CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Pegasus infected a Serbian activist’s iPhone through an in-the-wild zero-click iMessage exploit, Citizen Lab confirmed. Attackers are also chaining two PaperCut NG/MF flaws for unauthenticated code execution, while malicious Composer themes delivered an iOS spyware chain and Elementor Pro exploitation generated more than 190,000 blocked attempts.
The Pegasus attack used the zero-click exploit between December 2025 and January 2026. Apple reportedly patched the vulnerability in iOS 18.4.1, but at least 14 other Serbian civil-society and political figures received threat notifications.
PaperCut, Elementor Pro and Injective show how quickly exposed flaws can become operational crises: unauthenticated code execution, site takeover and a nearly four-hour blockchain halt after a reported $4.9 million theft. PaperCut’s flaws are in CISA’s KEV catalog, Elementor Pro users need version 4.2.2, and Injective validators deployed an emergency patch.
Editorial: Recommended Actions
01
PRIORITY
Update at-risk iPhones to iOS 18.4.1 or later, and prioritize forensic examination of devices whose users received Apple threat notifications. Pegasus infected a Serbian activist through a zero-click iMessage exploit, while at least 14 other Serbian civil-society and political figures received warnings.
02
PRIORITY
Remediate CVE-2026-81578 and CVE-2026-82078 on PaperCut NG and MF systems immediately, prioritizing exposed deployments. Attackers are actively chaining the access-control bypass and unsafe class-loading flaws for unauthenticated remote code execution, and CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog.
03
PRIORITY
Upgrade Elementor Pro to version 4.2.2 and investigate vulnerable WordPress sites for unauthorized PHP uploads or takeover. Attackers are exploiting the unauthenticated file-upload flaw in versions through 4.2.1, and Wordfence recorded more than 190,000 blocked exploitation attempts.
04
PRIORITY
Move Sangoma Switchvox systems to version 8.4.0.2 and inspect relevant logs and network connections for compromise. Attackers are exploiting CVE-2026-9586 to execute commands, attempt reverse shells, enumerate processes, and exfiltrate encoded data; approximately 4,000 Switchvox systems are internet-exposed.
05
PRIORITY
Install the latest SonicWall SMA1000 hotfix immediately. If compromise is suspected, re-image the appliance and reset credentials and TOTP tokens. Attackers are actively chaining CVE-2026-83548, a pre-authentication SSRF flaw rated CVSS 10, with CVE-2026-83549 command injection to achieve remote code execution.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents14Messages20mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_