CYBER THREATCAST

Remove Langflow through version 1.4.2 from internet exposure immediately, restrict access to its validate endpoint, and investigate for unauthorized Python execution or access to environment variables and sensitive files. Organizations operating exposed instances should rotate application, AI-service and cloud secrets and review SSH access because attackers are actively exploiting CVE-2026-0768, a CVSS 9.8 unauthenticated code-injection flaw.

Install SonicWall’s latest SMA1000 hotfix immediately on 6210, 7210 and 8200v appliances. Treat suspected compromise as an incident: reimage affected appliances and reset associated credentials and TOTP tokens. Attackers are actively exploiting CVE-2026-83548, a CVSS 10 pre-authentication SSRF flaw, and CVE-2026-83549, an authenticated command-injection flaw; the vulnerabilities may be chained.

Patch internet-exposed JFrog Artifactory servers for CVE-2026-82329 immediately, then investigate for newly minted administrator tokens and enumeration of sensitive configurations. Revoke unauthorized administrative tokens discovered during review. Multiple actors are actively exploiting this CVSS 9.8 authentication bypass, and an available public proof of concept could accelerate exploitation.

Update internet-exposed Microsoft Exchange Server deployments to the patched builds covering CVE-2026-62911, prioritizing Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Subscription Edition RTM. Nearly 21,900 exposed servers remain vulnerable, and active exploitation allows attackers to replay authentication traffic and impersonate legitimate users.

Restrict public access to researcher-operated EC2 applications and agent-orchestration dashboards, verify their authentication controls, and rotate exposed model-provider API keys. Review SSH authorized keys for unauthorized persistence and examine AI-credit consumption for abuse. An attacker exploited METR’s public EC2 application, stole an API key, installed an SSH key and consumed approximately $600,000 in AI credits.