CYBER THREATCAST

Upgrade Cisco Secure Email Gateway appliances to a fixed AsyncOS release immediately. CVE-2026-76461 is under active exploitation and allows unauthenticated root command execution; CISA has added it to the Known Exploited Vulnerabilities catalog and set a September 17, 2026 federal remediation deadline.

Update Google Chrome on Windows and verify managed endpoints received the fix for CVE-2026-85046. UTA0560 used the BlueMoon browser-to-kernel chain against NGOs to deploy GRIMWEDGE, while APT31 reportedly used the same chain to install LONGTALE; multiple espionage groups are sharing or rapidly acquiring this capability.

Patch TeamCity on-premises and the affected plugin, then rotate AWS IAM credentials accessible through TeamCity or its backups. CVE-2026-63077 is a CVSS 9.8 unauthenticated remote-code-execution flaw that attackers exploited to access JetBrains Cadence backup data, AWS credentials and Amazon S3 content.

Remove Vite development servers from public exposure and upgrade affected installations to Vite 8.0.5 or later. Attackers are exploiting CVE-2026-39364 through the @fs endpoint to obtain sensitive files; F5 observed more than 800 attacks and roughly 32,000 events in one month, with AWS, Azure, Terraform and Serverless secrets at risk.

Take programmable logic controllers off the public internet and review exposed ICS and OT systems for changed credentials, altered addresses, disabled devices or valve manipulation. An active global campaign is targeting internet-exposed PLCs, and observed incidents have caused device lockouts, boil-water advisories, manual operations and limited municipal water-distribution effects.