CYBER THREATCAST

Upgrade self-hosted N-able N-central servers to hotfix 2026.3.1.7 immediately, and verify hosted instances received the automatic fix. All builds before 2026.3.1.7 are affected, and attackers are exploiting CVE-2026-18577 to gain remote administrative access, take over admin accounts, use Take Control to reach managed endpoints, and deploy Cloudflare Tunnel persistence. MSPs and N-central customers should inspect N-central servers, admin accounts, Take Control activity, managed endpoints, and any Cloudflared/Cloudflare Tunnel artifacts for signs of compromise.

Remediate SonicWall SMA 1000 appliances for CVE-2026-15409 and CVE-2026-15410 now, then treat exposed credentials and MFA material as potentially compromised. INC Ransomware is suspected of chaining the two zero-days against SMA 1000 VPN appliances to obtain root-level access, and attackers reportedly stole credentials, session databases, and TOTP MFA seed material. Government and private-sector operators should prioritize patching, review appliance access, invalidate sessions, and reset affected authentication material.

Remove internet exposure from water and wastewater control equipment and review Allen-Bradley/Rockwell Automation PLC access immediately. The FBI and EPA warned that hackers targeted municipal water and wastewater systems in at least seven U.S. states, gained remote access to internet-connected control equipment, and in some incidents degraded operations. Utilities using HMI/SCADA systems, OT environments, PLC systems, and Allen-Bradley PLCs should audit remote access, examine PLC project files for theft or tampering, and verify monitoring and control functions remain safe.

Move Apple iOS 18.4 through 18.7 users out of the vulnerable exposure window and warn them against AWS- and Apple ID-themed lures tied to DarkSword. A Chinese threat actor is using leaked DarkSword exploit-kit source code across more than 100 web properties to target iOS 18.4 through 18.7 with a browser-to-kernel exploit chain and install GHOSTBLADE, which can steal keychain, iCloud, and Wi-Fi credentials and collect files. Organizations with managed Apple fleets should prioritize affected users and investigate suspected credential theft.

Create new Coldcard wallet seeds on patched firmware and move funds from wallets generated during the affected firmware period. Unknown attackers allegedly exploited a Coldcard firmware RNG fallback issue that made recovery seeds reproducible offline, draining more than 1,367 BTC from over 4,500 Bitcoin wallets. Coldcard Mk2 and Mk3 users, Bitcoin holders, and custodial teams that generated BTC addresses with Coldcard firmware should not rely on old recovery phrases after updating; generate fresh seeds and transfer funds to new addresses.