CYBER THREATCAST

Patch exposed Joomla sites running iCagenda or Balbooa Forms immediately, upgrading iCagenda to 4.0.8 or 3.9.15 and Balbooa Forms to 2.4.1, then hunt for malicious PHP uploads and web shells. CISA added the flaws to its KEV catalog after active exploitation involving automated scanning, web shell deployment, and remote code execution risk against publicly exposed Joomla servers.

Audit npm lockfiles, build logs, and developer workstations for compromised Miasma-related package versions, especially affected AsyncAPI packages such as @asyncapi/generator 3.3.1, and rotate npm, GitHub, repository, and CI/CD secrets that may have been exposed. StepSecurity reported that the self-spreading Miasma variant compromised 57 packages across more than 286 malicious versions, executed during install through Phantom Gyp, and exfiltrated credentials to GitHub dead-drop repositories; unpublished packages may still persist in existing installs and lockfiles.

Disable or tightly restrict SNMP on internet-facing routers, replace weak or default community strings, remove obsolete Cisco configurations, and retire or isolate end-of-life network edge devices. US and allied agencies warned that FSB Center 16-linked Russian actors are scanning exposed routers and abusing weak SNMP settings to issue Set-Requests, copy router configurations via TFTP, and steal sensitive information from critical infrastructure sectors including communications, energy, healthcare, financial services, government, and defense.

Patch and investigate Oracle PeopleSoft Environment Management Hub systems for CVE-2026-35273 exposure, prioritizing internet-reachable instances and environments serving education or nonprofit operations. Moody Bible Institute reported personal data exposure affecting more than 2.3 million donors, students, and alumni, ShinyHunters claimed responsibility, and the attack was tied to an unauthenticated RCE flaw reportedly used across more than 300 PeopleSoft instances at over 100 organizations.

Deploy Microsoft’s July 2026 security updates on an emergency schedule, prioritizing AD FS, SharePoint, Microsoft Copilot, BitLocker, Exchange, Office, .NET, and Azure-facing systems. Microsoft fixed at least 570 flaws, including three zero-days, two actively exploited issues in AD FS and SharePoint, multiple high-risk SharePoint remote code execution bugs, a publicly disclosed BitLocker bypass, and a 9.6-rated Copilot remote code execution vulnerability.