CYBER THREATCAST

Install Apple’s emergency fixes for supported macOS Tahoe, Sequoia, and Sonoma systems, and remove unnecessary internet exposure for Screen Sharing on port 5900. Attackers are actively exploiting CVE-2026-65400 to bypass authentication, obtain root access, and install Monero miners on exposed Macs.

Patch SAP Commerce Cloud against CVE-2026-58231 immediately and identify any Commerce Cloud Data Hub Adapter instances exposed to the internet. The unauthenticated RCE flaw carries a CVSS score of 10.0, exploitation attempts have been observed, and approximately 1,200 instances were reportedly exposed online.

Apply Microsoft’s July 2026 update to on-premises SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Subscription Edition. Attackers are exploiting CVE-2026-55040 to impersonate users or administrators without authentication; chaining it with CVE-2026-63520 can produce remote code execution and full server takeover.

Apply PTC’s fixes for CVE-2026-12569 on Windchill and FlexPLM systems, then investigate exposed deployments for JSP webshells and data theft. CISA confirmed active exploitation and added the flaw to its KEV catalog; Cl0p claims it stole data from nearly 50 companies, including 89GB from Shell and 13.5GB from Philips.

Audit CI/CD environments for compromised Trivy v0.69.4 and poisoned GitHub Action tags, then revoke and replace any potentially exposed SSH keys, cloud credentials, Kubernetes tokens, API keys, and CI/CD secrets. Attackers used the compromised Trivy components to steal credentials from LiteLLM’s pipeline, and a surfaced 153GB archive allegedly contains secrets associated with nearly 2,500 organizations.