CYBER THREATCAST

GitLab operators should immediately upgrade installations affected by CVE-2026-85706: GitLab 19.2 before 19.2.6, 19.3 before 19.3.2, and Community or Enterprise Edition 18.7 through versions before 19.1.8. Investigate exposed instances for crafted HTTP requests and unauthorized file access; the path-traversal flaw permits unauthenticated arbitrary file reads and was exploited within 24 hours of disclosure.

Cisco Secure Firewall Management Center administrators should urgently address CVE-2026-20079 and CVE-2026-20316, restrict management access, and investigate affected systems for root or credential-based access. Hunt for web shells, malicious JAR executors, reverse-shell tooling, and Cyclops Blink variants; Cisco reports exploitation associated with Sandworm, a Qilin operator, and another intrusion group.

Apply Check Point’s September 9 fixes for VPN vulnerabilities CVE-2026-85102 and CVE-2026-85103 before anticipated exploitation, and prioritize remediation of CISA-listed flaws affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. Examine exposed systems for administrative takeover, backdoors, malicious VBScript execution, and unauthorized router control.

Defense-sector organizations should deploy Microsoft’s August 2026 cumulative updates for Windows CVE-2026-68820 and hunt for the updated FudModule rootkit. Review Windows AFD.sys exploitation paths involving both CVE-2026-68820 and the earlier CVE-2024-38193, accounting for the reported five-week period in which the Lazarus operation evaded detection.

Symbiosis liquidity providers and syBTC holders should pause new BridgeV2 exposure and reconcile token balances against backing before resuming activity. A malicious BridgeV2 receive operation minted roughly 46.1 billion unbacked syBTC; Symbiosis recovered about 15 BTC, but total losses, attacker addresses, reimbursement timing, and compensation criteria were not published.