CYBER THREATCAST

Upgrade Atlassian self-hosted Data Center products affected by CVE-2026-21589 to a fixed release immediately, prioritizing internet-facing systems and checking them for exploitation. Attempts appeared within two hours of public proof-of-concept publication, leaving organizations running affected on-premises products little time to respond. Atlassian Cloud customers were automatically patched.

Secure Zammad deployments against CVE-2026-102489 and CVE-2026-102490 now: invalidate active sessions, review WebSocket activity and package installations, and investigate administrator accounts for hijacking. The vulnerabilities were reportedly exploited in the DIVD breach; together they can expose session cookies and turn a stolen administrator session into remote code execution and complete server takeover.

Install Citrix’s emergency updates for NetScaler ADC and NetScaler Gateway vulnerabilities CVE-2026-88771 and CVE-2026-88772, then investigate appliances for prior compromise and credential exposure. Attackers are actively exploiting both flaws, exfiltrating configuration data, deleting artifacts and using compromised appliances as tunnels into internal networks; patching alone will not establish that an appliance was not previously breached.

Audit internet-facing Fortinet FortiGate and SSL VPN devices for FortiBleed activity, revoke exposed tokens, reset affected credentials and inspect administrator-account changes. The campaign remains active and reportedly compromised more than 86,644 devices across 194 countries through credential stuffing, password spraying and stolen credentials—not a new Fortinet vulnerability—so patch status alone does not address the threat.

Install Apple’s protective iOS updates on supported iPhones immediately, including affected older iOS branches, and prioritize devices used for cryptocurrency wallets. DarkSword/Coruna operators used watering-hole activity to compromise iPhones and search wallet apps, Photos and Notes for BIP39 recovery phrases. Users who suspect compromise should move assets to a wallet protected by a new recovery phrase rather than continuing to trust secrets stored on the affected device.