CYBER THREATCAST

Patch internet-facing ownCloud systems against CVE-2023-49105 and other outstanding ownCloud vulnerabilities immediately, then investigate affected deployments for unauthorized access and data theft. A Chinese-speaking operator exploited unpatched systems to target Philippine nuclear-sector and naval organizations, with logs indicating that roughly 9 GB may have been stolen from the nuclear organization.

Upgrade PaperCut NG and MF versions 25 and 26 with the emergency patches and investigate every deployment for compromise. The zero-day affects all NG and MF versions and is actively exploited; suspicious pc-app.exe activity and altered server.log files are potential signs of intrusion.

Apply SAP's fix for CVE-2026-58231 to affected SAP Commerce Cloud Data Hub Adapter COM_CLOUD 2211 and 2211-JDK21 deployments without delay. The CVSS 10.0 vulnerability permits unauthenticated remote code execution, and honeypots reportedly detected exploitation attempts three days after the patch became available.

Audit internet-facing applications, patch vulnerable software and firmware, isolate critical systems, and hunt for the published QTFY indicators. China-linked QTFY actors have targeted U.S. and foreign organizations since 2018 using zero-day and known vulnerabilities, stolen credentials, malware platforms, and compromised IoT devices that obscure traffic and maintain access.

Update affected WordPress installations running Avada through 7.16, Fusion Builder through 3.16, GiveWP through 4.16.7.1, Pods through 3.3.9, TranslatePress through 3.3.1, or WPMU DEV Dashboard through 5.0.1. Five critical flaws could enable unauthenticated takeover, privilege escalation, or remote code execution; GiveWP CVE-2026-82222 carries a CVSS score of 10.0.