CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
CISA added critical SharePoint flaw CVE-2026-55040 to its Known Exploited Vulnerabilities catalog after confirmed attacks, while active exploitation also struck GitLab, MLflow, Ray and Microsoft’s Internet Key Exchange service. The activity puts on-premises collaboration systems, development platforms, cloud credentials and internet-facing VPN infrastructure under immediate pressure.
CVE-2026-55040 lets attackers forge tokens and impersonate SharePoint users or administrators. Microsoft patched the flaw in July, but exploitation followed publication of proof-of-concept code. Administrators should update every server in each SharePoint farm and examine logs for suspicious trusted-user and administrative activity.
Attackers are also applying automation to exposed operational and web infrastructure. US agencies say AI-generated scripts are targeting Siemens S7 PLCs, while UAT-10147 used agentic AI during attacks on Windows and Linux web servers. Operation CameraSwarm compromised more than 14,530 Dahua devices, and Microsoft is urging organizations to hunt for signed vulnerable drivers abused by state and ransomware operators.
Editorial: Recommended Actions
01
PRIORITY
Patch CVE-2026-55040 on every server in on-premises Microsoft SharePoint farms, then review logs for suspicious trusted-user and administrative activity. Attackers are exploiting the authentication flaw to forge tokens and impersonate users or administrators, and CISA has added it to the Known Exploited Vulnerabilities catalog.
02
PRIORITY
Upgrade self-managed GitLab immediately to 19.2.4, 19.1.6, 19.0.8, 18.11.11, or a later fixed release, and inspect logs for @gl_introduced requests. Attackers began exploiting unauthenticated code-injection flaw CVE-2026-19478 roughly two days after disclosure and can alter or delete public projects, forge merge records, ban maintainers, and rewrite repository state.
03
PRIORITY
Upgrade MLflow deployments running versions earlier than 3.15.0 and investigate exposed environments for stolen cloud credentials or secrets. Attackers are actively exploiting SSRF vulnerability CVE-2026-64849 to obtain temporary cloud credentials and secrets, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
04
PRIORITY
Patch Citrix NetScaler ADC and Gateway systems affected by CVE-2025-5777, then invalidate potentially stolen sessions and credentials rather than treating patching as complete remediation. Anubis reportedly exploited the flaw at Fairlife, exfiltrated about 1 TB of data, and disrupted U.S. production for 11 days; applying the patch alone does not revoke previously stolen access.
05
PRIORITY
Identify internet-exposed Siemens S7 PLCs and investigate them for unauthorized access, reconnaissance, credential theft, configuration or ladder-logic access, and denial-of-service attempts. U.S. agencies warn that attackers are actively using AI-generated scripts and Snap7 components against S7-1200, S7-1500, S7-200, S7-300, and S7-400 controllers across critical-infrastructure sectors.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents16Messages31mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_