CYBER THREATCAST

Patch Arista CloudVision Portal, Fortinet FortiOS, and on-premises Arista VeloCloud Orchestrator immediately, then check for persistence and indicators of compromise. CISA has placed the Arista and Fortinet flaws in its Known Exploited Vulnerabilities catalog, and Arista says CVE-2026-16812 in VeloCloud Orchestrator is being exploited in the wild. Agencies and enterprises running edge or orchestration systems face administrative-interface access, OS command injection, and sensitive data exfiltration risk if these devices remain exposed.

Identify every Java application using FastJson 1.x, especially FastJson 1.2.68 through 1.2.83 and Spring Boot fat-JAR deployments, and enable SafeMode or migrate to fastjson2. Attackers are actively exploiting CVE-2026-16723 without authentication, and the flaw can enable remote code execution without user interaction or elevated privileges. Organizations in the U.S., Singapore, and Canada across multiple sectors have already been targeted, and no fix is available for FastJson 1.x.

Upgrade public-facing WordPress sites to WordPress 7.0.2, 6.9.5, or 6.8.6, or block the vulnerable REST API batch endpoint where immediate upgrade is not possible. Pakistan’s National CERT warned that attackers are actively exploiting CVE-2026-63030 and CVE-2026-60137, which can be chained for unauthenticated remote code execution and full website takeover. Sites on WordPress 7.0.0-7.0.1, 6.9.0-6.9.4, and affected 6.8.x-and-later branches should be treated as exposed until remediated.

Remove malicious prerelease versions of @joyfill/components and @joyfill/layouts from developer machines, CI systems, test runners, and build environments, then rotate credentials that may have been exposed. StepSecurity reported that the compromised Joyfill npm beta releases execute on import, contain obfuscated payloads, and include remote access and credential-stealing behavior. Teams that imported the affected packages should treat the environment as potentially compromised rather than only updating the dependency.

Prioritize securing vulnerable Zimbra Collaboration Suite webmail servers used by defence, government, education, energy, law enforcement, media, NGO, and technology organizations. UK NCSC and partner agencies warn that Russian state-supported LAUNDRY BEAR is running an ongoing zero-click phishing espionage campaign against Western organizations, with compromise possible when users view malicious email. Organizations using Zimbra should harden and remediate exposed webmail before relying on user awareness to stop this activity.