CYBER THREATCAST

Patch self-managed GitLab Community Edition and Enterprise Edition against CVE-2026-85706 immediately, then inspect logs and perform forensic triage for arbitrary server-file access. Rotate any secrets that may have been exposed. CISA added the unauthenticated path-traversal flaw to its KEV catalog after active exploitation was observed.

Deploy the available Chrome and Windows fixes for CVE-2026-85046, CVE-2026-85880, and CVE-2026-87491. China-linked actors chained Chrome V8 exploitation, a sandbox escape, and Windows privilege escalation to compromise targeted hosts, with victims redirected through compromised university websites and reflected XSS.

Investigate Cisco Secure Firewall Management Center and cloud-delivered Firewall Management Center deployments for root or credential-based access, web shells, reverse shells, credential theft, configuration theft, and Cyclops Blink persistence. Remediate CVE-2026-20316 and the associated actively exploited firewall-management flaw as a priority.

Patch internet-facing Citrix NetScaler ADC and NetScaler Gateway appliances against CVE-2026-19490 and investigate them for compromise. The reportedly exploited flaw allows remote, unauthenticated authentication bypass, placing exposed remote-access appliances at immediate risk of initial access.

Audit GitHub Actions workflows, npm and PyPI dependencies, and developer extensions for unauthorized releases or credential access, including Nx Console VS Code extension 18.95.0 and packages associated with TanStack, UiPath, Mistral AI, and Guardrails AI. Investigate CI/CD credential exposure and stolen OIDC tokens; coordinated attacks used these channels to publish malicious components, steal credentials, install a macOS backdoor, and reportedly exfiltrate about 3,800 GitHub repositories.