CYBER THREATCAST

Patch or remove exposed N-able N-central, IBM Langflow, and Apache Tomcat systems immediately, and give MSP environments first priority. CISA added these flaws to its Known Exploited Vulnerabilities catalog after active exploitation, including N-able N-central CVE-2026-18556 and CVE-2026-18577, where attackers gained administrative access and pivoted into MSP-managed endpoints. Tomcat administrators should move to fixed versions without delay, and organizations using Langflow or N-central should investigate for unauthorized administrative activity before assuming patching alone is sufficient.

Freeze high-risk npm updates, audit builds for Shai-Hulud-affected packages, and rotate developer and CI/CD secrets exposed during recent installs. The worm infected at least 444 packages across more than 2,000 versions, stole developer secrets, and used compromised maintainer credentials to publish malicious releases; some poisoned releases carried legitimate provenance attestations after a maintainer GitHub account was hijacked. Node.js teams should treat affected build hosts and CI runners as potentially compromised, especially where packages with large downstream use entered pipelines.

Remove direct internet access to water-sector PLCs and HMIs, then verify Allen-Bradley MicroLogix and other industrial controller logic, credentials, and remote-access paths. Iran-linked or Iran-aligned activity reportedly affected water systems in at least a dozen U.S. states, including remote access to pumps, valves, and pressure controls; attackers also allegedly deleted PLC programming and changed passwords, blocking operators from reconnecting. Smaller utilities should prioritize known vulnerable industrial control systems and cellular-connected devices that can be reached remotely.

Update Coldcard firmware, generate a new seed phrase, and move Bitcoin funds to a newly secured wallet if you used affected Coldcard devices. Coinkite released hotfixes after a random-number-generation flaw was reportedly exploited by at least 15 attackers, with confirmed Bitcoin losses of about $100 million and possible losses around $130 million. Hardware-wallet users should not rely on the old seed after applying firmware fixes because the reported exploit targets wallet key generation rather than only transaction handling.

Upgrade Paperclip deployments to v2026.416.0 and take network-accessible instances offline until the update is complete. CVE-2026-41679 can allow unauthenticated host command execution on exposed Paperclip deployments through self-registration, authorization logic, API key minting, and import functionality; related issues can also enable local command execution through malicious imports in default local_trusted mode. A Metasploit module is available, so Paperclip operators should assume exploit attempts will target reachable instances quickly.