CYBER THREATCAST

Patch Internet-exposed on-premises Microsoft SharePoint Server systems immediately, then reduce external exposure, enable and review logging, monitor for post-exploitation activity, and rotate relevant keys. CISA says attackers are actively exploiting CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 on Internet-facing SharePoint Server deployments, with reported activity including IIS machine-key theft, persistence, deserialization attacks, malware deployment, and in some cases possible Warlock ransomware deployment.

Apply SonicWall SMA1000 hotfixes for CVE-2026-15409 and CVE-2026-15410 and hunt for the vendor-published indicators of compromise on SMA1000 appliances. Attackers are chaining the critical SSRF issue in the Appliance Work Place interface and the high-severity code-injection issue in the Appliance Management Console; Rapid7 observed exploitation beginning June 22 and disrupted activity with possible exfiltration and encryption objectives. Enterprises using SMA1000 remote-access appliances should treat exposed systems as high-priority incident-response targets, not routine patch candidates.

Remediate Internet-exposed Ivanti Sentry systems for CVE-2026-10520 now and investigate any instance that may have been exposed while vulnerable. The flaw is actively exploited, is listed in CISA’s Known Exploited Vulnerabilities catalog, and allows unauthenticated OS command execution as root; public proof-of-concept code and backdoored instances have also been reported. Ivanti Sentry operators should also account for related risk from CVE-2026-10523, which enables arbitrary admin account creation, and verify administrative users and integrations after patching.

Audit use of affected AsyncAPI npm packages, rebuild developer workstations that installed them, and rotate npm tokens, source-control access, cloud credentials, CI/CD secrets, SSH keys, signing keys, and browser sessions. Compromised @asyncapi packages distributed hidden JavaScript that downloaded an encrypted second-stage Miasma botnet payload from IPFS, and the reported guidance specifically calls for broad credential and environment recovery. Teams using AsyncAPI packages or CI/CD workflows should also review GitHub Actions exposure, because a vulnerable pull_request_target workflow may have exposed repository secrets to attacker-controlled pull request code.

Replace outdated internet-facing routers, disable Cisco Smart Install where present, move SNMP to SNMPv3, and eliminate default or weak SNMP credentials. UK and allied cyber agencies warned that Russian state-backed hackers linked to Centre 16/FSB are scanning and targeting poorly configured routers worldwide, including older Cisco devices and router web portals, to reach critical infrastructure networks. Energy, government, defense, communications, and financial-services operators should prioritize edge-router configuration review because the activity focuses on exposed management and weak operational hygiene rather than a single new product flaw.