CYBER THREATCAST

Apply Cisco Secure Firewall Management Center hot fixes immediately and treat exposed FMC appliances as high-risk until verified. CISA says CVE-2026-20316 is being actively exploited to allow unauthenticated remote login through a low-privileged account, and Cisco confirmed active exploitation of maximum-severity CVE-2026-20131, an unauthenticated RCE tied to Interlock ransomware activity. Inventory FMC instances, prioritize internet-reachable management surfaces, and review logs for unexpected low-privileged access or remote command activity.

Patch on-premises Microsoft Exchange Server 2016, 2019, and Subscription Edition systems for CVE-2026-42897 and investigate Outlook Web Access activity for signs of OWAReaper. Proofpoint reported Russian-linked TA488 exploiting the flaw against government and enterprise targets in the U.S. and Europe, and CISA added it to the Known Exploited Vulnerabilities catalog. The campaign can compromise a mailbox when a victim opens a booby-trapped email in OWA, and OWAReaper can capture credentials, mailbox data, and OAuth tokens while maintaining browser-based persistence.

Upgrade or disable vulnerable React Server Components and affected Next.js-related deployments exposed to untrusted traffic, then hunt for post-exploitation payloads. CVE-2025-55182 is a CVSS 10.0 pre-authentication RCE, and Trend Micro reports active exploitation, mass scanning, WAF bypass variants, and roughly 145 proof-of-concept exploits in the wild. Look specifically for activity associated with Cobalt Strike, Nezha, FRP, Sliver, and Secret-Hunter on servers that process React Server Components.

Treat systems that installed affected @tanstack npm packages as compromised: rotate developer, cloud, Kubernetes, GitHub Actions, and OIDC-derived credentials; rebuild CI/CD environments; and remove malicious services. TeamPCP allegedly published 84 malicious artifacts across 42 @tanstack packages with valid SLSA provenance, and the loaders harvested developer and cloud credentials during installation. Valid provenance is not enough here because attackers used short-lived OIDC tokens from CI environments to act as trusted build systems.

Remove internet exposure from Rockwell Automation and Allen-Bradley PLCs, especially MicroLogix 1100 and 1400 devices, and urgently tighten credentials, remote access, and segmentation around HMI/SCADA networks. U.S. agencies warned Iranian-affiliated actors are targeting exposed PLCs across water, energy, and government facilities, while FBI and EPA warnings describe attacks on municipal water systems in at least seven states. Review PLC passwords, IP settings, project files, and HMI/SCADA display data for unauthorized changes that could disrupt operations.