CYBER THREATCAST

Update macOS Tahoe, Sequoia, and Sonoma immediately and investigate Internet-facing Macs with Screen Sharing enabled for root-level compromise, data theft, and hidden Monero miners. Attackers are actively exploiting CVE-2026-65400, and Apple has released fixes for affected current versions.

Apply SAP’s available Commerce Cloud fixes for CVE-2026-58231 without delay and examine Internet-exposed deployments for exploitation attempts. The flaw permits unauthenticated arbitrary code execution, a public proof of concept is available, and honeypots detected attempts just three days after patches appeared.

Investigate VMware vCenter systems for exploitation of CVE-2026-59309 and CVE-2026-59310, including unauthorized administrator-account creation and Babuk-derived ransomware activity. A suspected China-nexus actor exploited CVE-2026-59310 five days after disclosure, while the campaign affected an estimated 361 IP addresses across 47 countries.

Patch Adobe Commerce, Adobe Commerce B2B, and Magento Open Source for CVE-2026-71362, then conduct a historical compromise investigation rather than treating the update as remediation by itself. Attackers are exploiting the remotely accessible flaw without authentication or user interaction, and patching does not remove an existing intrusion.

Replace seed phrases generated on affected Coldcard firmware and migrate funds immediately to wallets created with secure replacement seeds. The predictable seed-generation flaw reportedly enabled theft of more than 1,778 Bitcoin from over 8,600 addresses; affected versions include Mk3 firmware from 4.0.1 to before 4.2.0 and Mk4/Mk5 firmware before 5.6.0.