CYBER THREATCAST

Remove IBM Langflow endpoints such as /api/v1/auto_login and /api/v1/validate/code from unauthenticated access, upgrade to 1.10.1 where applicable, and assume exposed deployments may need credential rotation and database review. Attackers are reported minting superuser tokens, executing arbitrary Python, stealing Global Variables such as API keys, cloud credentials, and database passwords, dumping databases, pivoting laterally, and deploying ransomware; Langflow operators should treat internet-exposed instances as potentially compromised, not merely unpatched.

Lock down Metabase 1.58+ and open-source 0.58+ instances immediately, especially access to /api/session/reset_password, and audit for unauthorized admin promotion, credential access, and extraction from connected data sources. Attackers are actively exploiting an unauthenticated SQL injection in Metabase, and Framework has notified customers after personal details were exposed through a third-party analytics provider breach tied to this activity; self-hosted Metabase operators should prioritize exposure reduction and incident review.

Prioritize Microsoft Outlook Web Access remediation and mailbox threat hunting for CVE-2026-42897, with special attention to government, telecom, finance, hospitality, and aerospace environments in the U.S. and Europe. Russia-linked TA488 is reported exploiting the flaw with OWAReaper, which executes in the OWA read pane and captures credentials and mailbox settings, enabling stealthy long-term mailbox access rather than noisy one-time compromise.

Patch Citrix NetScaler ADC and NetScaler Gateway systems affected by CVE-2026-8451 without delay, including 13.1 before 13.1-63.18 and 14.1 before 14.1-72.61, and review SAML-facing appliances for signs of probing or cookie theft. The flaw is a pre-authentication memory overread in SAML XML parsing that can leak live session cookies to unauthenticated attackers, and attackers reportedly began probing or exploiting it within about 24 hours of disclosure.

Upgrade BTCPay Server 2.4.2 deployments handling Lightning payments and rotate or revoke LND credentials that may have been exposed. The flaw is reportedly being actively exploited to reach LND credential files, compromise Lightning nodes, and drain Lightning channels; Bitcoin ecosystem organizations running BTCPay Server with LND should pair patching with credential cleanup rather than relying on an upgrade alone.