CYBER THREATCAST

Remediate the seven vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog, prioritizing internet-exposed SonicWall SMA 1000 and Sangoma Switchvox systems. Isolate affected devices that cannot be fixed immediately and investigate for reverse shells, administrator-token creation, cryptomining, credential access, and possible Qilin ransomware activity.

Upgrade Elementor Pro to version 4.2.2 or later and inspect WordPress upload directories for PHP files. CVE-2026-32475 affects version 4.2.1 and earlier on sites using an Elementor Pro Form widget with a File Upload field; attackers can bypass validation, upload executable PHP, and run commands on the server.

Deploy Google's Chrome update for CVE-2026-85046 across managed endpoints and verify that browsers have received the patched release. The severe V8 type-confusion vulnerability is reportedly under active exploitation, making delayed or incomplete browser updates an immediate risk to Chrome users.

Patch FortiOS and FortiProxy against CVE-2024-55591 and invalidate compromised Fortinet VPN credentials immediately. Investigate affected environments for data exfiltration, disabled defenses, and backup sabotage, because Gentlemen ransomware affiliates can move from initial access to organization-wide encryption in under 24 hours.

Remove programmable logic controllers and other operational-technology devices from direct internet exposure, replace weak or default credentials, and secure remote-access paths. U.S. water, energy, and telecommunications operators using Rockwell Automation, Schneider Electric, or Siemens PLCs should act now: CISA says Iranian actors are targeting exposed devices and industrial controllers.