CYBER THREATCAST

Apply Cisco and SonicWall’s emergency fixes for CVE-2026-76504 and CVE-2026-102255 immediately, prioritizing internet-facing Cisco Catalyst SD-WAN Manager and SonicWall SMA 1000 deployments. Cisco confirmed exploitation of CVE-2026-76504 before patch availability, and the flaw can give an unauthenticated attacker administrator-level access; CVE-2026-102255 is a pre-authentication SSRF vulnerability requiring the available hotfix. Investigate affected perimeter systems for compromise because either flaw could provide an entry point for enterprise-network intrusion and follow-on attacks.

Upgrade Ahsay Cloud Backup Server to the vendor-fixed release, restrict exposed AhsayCBS interfaces, and investigate deployments running through version 10.3.4. Attackers are chaining CVE-2026-105133 and CVE-2026-105134 to deploy JSP web shells without authentication and execute commands as NT AUTHORITY\SYSTEM. Look for XMRig disguised as Microsoft Edge and persistence established through a fraudulent Edge update service on exposed backup servers.

Update affected iPhones to iOS 15.8.7, 16.7.15, or 18.7.7, as applicable, with particular urgency for users in Saudi Arabia, Turkey, Malaysia, and Ukraine. P7 DarkSword has been used in attacks against unpatched devices and can spread through malicious advertisements, steal sensitive information, and remotely control compromised iPhones. Organizations supporting high-risk personnel should verify that older iOS systems have received Apple’s protective updates.

Remove or downgrade affected MemTensor and MemoryOS packages, rebuild impacted systems, and rotate potentially exposed npm, PyPI, GitHub, GitLab, AWS, and Vault credentials. Review use of @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25 and MemoryOS 2.0.34; block the reported command-and-control endpoint and inspect dependencies and GitHub Actions workflows for propagation. The poisoned packages reportedly stole credentials and included worm-like code capable of spreading into other packages and workflows.

Identify budget Android devices that may contain compromised firmware, including Cubot KingKong X and Doogee S200 X models, and apply manufacturer corrective patches where available. Do not rely on factory resets: the firmware-level Midnight Mimosa component is unlikely to be removed that way. Organizations managing low-cost or MediaTek-based Android fleets should also review exposure to the 13 related malicious apps distributed through Google Play and consider removing affected devices that cannot receive a corrective update.