CYBER THREATCAST

Patch or isolate Fortinet FortiSandbox systems affected by CVE-2026-39808 and CVE-2026-25089 immediately, and treat any exposed Fortinet security stack as a trust-chain risk until verified. CISA warned that the critical FortiSandbox command-injection flaws are being actively exploited and directed federal civilian agencies to remediate by July 19, 2026; compromise could let attackers forge malicious-file verdicts and weaken downstream Fortinet products, with links to FortiBleed credential harvesting and ransomware activity.

Prioritize Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition patching, then hunt for web shells, IIS machine-key theft, persistence, and lateral movement. Resecurity reports attackers are actively chaining July 2026 SharePoint Server flaws, including authentication bypass, input validation, and unsafe deserialization bugs, to achieve remote code execution and potential domain compromise; Microsoft and CISA have placed the issues in an urgent patching and threat-hunting category.

Confirm WordPress sites have received the security fixes for CVE-2026-63030 and CVE-2026-60137, especially installations running WordPress 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1. Public exploits are available for the wp2shell chain, which combines the two WordPress Core issues to achieve unauthenticated remote code execution; WordPress released fixes and forced automatic security updates, but site owners should verify update status rather than assume coverage.

Manually update 7-Zip installations to 26.02 and prioritize endpoints that routinely handle untrusted archives. 7-Zip has no automatic updater, and version 26.02 fixes a remote code execution flaw in XZ decompression handling where crafted XZ-compressed data in a malicious archive can trigger a heap-based buffer overflow; exploitation requires user interaction and no active exploitation has been reported, so fleet hygiene now can prevent later abuse.

Audit RubyGems dependencies and maintainer accounts for exposure to the SleeperGem campaign, with specific attention to git_credential_manager packages and dormant accounts. Aikido reported that attackers hijacked dormant RubyGems maintainer accounts and published packages that downloaded and executed payloads on Windows and Unix-like systems, with later versions executing when the library was required; Ruby teams should review dependency provenance before builds and reduce risk from abandoned or lightly maintained packages.