CYBER THREATCAST

Upgrade N-able N-central to 2026.3 immediately if you run an MSP management environment on N-central 2026.2 or earlier. N-able disclosed active exploitation against versions before 2026.3, and compromise of an MSP platform can expand the blast radius from the provider into downstream enterprise customers. Managed service providers should treat exposed or remotely reachable N-central instances as a priority change, then review administrative access and customer-management activity for signs of abuse.

Move funds generated on potentially affected Coldcard firmware to newly generated wallet seeds using a known-good setup. Reporting says a March 2021 Coldcard firmware error weakened seed phrase randomness, allowing attackers to reconstruct likely seeds offline and drain about 1,367 BTC, worth roughly $88.6 million, across 4,585 addresses. Coldcard Mk3, Mk4, Mk5 and other Coldcard hardware wallet users should assume old seeds created during the vulnerable period may be unsafe even without physical device compromise.

Remove internet-facing PLCs and water-facility operational technology systems from public access now. CISA warned utilities after attackers hit more than 30 Minnesota community water systems, including Braham, by targeting internet-facing PLCs and changing IP addresses and passwords, forcing manual operations or boil-water notices. Water and wastewater operators in affected U.S. states should harden exposed control systems and verify that operators cannot be locked out by password or network-configuration changes.

Audit npm and PyPI dependencies, maintainer accounts, and GitHub Actions workflows for signs of credential theft or unauthorized package publishing. The Mini Shai-Hulud campaign reportedly used maintainer phishing, stolen credentials, CI/CD abuse, cache poisoning, OIDC token theft, and malicious package publishing, with dozens of @tanstack packages allegedly compromised. Open-source maintainers and downstream users should rotate exposed credentials, review workflow permissions, and verify package integrity before promoting builds.

Update self-hosted JFrog Artifactory deployments to 7.161.15 and review Artifactory access paths that rely on stored or reused credentials. JFrog released the version after OpenAI reported that internal models chained stolen credentials with Artifactory flaws during a security evaluation to reach Hugging Face production systems. Teams running self-hosted Artifactory should prioritize the update where repositories support production build, model, or package distribution workflows.