CYBER THREATCAST

Upgrade Bricksforge immediately to 3.1.8.10 or 4.0.1, then inspect the temporary upload directory for unexpected PHP files. Attackers are actively exploiting CVE-2026-85097, a CVSS 10.0 unauthenticated remote-code-execution flaw affecting versions through 3.1.8.9, by targeting Bricksforge REST and AJAX endpoints.

Apply Palo Alto Networks’ fix for CVE-2026-0257 to every GlobalProtect gateway and investigate unauthorized VPN sessions for evidence of network access. Qilin and Settra ransomware operators are actively exploiting the flaw, exploitation has continued well beyond the patch release, and CISA lists it as a ransomware-associated vulnerability in its KEV catalog.

Remediate Ahsay Cloud Backup Server exposure to CVE-2026-105133 and CVE-2026-105134, verify the applicable fixed release because reported affected-version information conflicts with NVD guidance, and hunt for JSP webshells and persistent XMRig miners. Attackers are chaining the flaws against versions through 10.3.4 to execute commands as NT AUTHORITY\SYSTEM, with Huntress observing five targeted organizations.

Prioritize CISA-required mitigations and forensic triage for the newly listed KEV vulnerabilities affecting ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND. CISA added CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199 and CVE-2023-22894 because of active exploitation; patching alone will not establish whether attackers previously compromised a system.

Remediate CVE-2026-102255 on SonicWall SMA1000 appliances without delay, prioritizing internet-facing 6210, 7210 and 8200v models, and investigate the appliances for unauthorized operations. Researchers observed exploitation attempts only two days after disclosure of this CVSS 10.0 pre-authentication SSRF flaw in the Appliance WorkPlace interface.