CYBER THREATCAST

Install Apple’s emergency fixes on Macs immediately, then remove unnecessary internet exposure for Screen Sharing on TCP port 5900. Attackers are actively exploiting CVE-2026-65400 against exposed systems, gaining root access and deploying Monero miners.

Apply SAP’s fix for CVE-2026-58231 to affected SAP Commerce Cloud Data Hub Adapter deployments immediately and restrict unauthenticated access until remediation is complete. The CVSS 10.0 flaw permits unauthenticated remote code execution, and exploitation attempts began three days after patch availability.

Move assets from Coldcard wallets whose seeds were generated with Coinkite firmware released in March 2021, replacing those seeds before reuse. Attackers exploited insufficient seed entropy to drain at least 1,778.84 BTC—about $112.7 million—from more than 8,600 addresses.

Inventory and patch internet-facing routers, cameras, NAS devices, firewalls, gateways, application servers, PHP-CGI systems, and Kubernetes ingress-nginx deployments targeted by Evooo1Bot; remove unnecessary exposure. The Mirai-based malware exploits known vulnerabilities, persists, and turns compromised devices into proxies, credential stealers, access infrastructure, or DDoS nodes.

Prioritize Windows AFD.sys risk review and recruiter-lure defenses at defense and aerospace organizations, particularly in Brazil, France, Germany, and India. Lazarus Group exploited an AFD.sys zero-day in Operation Dream Job and used recruiter-themed lures to deploy the Troy in-memory backdoor.