CYBER THREATCAST

Patch Cisco Secure Firewall Management Center against CVE-2026-20079 immediately, then examine vulnerable deployments for web shells, command executors, reverse shells, and proxies. Active exploitation can give unauthenticated attackers script execution and root access, so organizations with exposed FMC interfaces should treat unpatched systems as potential compromises rather than completing a patch-only response.

Upgrade affected F5 BIG-IP APM branches to patched releases and investigate appliances for compromise before returning them to service. Attackers are exploiting unauthenticated CVE-2025-53521 to inject an in-memory PHP web shell that can evade disk-based integrity scans; patching alone may not remove established access, and compromised appliances may require rebuilding.

Apply Fortinet’s fixes for CVE-2025-25249 to FortiOS and FortiSwitchManager, and inspect affected devices for PivotC2 activity. Attackers scanned more than 30,000 IP addresses and infected 178 devices, demonstrating broad exploitation rather than isolated targeting; organizations operating these products should prioritize both remediation and compromise assessment.

Deploy Google’s Chrome update for CVE-2026-87491 and verify that managed Chromium-based browsers receive the corresponding V8 fix. A crafted HTML page can trigger memory corruption and arbitrary code execution inside the Chrome sandbox, and at least four espionage-oriented groups have used the related BlueMoon exploit chain against government, defense, commercial, and NGO targets.

Inventory PaperCut NG/MF servers, investigate them for exploitation of CVE-2026-81578 and CVE-2026-82078, and contain any compromised systems. Reports link the flaws to at least 440 compromised servers across 395 organizations, with Domain Admin access confirmed at 12 organizations; although claims about hundreds of autonomous AI agents are not independently corroborated, the reported remote-code-execution and domain-compromise outcomes warrant immediate review.