CYBER THREATCAST

Patch Microsoft SharePoint Server Subscription Edition, 2019, and 2016 immediately for CVE-2026-58644 and related emergency fixes, then review exposed on-premises servers for signs of remote code execution or malware deployment. CISA has added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog, and the reported unauthenticated OS command injection path can lead to full system compromise for hospitals, federal agencies, and any organization still running on-premises SharePoint.

Lock down SonicWall SMA 1000 Series appliances and prioritize remediation for CVE-2026-15409 and CVE-2026-15410, especially where the appliances are internet-facing. Inc Ransomware is reportedly exploiting both zero-days in real intrusions, CISA added both to KEV, and a public proof of concept exists for CVE-2026-15409; the flaws can lead to remote code execution and root-level command execution.

Upgrade WordPress Core 6.9.0–6.9.4 and 7.0.0–7.0.1 to WordPress 6.9.5 or 7.0.2 without waiting for exploit code. The wp2shell flaw is described as a critical unauthenticated remote code execution issue affecting default installs; no public PoC or confirmed in-the-wild exploitation was reported at publication time, but exploit details being withheld should not be treated as a safe window for exposed sites.

Add simulation-versus-execution checks to DeFi routing, wallet, and DEX aggregator workflows before routing users through pools with abnormal quote behavior. Enso described live toxic pool examples on Ethereum and Polygon where pools behave differently in off-chain simulation than in real on-chain execution, using checks such as tx.gasprice, tx.origin, and block.coinbase to worsen swaps, fail transactions, and cause gas losses for DeFi users.

Audit any environment that installed the compromised @bitwarden/cli NPM package, rotate exposed NPM, GitHub, AWS, GCP, and Azure secrets, enable 2FA, check for campaign marker strings, and downgrade to a safe version as advised. OX Security reports the Shai-Hulud campaign backdoored @bitwarden/cli with a self-propagating worm that stole developer and cloud credentials and uploaded exfiltrated data to public GitHub repositories.