CYBER THREATCAST

Patch internet-exposed macOS Screen Sharing and Remote Management systems with Apple’s emergency updates immediately, or remove them from public access until updated. CVE-2026-65400 is under active exploitation, bypasses authentication through stale validation state, and can provide root access. Review Screen Sharing sessions for the associated SRP authentication_type value and investigate affected Macs for Monero-miner deployment.

Remediate CVE-2026-12569 across PTC Windchill, Windchill PDMLink, and FlexPLM, prioritizing internet-accessible systems. Cl0p claims 43 breaches, and the flaw can be chained with information disclosure for unauthenticated remote code execution. Hunt for WSDL requests, JSP backdoors, flst.txt, and the reported distinctive HTTP header; treat matches as potential evidence of engineering-data theft.

Deploy SAP’s fixed Commerce Cloud releases for CVE-2026-58231 now; where immediate patching is impossible, restrict access to the vulnerable endpoint. The CVSS 10.0 flaw permits unauthenticated remote code execution and potential system takeover, and exploitation attempts reached honeypots only three days after patches became available.

Reduce public exposure and patch known vulnerabilities on routers, cameras, NAS devices, firewalls, gateways, application servers, PHP-CGI systems, and Kubernetes ingress-nginx. Evooo1Bot is actively compromising internet-facing Linux infrastructure and converting victims into SOCKS5 relays and DDoS nodes while supporting credential theft, persistence, and remote access. Investigate unexpected proxying, outbound traffic, and persistence on exposed devices.

Audit npm dependencies and development branches for ChainDrop exposure, and rotate npm tokens, GitHub credentials, cloud keys, and other secrets on affected systems. The worm reportedly compromised 444 packages, modifies published tarballs, and propagates using stolen npm and GitHub access. Scan suspect branches before opening them in Visual Studio Code or Claude Code because malicious configuration hooks may execute when developers open an infected branch.