CYBER THREATCAST

Install Citrix’s fixed NetScaler releases immediately and inspect every SAML-enabled ADC and Gateway deployment for compromise. Attackers are actively exploiting CVE-2026-88779, and reported activity includes remote access, web shells, tunneling malware, credential theft and network pivoting. Review SAML configuration and investigate crafted usernames containing shell-command strings, while recognizing that those strings alone do not confirm remote code execution.

Identify FortiMail appliances running 7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6 or 8.0.0–8.0.1 and treat them as immediate remediation and incident-response priorities. Attackers are actively exploiting CVE-2026-104286, a CVSS 9.8 flaw that permits unauthenticated arbitrary file writes through crafted HTTP or HTTPS requests. Examine affected appliances for unauthorized files, persistence and malware that could indicate broader compromise.

Patch Rejetto HTTP File Server 3.0.0 through 3.2.0 without delay and investigate affected systems for forged administrator sessions or use of server_code functionality. CVE-2026-61500 can expose session-signing keys, enable administrator impersonation and be chained to remote code execution. A China-linked actor reportedly exploited the flaw within one day of disclosure, and public proof-of-concept code is available.

Audit GitLab environments for exposed credentials and secrets, revoke or rotate anything that could provide production access, and examine associated systems for unauthorized database activity. Azazel reportedly used exposed GitLab credentials and secrets to breach more than two dozen organizations across six countries, then stole terabytes of data, deleted production records and left ransom messages. AI, government-linked, insurance, logistics, medical-device and pharmaceutical organizations should prioritize this review.

Block the eight npm packages associated with MALFEX, identify systems that installed them, and isolate affected Windows hosts. Remove any resulting persistence and rotate credentials exposed on those systems. The packages accumulated more than 40,000 downloads and delivered payloads including Overlord RAT and the movinlike information stealer; incomplete advisory coverage means package and version checks should not rely on a single advisory source.