CYBER THREATCAST

Verify WordPress automatic core updates completed on every site running WordPress 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1, and prioritize any host where updates are disabled or managed manually. CVE-2026-63030 and CVE-2026-60137 are reportedly exploited in the wild, and the chain gives unauthenticated remote code execution against default WordPress installations without plugins, themes, or login access.

Inventory KNX building automation deployments and immediately review exposure of KNX Protocol Connection Authorization Option 1, especially systems reachable through remote-access paths or shared building networks. CVE-2023-4346 is now in CISA’s Known Exploited Vulnerabilities catalog, and attackers reportedly accessed a German KNX automation network, wiped hundreds of devices, and permanently locked them, creating physical-operational recovery risk for commercial building operators.

Confirm ServiceNow AI Platform fixes are applied on hosted instances and install the available updates on any self-hosted ServiceNow deployment without delay. CVE-2026-6875 is under active exploitation as a pre-authentication sandbox escape that can lead to remote code execution, and reported post-exploitation activity includes privilege escalation, credential harvesting, data exfiltration, and lateral movement against ServiceNow customers.

Patch Linux kernels for CVE-2026-31431 across servers, Kubernetes environments, cloud images, and major distributions including RHEL, SUSE, Ubuntu, Amazon Linux where applicable. The Copy Fail flaw allows a low-privilege local attacker to gain root through the algif_aead cryptographic module, public proof-of-concept code is reportedly available, and the vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog.

Patch SonicWall SMA 1000 VPN appliances for CVE-2026-15409 and CVE-2026-15410 and hunt for compromise dating back to June 22, 2026. Volexity reported, and SonicWall confirmed, exploitation before patches were available; threat actor UTA0533 chained an SSRF flaw with post-authentication code injection to obtain root or administrator access on SMA 1000 appliances.