CYBER THREATCAST

Upgrade Ray deployments to version 2.52.0 or later immediately. CISA has confirmed active exploitation of critical remote-code-execution vulnerability CVE-2025-62593 and added it to the KEV catalog; every Ray version before 2.52.0 is affected.

Update MLflow to version 3.15.0 or later now. Attackers are exploiting unauthenticated SSRF vulnerability CVE-2026-64849 in earlier releases, and successful attacks can expose internal systems or cloud metadata services through unsafe redirects and hostname resolution.

Apply GitLab’s fixed releases to exposed self-managed Community Edition and Enterprise Edition instances without delay. Honeypots have detected exploitation attempts against CVE-2026-19478, an unauthenticated GraphQL code-injection flaw that can modify or delete public projects and user data.

Patch Kubernetes ingress-nginx against CVE-2026-4342 and identify who can create or modify Ingress objects. Crafted annotations can inject raw NGINX directives, potentially enabling code execution in the controller pod and disclosure of accessible Kubernetes Secrets; the project was archived on March 24, 2026, and many production deployments reportedly remain unpatched.

Warn Microsoft Teams users to reject unsolicited MSI installers sent by purported internal IT staff and investigate such messages promptly. SynkLoader operators use this pretext to install malware that presents a fake Windows lock screen for credential theft, executes arbitrary Python, and provides tunneling and interactive access.