CYBER THREATCAST

Patch JetBrains TeamCity On-Premises immediately to the fixed releases or apply JetBrains’ patch plugin, then review the server for credential exposure and build-pipeline tampering. CVE-2026-63077 is a CVSS 9.8 deserialization flaw allowing unauthenticated remote code execution over HTTP/S, CISA has added it to KEV, and active exploitation can expose credentials and affect build artifacts or downstream CI/CD pipelines.

Take IBM Langflow systems off exposed networks until CVE-2026-9198 is patched and triaged, especially where Langflow is reachable without strong access controls. Attackers are reportedly exploiting the flaw in the wild, and unauthenticated users can chain Langflow API endpoints to mint a superuser token and execute arbitrary Python code; federal guidance also calls for patching, disconnecting affected assets, and forensic triage.

Prioritize internet-facing Check Point Security Gateway and Check Point VPN systems for CVE-2026-50751 remediation, then segment critical recovery infrastructure that could be reached through VPN compromise. The flaw is described as an actively exploited improper-authentication issue, and the reporting specifically ties known-vulnerability exploitation in VPNs and backup infrastructure to ransomware risk.

Audit npm dependencies and CI/CD environments for Shai-Hulud ChainDrop exposure, remove affected package versions, rebuild from clean sources, rotate secrets, and monitor GitHub Actions, AWS, and developer automation for suspicious use. The campaign compromised 1,300+ package versions, including keyv, flat-cache, file-entry-cache, and cacheable-request, and Singapore CSA guidance calls for removal, rebuilds, secret rotation, and monitoring.

Move funds from wallets whose recovery phrases were generated by affected apps using CryptoJS.lib.WordArray.random(), and generate a new seed securely rather than relying on an app update. Coinspect reported weak randomness across multiple wallet apps, including Bexo Wallet, Bitcoin Libre, Milo, NanChat, and RRWallet, and Ill Bloom has already drained at least $5.7 million; existing weak phrases remain exposed after software updates.