CYBER THREATCAST

Update TrueConf Server 5.3.x to 5.3.9, 5.4.x to 5.4.9, and 5.5.x to 5.5.5 or later, and restrict access to TCP port 4307 until remediation is complete. CVE-2026-72530 allows an unauthenticated attacker with network access to that port to execute arbitrary code through a crafted script. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a September 3, 2026 remediation deadline.

Install Dahua’s firmware fixes, replace weak or default credentials, and inspect cameras and network video recorders for unauthorized persistent accounts. Operation CameraSwarm compromised more than 14,530 Dahua devices through CVE-2021-33044, CVE-2021-33045, credentials, and Easy4IP peer-to-peer relaying; operators should also review whether Easy4IP permits access to devices behind firewalls or NAT.

Identify projects and build hosts that compiled the three poisoned Rust crate releases, then quarantine and investigate systems containing the implicated lockfile entries or artifacts. Treat those developer workstations and CI runners as compromised: the malicious typosquatted dependency executed during Cargo builds and downloaded cross-platform payloads after a compromised maintainer account poisoned legitimate releases.

Audit npm dependencies and publishing accounts for ChainDrop activity, revoke affected publishing access, and rotate package, cloud, Kubernetes, and Vault credentials exposed on infected developer or CI/CD systems. The worm searches these environments for credentials and uses valid npm publishing access to modify and republish packages; reports attribute 444 affected packages and about two billion monthly downloads to the campaign.

Remove Siemens S7 PLCs from direct internet exposure and investigate exposed S7-1200, S7-1500 F-series, S7-200, S7-300, and S7-400 systems for reconnaissance or exploitation attempts. U.S. agencies warn that attackers are actively scanning critical-infrastructure facilities and using AI-generated exploitation scripts, including scripts disguised as monitoring tools, to target internet-accessible Siemens controllers.