CYBER THREATCAST

Patch Fortinet FortiOS and FortiProxy systems for CVE-2024-55591 and CVE-2025-24472 immediately, then review internet-facing Fortinet VPN gateways and firewalls for unauthorized administrative access. Gunra ransomware affiliates are actively exploiting these flaws before stealing and encrypting data, with finance, government, enterprise, and critical infrastructure organizations among the affected sectors. Enforce MFA, segment exposed services from internal systems, and verify that offline or immutable backups can restore priority workloads.

Update on-premises Microsoft SharePoint Server without delay and check affected servers for compromise, prioritizing systems exposed to untrusted networks. CVE-2026-45659 is being actively exploited in ransomware attacks and CISA added it to the Known Exploited Vulnerabilities catalog; separate research also showed an on-premises SharePoint exploit chain using CVE-2026-55040 and CVE-2026-63520 to reach unauthenticated remote code execution, with Microsoft and Rapid7 saying the July update breaks that chain. SharePoint Online is not identified as affected by the latter chain.

Upgrade internet-reachable TrueConf Server deployments to the latest patched releases and inspect them for web shells, unexpected NT AUTHORITY\SYSTEM-level activity, and replaced client installers. Kaspersky reported Head Mare exploited KLCERT-26-057 and KLCERT-26-058 in TrueConf Server 5.3.x through 5.3.9, 5.4.x through 5.4.9, and 5.5.x through 5.5.5 to gain arbitrary code execution as NT AUTHORITY\SYSTEM, access data, deploy a web shell, and swap a TrueConf client installer with an infected build.

Patch self-hosted Metabase 1.58 and later immediately, and treat exposed instances as potentially compromised until logs, sessions, credentials, API keys, and tokens have been reviewed. Metabase disclosed a critical zero-day SQL injection flaw in /api/session/reset_password that was exploited to gain direct SQL access and could expose credentials, API keys, and tokens; Metabase Cloud blocked exploited endpoints, patched the issue, terminated sessions, and revoked credentials used in the incident, but self-hosted deployments may remain exposed if not updated.

Defense, aerospace, and aviation organizations in Europe and India should patch Windows AFD.sys CVE-2026-68820 and Roundcube CVE-2025-49113, then hunt for fake job-offer lures, trojanized PDF viewers, RelayShell web shells, FudModule/rootkit activity, and related persistence. Check Point reported DPRK-linked Operation Dream Job activity using impersonation sites, SEO abuse, SecurityPDF, the Troy backdoor, Roundcube exploitation, and a Windows zero-day exploited before Microsoft patched it to gain SYSTEM privileges and evade EDR.