CYBER THREATCAST

Remove water and wastewater control systems from direct internet exposure, replace weak or default credentials, and remediate CVE-2021-22681 immediately. Attackers compromised systems in more than 30 Minnesota communities and other states, changed credentials and device addresses, locked out operators, and modified ladder logic on at least one system.

Mitigate vulnerable VMware vCenter systems immediately, restrict their internet exposure, and investigate exposed instances for compromise and Babuk-derived ransomware. A suspected China-nexus actor exploited vCenter flaws shortly after disclosure and compromised systems across 47 countries; applicable federal agencies must mitigate by August 21, 2026, or discontinue use if mitigation is unavailable.

Upgrade every Ray deployment older than 2.52.0 and prioritize exposed or network-adjacent development and testing instances. CISA confirmed active exploitation of CVE-2025-62593 and added it to the Known Exploited Vulnerabilities catalog after botnet and cryptocurrency-mining attacks targeted unpatched Ray clusters.

Remediate CVE-2026-72898 on self-hosted Metabase instances, restrict public access until remediation is complete, and review affected systems for unauthorized database activity. The unauthenticated SQL injection flaw has a public proof of concept, appears in CISA’s KEV catalog, and was reportedly exploited in breaches exposing personal data belonging to 253,487 cryptocurrency customers.

Install Microsoft’s patch for CVE-2025-60710 on affected Windows 11 and Windows Server 2025 systems without delay. CISA added the privilege-escalation flaw to its Known Exploited Vulnerabilities catalog after confirming that ransomware gangs actively exploit it.