CYBER THREATCAST

Patch on-premises Microsoft SharePoint Server for CVE-2026-45659 immediately and treat any exposed unpatched instance as a ransomware foothold until proven otherwise. CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirming exploitation, and reporting ties active attacks to ransomware groups, with researchers suspecting China-linked Storm-2603 and possible Warlock ransomware involvement. Organizations running unpatched SharePoint servers should prioritize emergency change windows, verify patch completion, and review SharePoint hosts for signs of unauthorized access before returning them to normal risk status.

Apply the Microsoft Windows fix for CVE-2026-68820 and hunt for DPRK-linked intrusion activity on defense, aerospace, and aviation networks. Check Point reports North Korean operators exploited this Windows afd.sys use-after-free as a zero-day to gain SYSTEM privileges and deploy FudModule, alongside fake jobs, malicious files, sideloaded malware, and backdoors. European and Indian defense-sector organizations should also check Roundcube exposure because the same activity used CVE-2025-49113 on Roundcube servers to install RelayShell webshells for command-and-control relay infrastructure.

Patch Fortinet FortiOS and FortiProxy devices for CVE-2024-55591 and CVE-2025-24472, then review internet-facing appliances for privileged access abuse. A joint U.S.-South Korean advisory says Gunra ransomware affiliates are exploiting these known authentication-bypass flaws against critical infrastructure and government organizations, with observed tactics including MFA bypass, session hijacking, backup deletion, and double extortion. Fortinet appliance owners in healthcare, finance, manufacturing, government, and critical infrastructure should combine rapid patching with network segmentation and immutable backups, as authorities recommend.

Take internet-reachable TrueConf Server systems on port 4307/TCP through emergency remediation and verify hosted TrueConf client installers before users download them. Kaspersky-linked reporting says Head Mare exploited unpatched TrueConf Server vulnerabilities, achieved NT AUTHORITY\SYSTEM execution, deployed a web shell, and replaced hosted client installers with trojanized builds carrying PhantomCore and PhantomGraph. Organizations running TrueConf Server 5.3.x through 5.5.5 should assume installer integrity matters as much as server patching, especially Russian organizations identified as targets.

Remove internet exposure from PLCs, cellular IoT modems, and edge devices used in water and wastewater operations, then reset weak or shared credentials on Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 environments. CyberAv3ngers, linked to Iran IRGC-CEC, reportedly compromised more than 30 Minnesota municipal water and wastewater systems and systems in at least six other U.S. states by targeting weakly secured cellular IoT modems, internet-facing PLCs, and edge devices. Utilities should prioritize access hardening because reporting found no common vulnerability, only insecure exposure and weak OT operational hygiene.