CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Ivanti’s CVE-2026-104935 is under active attack, with UTA0576 reportedly chaining the Connect Secure authentication bypass to gain root-level command execution and evade integrity checks. CISA added the zero-day to its Known Exploited Vulnerabilities catalog as separate attacks exploited smart-account weaknesses and an Autheo Hyperlane configuration to drain or mint cryptocurrency assets.
Volexity found the Ivanti attackers targeting LAPS passwords and BitLocker recovery keys, then deleting forensic evidence from logs. Ivanti patched the first two flaws in the chain, but a privilege-escalation fix remained pending. Organizations with exposed appliances should upgrade immediately and repeat integrity checks rather than treating a single clean result as conclusive.
CISA also added exploited flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND to its catalog. Elsewhere, Startale accounts could be reinitialized without signatures, weak Safe module permissions exposed a $7.73 million rsETH position, and Autheo’s relayer configuration allegedly enabled 19 million unbacked THEO. Authentication, initialization and module permissions warrant immediate scrutiny.
Editorial: Recommended Actions
01
PRIORITY
Upgrade Ivanti Connect Secure appliances immediately and run the Ivanti Integrity Checker Tool repeatedly. UTA0576 is actively exploiting CVE-2026-104935 in chains that enable unauthenticated root-level command execution and can evade integrity checks. Organizations using affected releases should also investigate access to Active Directory material, including LAPS passwords and BitLocker recovery keys, and account for possible deletion of forensic logs.
02
PRIORITY
Apply Fortinet’s FG-IR-26-175 workaround to FortiMail systems without delay and track the advisory for remediation updates. CVE-2026-104286 is an unauthenticated path-traversal flaw rated CVSS 9.8, was exploited before a patch was available, and is now in CISA’s Known Exploited Vulnerabilities catalog.
03
PRIORITY
Install Microsoft’s October 2026 security updates, prioritizing systems exposed to CVE-2026-96951, and review Microsoft’s deployment guidance. Attackers are actively exploiting the Windows Shell flaw to bypass protections that depend on Mark of the Web, and CISA has added it to the Known Exploited Vulnerabilities catalog.
04
PRIORITY
Identify and remediate CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894 in ProFTPD, ISC BIND, Apache Struts, Strapi, and ONLYOFFICE Docs. CISA added all five to its Known Exploited Vulnerabilities catalog; exploitation may enable unauthorized access, file modification, arbitrary code execution, or denial of service. Critical-infrastructure operators and other internet-facing organizations should prioritize affected deployments.
05
PRIORITY
Assess public Android applications and their backend APIs as a single attack surface: extract exposed endpoints and communication formats from the apps, then test the associated services for SSRF, remote code execution, SQL injection, IDOR, and BOLA. Japanese organizations should prioritize this work because NICT linked app-to-backend techniques to multiple recent intrusions and data leaks; treat indicator matches as leads for investigation, not proof of compromise.
ROUNDTABLE
Expert Panel Discussion
14 AI experts analyzed this briefing across 3 turns of structured debate
14Agents18Messages35mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_