CYBER THREATCAST

Update WordPress to 6.9.5 or 7.0.2 immediately and verify that forced automatic security updates actually landed on every site. Public exploits and reported active exploitation target the wp2shell RCE chain in WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1; unauthenticated attackers can compromise sites, steal administrator password hashes, install malicious plugins, and execute shell commands.

Patch or isolate Langflow deployments exposed to untrusted networks and investigate connected MySQL, Nacos, MinIO, and Postgres environments for credential theft and lateral movement. Sysdig reported that JadePuffer used CVE-2025-3248, an unauthenticated Langflow RCE, for access before pivoting through MySQL and Nacos, stealing credentials, escalating privileges, and encrypting 1,342 Nacos configuration records.

Deploy Google Chrome 150.0.7871.128/.129 on Windows, Mac, and Linux without waiting for the next maintenance window. Google fixed seven vulnerabilities in this release, including three critical use-after-free flaws in Chrome components; Google said the bugs were found internally and did not warn of in-the-wild exploitation, but browser criticals warrant fast enterprise rollout.

Audit Docker and Jenkins instances used with AI model tooling such as Ollama and ComfyUI, then remove misconfigurations and rotate any exposed AWS keys or Kubernetes tokens. Researchers warned that NadMesh botnet operators target misconfigured Docker and Jenkins environments tied to AI tooling to steal cloud credentials, creating risk of follow-on cloud infrastructure compromise.

Require developers to treat recruiter-supplied GitHub repositories as hostile until reviewed, especially projects that execute Node.js or Tailwind plugin code. SlowMist analyzed fake recruitment outreach that lured developers into running malicious repositories; an obfuscated JavaScript file loaded as a Tailwind plugin executed through Node.js, then second-stage payloads stole browser and wallet data, exfiltrated files, and enabled remote control.