CYBER THREATCAST

WordPress administrators should immediately install version 7.1.2 or the corresponding backport, then conduct forensic review of any site that was exposed while unpatched. CVE-2026-87902 is in CISA’s KEV catalog and attackers have used it to attempt PHP-file writes and establish persistence. Updating blocks new exploitation but does not remove malicious files, accounts, or persistence already created; potentially compromised sites may require a clean rebuild.

Oracle PeopleSoft operators should apply the critical fix for CVE-2026-35273 and verify that third-party service providers have patched every managed instance. An unpatched, contractor-managed PeopleSoft ERP platform enabled an intrusion affecting thousands of FBI employees, showing why customers must independently validate remediation rather than assume outsourced systems are current. Organizations with delayed patching should assess affected platforms for unauthorized access.

AhsayCBS administrators should restrict the management interface to trusted IP addresses and investigate exposed servers for compromise now. Attackers are chaining CVE-2026-105133 and CVE-2026-105134 to bypass authentication, execute OS commands, deploy JSP webshells and XMRig, and persist through MicrosoftEdgeUpdateSvc using a modified NSSM utility. Do not treat version 10.3.4 as safe: researchers report that it remains affected.

Palo Alto Networks customers should upgrade affected GlobalProtect portals and gateways and disable authentication override cookies wherever they are unnecessary. Qilin and Settra ransomware actors are reportedly exploiting CVE-2026-0257 in affected PAN-OS and Prisma Access configurations to create unauthorized VPN sessions without valid credentials. Review affected environments for credential theft, reconnaissance, lateral movement, Cobalt Strike deployment, and ransomware preparation.

Organizations running internet-exposed LiteLLM, Ollama, Gitea, Gotenberg, or Ivanti Sentry services should reduce unnecessary public exposure and investigate them for XMRig, Iron, and scanning activity. The PoeLLM campaign compromised more than 3,400 publicly exposed servers and used infected systems to identify and exploit additional victims. Prioritize remediation of LiteLLM CVE-2026-42271, which attackers likely exploited and CISA reportedly added to its exploited-vulnerabilities catalog.