CYBER THREATCAST

Identify every Adobe Commerce and Magento Open Source deployment immediately and investigate for malicious PHP execution through GraphQL style properties and report rendering. All current versions were reportedly affected, exploitation was active, and no CVE, official patch, or vendor workaround was available at publication; operators should monitor for vendor remediation and apply it as soon as available.

Prioritize CISA KEV remediation for exposed SonicWall SMA1000, JFrog Artifactory, and Sangoma Switchvox systems, and reduce their internet exposure while patch details and compromise indicators are confirmed. Water-sector operators should also replace default credentials and strengthen segmentation around internet-exposed HMIs and PLCs; CVE-2026-9586 is reportedly remotely reachable without authentication and exploited in the wild.

Update managed Chrome installations to version 152.0.7977.82 or .83 and urgently update other affected Chromium-based browsers. Google patched CVE-2026-85046 after exploitation was observed in the wild; although full system compromise may require an additional sandbox escape, organizations should accelerate browser deployment and verify endpoints received the update.

Upgrade PaperclipAI Paperclip and PaperclipAI/Server to version 2026.416.0 or later, prioritizing network-accessible deployments. CVE-2026-41679 permits unauthenticated remote code execution against default deployments running versions before 2026.416.0.

Test cross-chain bridges for strict message validation, replay protection, collateral reconciliation, and rate limiting before permitting further high-value transfers. Weak validation or monitoring reportedly enabled forged messages, 94 unauthorized Coreum-XRPL withdrawals, 191,156 USDC stolen from Allbridge, and the minting of 14.9 billion unbacked SAND tokens, contributing to about $2.7 million in losses.