CYBER THREATCAST

Patch or remove Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 from exposed and production paths immediately, then look for exploitation against Tomcat Tribes EncryptInterceptor configurations. CVE-2026-34486 is in CISA’s Known Exploited Vulnerabilities catalog, public proof-of-concept code and active exploitation have been reported, and the regression can fail open so attacker-controlled bytes reach Java deserialization after decryption failure, enabling unauthenticated remote code execution under certain conditions.

Upgrade JetBrains TeamCity On-Premises before 2025.11.7 and before 2026.1.3 without waiting for the federal remediation deadline, and review TeamCity service-account activity for arbitrary command execution. CVE-2026-63077 is a CVSS 9.8 unauthenticated deserialization flaw reachable over HTTP/S, CISA added it to KEV after evidence of active exploitation, and attackers with network access can execute OS commands as the TeamCity service account.

Lock down and investigate N-able N-central servers now, especially at MSPs, and treat administrative access as potentially exposed if vulnerable instances were reachable. CISA confirmed exploitation in the wild of N-central vulnerabilities and added them to KEV; attackers have abused administrative access to pivot into MSP client endpoints through Take Control, target domain controllers, and use a Cloudflare tunnel for persistence.

Audit npm dependencies, developer machines, and CI/CD environments for Shai-Hulud/ChainDrop exposure, prioritizing Keyv and related packages, then rotate automation secrets tied to GitHub, GitHub Actions, AWS metadata access, and build pipelines. Singapore CSA warned the attack is ongoing; a maintainer GitHub account was hijacked to publish poisoned npm releases, the self-replicating worm has targeted packages such as keyv and plugins, and at least 444 packages and more than 2,000 versions were infected.

Remove exposed cellular modem and unprotected access paths to PLCs at water and wastewater facilities, then verify PLC programs, operator credentials, and manual-operation procedures. Tenable reports coordinated attacks disrupting more than 30 Minnesota water and wastewater systems and activity across at least seven U.S. states, preliminarily linked to Iran/CyberAv3ngers; attackers deleted PLC programming and changed passwords, causing some plants to go offline or switch to manual operations.