CYBER THREATCAST

Patch exposed Joomla sites running iCagenda or Balbooa Forms immediately: move iCagenda to 4.0.8 or 3.9.15 and Balbooa Forms to 2.4.1, then look for uploaded PHP files, web shells, and recent scanning or execution attempts. CISA added both CVSS 10.0 extension flaws to its Known Exploited Vulnerabilities catalog after active exploitation against exposed Joomla sites, and the weaknesses can allow malicious PHP upload leading to remote code execution.

Apply Microsoft’s July 2026 security updates first to internet-exposed SharePoint Server and Active Directory Federation Services systems, and treat exposed SharePoint servers as potentially compromised until reviewed. JPCERT/CC and CISA report active exploitation of SharePoint Server vulnerabilities, including CVE-2026-56164, which can be abused remotely without authentication; CVE-2026-56155 in AD FS was also exploited in the wild and can enable local privilege escalation.

Audit network edge devices for weak or default SNMP community strings, exposed Cisco Smart Install, and vulnerable Cisco IOS deployments, then apply the published mitigations and check agency indicators of compromise. Russian FSB Center 16 activity has targeted poorly configured routers, using SNMP scanning and spoofed SNMP Set-Requests to identify weak community strings and exfiltrate device configurations via TFTP; affected sectors include communications, defense, energy, financial services, government, and healthcare.

Inspect developer workstations, CI/CD environments, and lockfiles for the compromised AsyncAPI and related npm package versions, especially @asyncapi/generator, @asyncapi/generator-components, @asyncapi/generator-helpers, @asyncapi/specs, and @vapi-ai/server-sdk. StepSecurity reports Miasma compromised 57 packages across more than 286 malicious versions, used Phantom Gyp binding.gyp execution during npm install to steal credentials, and exfiltrated data to GitHub dead-drop repositories; bad versions were unpublished, but existing installs and lockfiles may remain affected.

Review Microsoft Entra ID tenants for OAuth device-code abuse, rogue device enrollment, and unusual ROPC authentication attempts, then investigate affected accounts for token theft and SaaS data access. Threat actors are using OAuth device-code phishing, including Jalisco, to capture access and refresh tokens after victims authenticate on legitimate Microsoft pages, and Proofpoint observed a campaign targeting more than one million accounts across nearly 4,000 tenants with over 700,000 spoofed client IDs to fragment logging and evade detection.