CYBER THREATCAST

Apply N-able’s second mandatory N-central hotfix immediately, then review the RMM platform for unauthorized administrative access, suspicious Take Control activity into customer environments, and any Cloudflare Tunnel service registered for persistence. N-central customers and managed-service providers should treat CVE-2026-18577 as a compromise-assessment trigger, not just a patching task, because attackers exploited the flaw as a zero-day to gain unauthenticated administrative access and reach downstream customer systems.

Remove internet exposure for Rockwell Automation and Allen-Bradley PLCs at water and wastewater utilities, especially EtherNet/IP on port 44818, and immediately check controller IP addresses, passwords, and operator access paths for unauthorized changes. U.S. water operators should prioritize Rockwell CompactLogix, Allen-Bradley MicroLogix 1100/1400, and other exposed PLCs because attackers have remotely accessed these systems, changed IP addresses and passwords, and caused disruptions including pressure drops, flooding, and manual operations across at least 12 states.

Upgrade WinRAR to version 7.13 on all Windows endpoints and investigate auto-run locations for unexpected executables on systems that handled archive files before patching. Organizations in Europe and Canada, especially defense, finance, and logistics firms, should move quickly because CVE-2025-8088 is being actively exploited in ransomware attacks and the path traversal flaw can place an executable in Windows auto-run locations.

Patch Metabase Cloud and self-hosted Metabase 1.58+ deployments according to Metabase’s urgent remediation guidance, then rotate connected database credentials and assess what customer data each Metabase instance could export. The unauthenticated SQL injection zero-day was exploited to steal database credentials and accessible data, and reported victims included Framework customers whose names, email addresses, phone numbers, and physical addresses were accessed.

Upgrade JetBrains TeamCity to 2026.1.3 and restrict HTTP/HTTPS exposure to trusted administrative networks while patching is underway. CVE-2026-63077 is an unauthenticated remote code execution flaw reachable without credentials, CISA added it to the Known Exploited Vulnerabilities catalog, and a proof-of-concept is available, making internet-accessible CI/CD infrastructure a high-value target.