CYBER THREATCAST

Install Cisco’s emergency update for CVE-2026-76504 on every Catalyst SD-WAN Manager deployment immediately; no configuration is unaffected and no workaround is available. Until patching is complete, restrict management access and monitor for suspicious j_security_check requests. Active exploitation can turn a single unauthenticated HTTP request into administrator-level API access, making internet-exposed managers the highest-priority systems.

Update affected iPhones and iPads to iOS or iPadOS 26.7.1 and apply Apple’s related macOS fixes for CVE-2026-86950 immediately. Prioritize devices used by high-risk or specifically targeted personnel: Apple says attackers exploited the CoreGraphics out-of-bounds write in highly targeted attacks, and a malicious visual file—including a PDF containing a crafted TrueType font—can trigger attacker-controlled code execution on unpatched devices.

Remediate CVE-2026-88771 and CVE-2026-88772 on customer-managed NetScaler ADC and Gateway appliances immediately, then investigate them for compromise rather than treating patching as sufficient. Attackers are mass-exploiting unmitigated systems for unauthenticated root-level code execution, changing web-server configurations and installing privileged web shells. Hunt for the sec_monitor superuser, PHP web shells mapped to CSS-like URLs, SLAPSHOT tunneling activity, and access to or exfiltration of /flash/nsconfig.

Medyc healthcare providers should treat the Qbusoft SQL-injection flaw as a confirmed breach path and determine whether their patient data was included in the exfiltrated database archive. Coordinate containment and investigation with Qbusoft, account for service disruption from repeated attacks, and prepare breach-response measures for potentially exposed contact details, PESEL identifiers and medical records. Qbusoft reportedly assumes attackers may be able to recover plaintext from weakly encrypted fields.

Upgrade the JCTables extension for Joomla to version 1.21.1 immediately and identify any deployments running the Free edition through 1.10.31.2. Unauthenticated JSON CRUD endpoints lack adequate authentication, authorization and CSRF controls, while unsafe SQL escaping permits arbitrary database reads and writes. An attacker can chain the flaw to execute code as the web-server user, so exposed installations warrant prompt review for unauthorized database changes.