CYBER THREATCAST

Patch PAN-OS GlobalProtect immediately and review portal and gateway configurations that use authentication override cookies and certificate settings. Qilin ransomware affiliates are actively exploiting CVE-2026-0257 to gain unauthorized VPN access, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog. Organizations running affected PAN-OS 10.2, 11.1, 11.2, 12.1 or Prisma Access releases should also hunt for persistence, credential dumping, Active Directory database extraction, defense evasion, and encryption activity in June 2026 and later logs.

Upgrade SonicWall SMA1000 appliances to fixed versions and investigate any exposed device as potentially compromised. UTA0533 exploited CVE-2026-15409 and CVE-2026-15410 as zero-days to gain root control through SSRF and command injection, and CISA has added both flaws to KEV. SMA1000 6210, 7210, and 8200v operators should look for KnuckleBall, OrangeTail, and Suo5 activity in legitimate processes and validate appliance integrity before returning systems to trusted VPN service.

Update exposed WordPress sites to the available fixed releases and treat vulnerable public installations as potentially compromised. CVE-2026-63030 and CVE-2026-60137 are being exploited in the wild and can be chained for unauthenticated remote code execution against vulnerable WordPress Core versions. Site operators should check for malicious plugin uploads, unauthorized admin access, user enumeration, local file inclusion attempts, mass scanning, and PHP webshell deployment before assuming an updated site is clean.

Remove exposed Langflow instances from untrusted access paths and investigate any server reachable through the unauthenticated /api/v1/validate/code endpoint. JADEPUFFER exploited Langflow CVE-2025-3248 for remote Python execution and deployed ENCFORGE, a Go ransomware strain targeting AI model weights, vector indexes, datasets, checkpoints, FAISS indexes, GGUF files, and other ML artifacts. AI and ML infrastructure operators should verify backups for those assets and look for .locked files and ransom notes.

Harden Cisco routers and other edge routing infrastructure by removing default credentials, disabling insecure protocols, updating firmware, and auditing SNMP and TFTP exposure. U.S. and allied agencies warned that FSB-linked Russian actors, including activity associated with Berserk Bear, Dragonfly, Energetic Bear, Ghost Blizzard, and Static Tundra, are scanning for weak or default SNMP community strings and using SNMP and TFTP to steal router configuration files from critical infrastructure networks.