CYBER THREATCAST

Review every Metabase and Metabase Cloud deployment now, confirm the vendor-side fix or attack-path block is in place, and investigate for abuse of admin access. A CVSS 10.0 unauthenticated SQL injection zero-day was exploited in the wild to gain admin access, steal credentials, and exfiltrate connected data; Framework also disclosed customer contact and account-related data exposure through a Metabase BI instance tied to an unknown zero-day affecting Metabase Cloud 1.58 and above. Check for the reported POST /api/session/reset_password followed by GET /api/user/current pattern, rotate exposed credentials, and assess what connected data sources may have been queried or exported.

Update BTCPay Server 2.4.2 deployments immediately, then rotate LND macaroon root keys and move hot-wallet funds rather than treating patching as sufficient. The flaw is reportedly being actively exploited to reach LND credential files and drain Lightning channels, so any BTCPay Server deployment handling Lightning payments should assume credentials may already be exposed until proven otherwise.

Patch TrueConf servers against KLCERT-26-057 and KLCERT-26-058 and verify that client installers hosted by those servers have not been replaced. Head Mare exploited unpatched TrueConf server flaws to compromise servers, serve trojanized TrueConf client installers, and deploy PhantomCore and PhantomGraph backdoors against multiple Russian organizations; administrators should treat affected servers as possible software-distribution points, not just vulnerable applications.

Restrict Atlassian Rovo access to the minimum Jira, Confluence, SharePoint, Slack, Microsoft 365, Google Workspace, and Bitbucket data it needs, and confirm Atlassian’s server-side fix is applied. Researchers showed prompt-injection paths, including RovoBlast, that could make Rovo collect accessible data and exfiltrate it externally; one issue was fixed server-side, while reducing Rovo access remains the main mitigation for the content-borne path.

Remove water utility control computers from direct public internet exposure and separate OT from IT before attackers change settings, IP addresses, or passwords. Hackers reportedly accessed internet-facing water control systems across at least seven U.S. states and caused loss of pressure, flooding, and a control shutdown in Braham, Minnesota; Michigan officials are urging MFA, patching, monitoring, offline backups, staff training, incident-response planning, OT/IT separation, and reduced public exposure for critical equipment.