CYBER THREATCAST

Patch CVE-2026-12569 in PTC Windchill and FlexPLM immediately, then inspect affected servers for the custom JSP web shell and evidence of credential or file theft. Clop likely exploited the flaw in active data-theft and extortion attacks, and CISA has added it to the KEV catalog.

Mitigate CVE-2026-59310 on VMware vCenter Syslog Server immediately and examine systems for root-owned systemd persistence, cron payloads, and unauthorized ESXi control. Attackers are exploiting the flaw without authentication to execute commands as root, and CISA’s KEV listing confirms exploitation.

Update internet-exposed Macs to Sequoia 15.7.9, Sonoma 14.8.9, or Tahoe 26.6.1 and investigate exposed Screen Sharing services for unauthorized root access or Monero mining. Attackers are exploiting CVE-2026-65400 to authenticate without valid credentials.

Deploy Microsoft’s patch for CVE-2025-60710 across Windows 11 and Windows Server 2025 systems without delay. CISA confirms ransomware groups are exploiting this Windows Task Host privilege-escalation flaw and has added it to the KEV catalog.

Identify and remove LiteLLM PyPI versions 1.82.7 and 1.82.8 from developer systems and CI/CD environments, then investigate every environment where either release executed and replace potentially exposed secrets. The malicious packages reportedly ran malware on every Python invocation and may have exposed thousands of organizations and hundreds of thousands of pipelines.