CYBER THREATCAST

Remediate CVE-2026-81578 and CVE-2026-82078 on PaperCut MF and PaperCut NG immediately, then investigate exposed servers for prior compromise. Attackers are actively chaining the flaws to extract database tables, pivot through networks, execute discovery commands, deploy in-memory payloads and remote-access tools, and conceal forensic evidence; a Metasploit module makes exploitation repeatable.

Remediate CVE-2026-82329 on every internet-accessible JFrog Artifactory instance and review administrative-token issuance and sensitive configuration access for signs of abuse. Attackers are exploiting the authentication bypass against exposed systems to obtain unauthenticated administrative access under default configurations, mint administrator tokens and enumerate configuration data.

Treat every Virtualizor host as potentially exposed and investigate for a malicious update with root-level execution. Attackers hijacked routes to Softaculous infrastructure between August 28 and 30, obtained a valid TLS certificate and served a cloned site; confirmed installations received the malicious update, and the number affected remains unknown. Include possible payment-information exposure in the assessment.

Patch internet-exposed Langflow 1.4.2 and earlier against CVE-2026-0768, then investigate whether attackers accessed or stole secrets. The actively exploited flaw permits unauthenticated Python execution as root, and observed payloads searched for Langflow credentials, OpenAI API keys, AWS secrets, SSH access and shell history.

Audit Laravel and Composer deployments for the 13 trojanized website-theme packages and remove affected dependencies; ensure iPhones that may visit compromised sites are updated against CVE-2025-31277 and CVE-2025-43529. Injected JavaScript delivered redirects, ad fraud and an iOS exploit chain capable of exposing keychain data, cryptocurrency wallet recovery seeds and other private information.