CYBER THREATCAST

Patch Progress Kemp LoadMaster systems for CVE-2026-8037 immediately and prioritize any internet-exposed LoadMaster API instances. CISA has added the command-injection flaw to its Known Exploited Vulnerabilities catalog after active exploitation reports, and the flaw allows unauthenticated arbitrary command execution through the LoadMaster API. Operators should treat exposed appliances as high-risk, verify remediation against the August 10, 2026 federal deadline, and review recent access for exploitation attempts, including activity from the reported 65 IPs across 18 countries.

Upgrade on-premise N-able N-central deployments to 2026.3.1.10 with Hotfix 2 and investigate managed-system access for signs of abuse. N-able released the hotfix after active exploitation of CVE-2026-18577, related to CVE-2026-18556, gave attackers remote administrative access and reach into managed systems, with persistence reported through Cloudflare Tunnel. Microsoft also reported Storm-1175 deploying StormEncryptor ransomware in activity that may be tied to exploitation of a newly disclosed N-able authentication-bypass flaw, so RMM operators should check for SimpleHelp, Advanced IP Scanner, and Mimikatz use where appropriate.

Apply Metabase patches and use the released IOCs to hunt for compromise in Metabase Cloud and self-managed Metabase versions 1.58 and above. Metabase disclosed a maximum-severity zero-day SQL injection exploited in the wild that can give unauthenticated attackers administrator access and expose connected data and stored credentials. Organizations using Metabase for business intelligence should review connected data sources, assess whether names, email addresses, phone numbers, physical addresses, or credentials were exposed, and reset affected secrets where investigation supports exposure.

Upgrade BTCPay Server instances using LND to version 2.4.2 now or take affected servers offline until they are fixed. Attackers exploited a critical BTCPay Server flaw to remotely obtain LND .macaroon access files, control Lightning Network nodes, and sweep funds, with Foundation and Citadel21 reportedly impacted. Operators should check for unauthorized .macaroon access and unexpected Lightning fund movement before restoring normal service.

Disable affected BdThemes WordPress plugins until a trustworthy fix is available, and audit administrator sessions, new admin accounts, plugin uploads, and outbound contact from WordPress hosts. Wordfence reported that attackers poisoned a remote JSON feed used by BdThemes plugins, triggering XSS in logged-in administrators’ browsers through the Biggopti component on wp-admin page loads. The compromise could enable rogue admin creation, webshell plugin uploads, and command-and-control contact, while affected plugins were closed with no patch available at reporting.