CYBER THREATCAST

Remediate or isolate PaperCut NG/MF 24.x through 26.x immediately, prioritizing internet-accessible servers. CVE-2026-81578 and CVE-2026-82078 form an actively exploited, unauthenticated RCE chain that can deliver SYSTEM access. Hunt affected hosts for discovery commands, in-memory payloads, remote-access tooling, and attempts to conceal forensic artifacts; treat suspicious systems as potentially compromised.

Identify exposed Ruby on Rails and Langflow systems vulnerable to CVE-2026-66066 and remediate them urgently. Attackers are reading sensitive files and seeking cloud credentials and SSH data, while a Marshal-deserialization RCE path reportedly remains possible on Rails 8.1.3.1 when an attacker has a valid signature. Review affected systems for remote-access, proxy, and cryptomining tools.

Patch exposed VMware vCenter Server Appliances against CVE-2026-59309 and CVE-2026-59310 immediately, or remove them from external reach until remediated. The flaws enable authentication bypass and unauthenticated root-level code execution, and incident responders have already observed exploitation followed by Babuk ransomware deployment. Investigate exposed appliances for signs of unauthorized root access and ransomware activity.

Remove the 13 malicious Composer website-theme packages from Laravel environments and investigate affected sites for unauthorized redirects or delivery activity. Ensure iPhones accessing those sites are protected against CVE-2025-31277 and CVE-2025-43529. The campaign turns compromised sites into infrastructure for spyware, ad fraud, and wallet-seed theft, potentially exposing keychain data and cryptocurrency recovery seeds.

Patch and audit internet-facing applications, edge devices, and IoT infrastructure for QTFY activity, then isolate critical systems and hunt using the agencies’ published indicators. The China-linked operators exploit zero-day and known vulnerabilities, steal legitimate credentials, and use QScan, QTRouter, and compromised IoT devices to conceal traffic and maintain access. U.S. and foreign organizations across multiple sectors are affected.