CYBER THREATCAST

Inventory every internet-facing Progress Kemp LoadMaster and Progress ADC deployment now, remove unnecessary exposure, and prioritize remediation of CVE-2026-8037. CISA added the command-injection flaw to its Known Exploited Vulnerabilities catalog after evidence of active exploitation against exposed Progress LoadMaster devices, so organizations running Progress Kemp LoadMaster GA 7.2.63.1 and earlier or LTSF 7.2.54.17 and earlier should treat externally reachable systems as high-risk until checked.

Upgrade Metabase deployments, revoke sessions, rotate credentials, review API keys, and inspect logs for suspicious API activity. Attackers exploited a critical unauthenticated Metabase SQL injection zero-day against Framework’s Metabase cloud instance and accessed customer data; Metabase Cloud users and self-hosted Metabase administrators should assume exposed analytics systems may hold credentials, customer records, and operational data attractive to attackers.

Patch and reduce exposure on Fortinet firewalls and VPNs, SonicWall SMA1000 gateways, and Check Point VPN systems, then hunt for ransomware access through remote-access infrastructure. Gunra affiliates are exploiting Fortinet VPN and firewall vulnerabilities against critical infrastructure, finance, healthcare, and manufacturing; ransomware gangs are exploiting SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410; and Qilin-linked activity used Check Point VPN vulnerabilities CVE-2026-33825 and CVE-2026-50751. Enforce MFA on remote access and review logs for unusual privileged access.

Secure N-able N-central immediately and investigate MSP environments for Storm-1175 tradecraft, especially use of N-central Take Control, Cloudflare tunnels, AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz. Microsoft says China-linked Storm-1175 is deploying StormEncryptor ransomware after likely exploitation of CVE-2026-18577 or a related CVE-2026-18556 patch bypass, followed by discovery, LSASS dumping, exfiltration, and encryption. MSPs should also assess downstream customer environments for signs of remote-access abuse.

Disable affected BdThemes WordPress plugins and inspect administrator accounts, installed plugins, web shells, and MU-plugin persistence before restoring service. Researchers reported a supply-chain compromise in BdThemes infrastructure that poisoned a promotional banner JSON feed and ran malicious JavaScript in admin browsers, creating rogue administrator users, installing fake plugins, and deploying web shell and backdoor persistence. WordPress site owners using BdThemes products should not treat plugin removal alone as sufficient cleanup.