CYBER THREATCAST

Treat N-able N-central servers as exposed and review them immediately for compromise tied to CVE-2026-18577 and CVE-2026-18556. N-able confirmed active exploitation of N-central, including an authentication bypass and account-takeover path tied to an incomplete patch, and attackers have used Take Control plus Cloudflare tunnels for persistence on managed endpoints. MSPs and organizations using N-central should prioritize server access review, administrative account validation, and hunting across managed customer endpoints for unexpected Take Control activity or Cloudflare tunnel use.

Upgrade on-premises VeloCloud Orchestrator deployments to 5.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1, or later without delay. Arista warned that attackers are actively exploiting CVE-2026-16812, an unauthenticated OS command injection reachable through the web interface, against exposed on-premises Orchestrator systems. Network teams should prioritize internet-facing management surfaces and verify that every supported branch is on a fixed build.

Investigate internet-facing SonicWall SMA 1000 appliances for compromise and credential exposure linked to CVE-2026-15409 and CVE-2026-15410. UTA0533 used the chained zero-days to tunnel to localhost-only services through /wsproxy, escalate to root through the hotfix-removal service, and harvest credentials and secrets from VPN gateways. Organizations using SMA 1000 should assume affected gateways may expose high-value identity material and prioritize root-level compromise review and credential handling for users and systems that trusted those gateways.

Move Bitcoin out of Coldcard wallets whose seeds may have been generated with the affected firmware randomness weakness, and create replacement wallets using a trusted, uncompromised seed-generation process. Reporting ties an ongoing theft campaign to a March 2021 Coldcard firmware flaw that weakened random seed generation, with Galaxy Research reporting about 1,367 BTC stolen across 4,585 addresses. Coldcard users and custodians should treat old seeds from the affected period as high risk, not merely the device firmware state.

Audit JavaScript builds that consumed recent Axios npm updates for the hidden plain-crypto-js dependency, postinstall execution, and SyphonV2 RAT indicators. Kaspersky-linked reporting says a compromised Axios maintainer account pushed malicious npm updates that pulled in plain-crypto-js, ran postinstall code, and dropped a cross-platform RAT, with artifacts linked to earlier BlueNoroff activity. Enterprise and crypto development teams should review developer workstations, CI systems, package locks, and build logs for exposure.