do so. Progress Software reported a credible external security threat and said no patch or workaround was available at the time; customers were asked to immediately disable Storage Zone Controllers. Treat these systems as high-risk until Progress provides confirmed remediation, preserve logs and forensic data before rebuilding where possible, and watch for evidence of unauthorized access even though none had been confirmed at the time of reporting.