CYBER THREATCAST

Upgrade Bricksforge to 3.1.8.10 or 4.0.1 immediately, then inspect the temporary upload directory for PHP files. Attackers are actively exploiting CVE-2026-85097 to upload arbitrary files without authentication against WordPress sites running Bricksforge 3.1.8.9 and earlier; observed requests vary extensions, encodings, and infrastructure.

Apply Citrix’s emergency fixes for CVE-2026-88771 and CVE-2026-88772, then investigate NetScaler ADC and Gateway appliances for persistence rather than treating patching as sufficient. Attackers are exploiting both flaws for remote code execution and deploying a modified Platypus remote-access payload disguised as a Perl file; CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog.

Treat Ahsay Cloud Backup Server deployments through version 10.3.4 as potentially exposed and investigate them for JSP webshells and persistent XMRig miners. Attackers are chaining CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute commands as NT AUTHORITY\SYSTEM. Because reports conflict with earlier guidance that 10.3.4 was fixed, administrators should not assume that version is safe without updated confirmation.

Patch exposed SonicWall SMA 1000 appliances for CVE-2026-102255 immediately and review available telemetry for exploitation attempts. Defused Cyber and Previdian observed 135 attempts against the unauthenticated SSRF flaw in the WorkPlace interface, beginning within two days of disclosure and patch availability. No production compromise was confirmed, but the rapid targeting leaves little margin for delayed remediation.

Complete Microsoft’s available ToolShell remediation on SharePoint systems and verify that earlier fixes were applied fully. China-linked Warlock ransomware operators reportedly exploited the ToolShell chain to breach at least four organizations in water, telecommunications, regional government, and higher education. Delayed or incomplete remediation left organizations exposed, and exploitation can lead to ransomware deployment, encryption, and operational disruption.