CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Apple patched CVE-2026-65400 after attackers exploited the macOS Screen Sharing authentication bypass to gain root access and install Monero miners. The urgent exposure extends beyond Macs: actively exploited flaws affect Microsoft, VMware and Cisco products, while Cl0p reports data theft from nearly 50 companies through attacks involving PTC software.
CVE-2026-65400 affects internet-accessible macOS systems and requires immediate remediation. Apple released fixes for Tahoe, Sequoia and Sonoma, giving organizations a direct response to attacks that have already achieved root privileges.
Coldcard firmware 4.0.1 exposed predictable wallet seeds, enabling theft of more than 1,778 BTC from over 5,000 addresses. The LiteLLM compromise reportedly exposed cloud, Kubernetes and source-code credentials, while Cl0p's campaign shows how quickly vulnerable enterprise software can become an extortion channel.
Editorial: Recommended Actions
01
PRIORITY
Apply Apple’s fixes for macOS Tahoe, Sequoia, and Sonoma immediately, prioritizing internet-accessible Macs running Screen Sharing. CVE-2026-65400 is actively exploited, and observed attackers gained root access and installed Monero miners; investigate exposed systems for unauthorized root activity and mining software.
02
PRIORITY
Remove internet exposure or strictly restrict access to GeoServer deployments until a patch is available, especially systems using Oracle JDBC or PostGIS configurations. Attackers began exploiting the SQL-injection zero-day within hours of disclosure, and WatchTowr recorded hundreds of attempts with potential remote-code-execution impact.
03
PRIORITY
Install Microsoft’s patch for CVE-2026-55040 on SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Subscription Edition without delay. Attackers are using the flaw to impersonate users or administrators without authentication; chaining it with CVE-2026-63520 can enable remote code execution and server takeover.
04
PRIORITY
Move assets protected by seeds generated with Coldcard firmware 4.0.1 to newly generated seeds on patched devices. The firmware used predictable seed generation, and attackers stole more than 1,778 BTC from over 5,000 addresses; affected Coldcard users should not continue relying on previously generated seeds.
05
PRIORITY
Identify LiteLLM installations exposed to the malicious package window or related compromise, then replace potentially stolen cloud, SSH, Kubernetes, AI-provider, source-code, payment, and communications credentials. Investigate CI/CD runners and Kubernetes environments for lateral movement; exposed credentials can support follow-on infrastructure and supply-chain attacks, and some reportedly remained valid five months later.
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_