CYBER THREATCAST

Patch and investigate Cisco firewall infrastructure now: apply Cisco Secure Firewall Management Center fixes for CVE-2026-20131 and CVE-2026-20316, rotate credentials, keys, and certificates as Cisco advised, and examine Cisco ASA, Firepower, and Firepower Threat Defense devices for FIRESTARTER persistence. CVE-2026-20131 allows unauthenticated Java code execution as root with no workaround, CVE-2026-20316 can permit unauthenticated remote login through a low-privileged account, and CISA/NCSC warn FIRESTARTER can hook Cisco’s LINA engine for remote control and shell execution, potentially surviving reboots and firmware updates.

Remove internet exposure from Rockwell Automation and Allen-Bradley PLCs, then review U.S. agency TTPs and IOCs for current or historical compromise. Iranian-affiliated APT actors are attacking exposed PLCs in U.S. water, energy, and government facilities, including devices used for water pressure, pumps, and chemical dosing. Operators should verify PLC IP addresses, passwords, HMI and SCADA access paths, and monitoring/control integrity because attackers have changed IP addresses and passwords and locked some operators out of equipment.

Accelerate mobile OS updates for high-risk users and restrict exposure to untrusted web content and unsolicited image files. Zimperium says Coruna can compromise iPhones through malicious web content using five exploit chains and 23 vulnerabilities across iOS 13 through iOS 17.2.1, while Apple patched CVE-2026-20700 in iOS 26.3 after warning of highly targeted exploitation. Samsung Galaxy fleets also need April 2025 or later fixes for CVE-2025-21042, which LANDFALL spyware exploited via malicious DNG files likely delivered through WhatsApp to enable surveillance and data theft.

Harden Kubernetes workloads against token theft and React2Shell exploitation by patching vulnerable components, reducing service-account privileges, and reviewing high-privilege token use in cloud backend paths. Unit 42 reports a 282% year-over-year rise in Kubernetes token-theft operations, with Slow Pisces stealing high-privileged service account tokens from a cryptocurrency exchange and attackers rapidly exploiting React2Shell CVE-2025-55182 for unauthenticated remote code execution in Kubernetes workloads. IT organizations, which represented 78% of observed activity, should prioritize this exposure.

Treat affected @tanstack npm installations as compromised, rotate accessible secrets, and audit CI/CD trust paths that publish or consume packages. Snyk reports TeamPCP compromised TanStack’s npm release pipeline on May 11, 2026, publishing 84 malicious artifacts across 42 @tanstack packages while using legitimate OIDC identity and valid SLSA Build Level 3 provenance attestations. Development teams should not rely on provenance alone here; review GitHub Actions, CI environment tokens, package versions, and downstream deployments that may have executed the malicious artifacts.