CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Attackers are exploiting critical unauthenticated SQL injection in Sangoma Switchvox, while Google has patched an actively exploited Chrome V8 zero-day. A reported SQL-injection breach at ShipMonk also exposed retained order records for roughly 80,000 Trezor customers, although wallets and recovery secrets were unaffected.
CVE-2026-9586 allows a crafted unauthenticated request to execute arbitrary SQL in Switchvox and may lead to remote code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog and imposed an accelerated remediation deadline on federal agencies.
The exposure extends beyond conventional enterprise software. An attacker stole about $1.73 million from Notional Finance’s legacy V1 escrow contract, while at least 14 Serbian students, activists and politicians were targeted with Pegasus through a zero-click iMessage exploit patched in iOS 18.4.1.
Editorial: Recommended Actions
01
PRIORITY
Sangoma Switchvox administrators should remediate CVE-2026-9586 immediately and investigate exposed systems for compromise. Attackers are actively exploiting this critical unauthenticated SQL-injection flaw, which can execute arbitrary SQL and may lead to remote code execution; CISA has added it to the KEV Catalog and requires rapid federal remediation.
02
PRIORITY
Google Chrome and Chromium-based browser administrators should deploy the latest stable-channel security update immediately. Attackers are exploiting V8 flaw CVE-2026-85046, and a malicious webpage may gain arbitrary heap access and execute native code inside the Chrome sandbox; CISA has added the vulnerability to its KEV Catalog.
03
PRIORITY
Citrix NetScaler operators should upgrade affected Gateway, AAA, CVPN, ICA Proxy, RDP Proxy, and SSL VPN deployments to fixed builds now. Requests matching proof-of-concept exploitation of critical authentication-bypass flaw CVE-2026-19490 have been observed from multiple countries, although successful production compromise has not been confirmed.
04
PRIORITY
Elementor Pro administrators should update installations through version 4.2.1 to version 4.2.2 immediately and examine servers for uploaded PHP webshells. Attackers are exploiting CVE-2026-32475 to bypass upload controls and achieve remote code execution, and Wordfence reportedly blocked nearly 200,000 attempts.
05
PRIORITY
Langflow operators should identify version 1.4.2 deployments, remove them from untrusted network access, and investigate exposed instances for command execution or filesystem access. CVE-2026-0768 allegedly passes attacker-supplied Python to exec() without adequate sandboxing, enabling unauthenticated remote code execution; observed activity reportedly escalated to continuous multi-source scanning.
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_