CYBER THREATCAST

Patch BeyondTrust Remote Support through version 26.2.3 immediately, and apply BeyondTrust’s precautionary Privileged Remote Access patch where applicable. Investigate affected environments for privilege escalation, lateral movement, SAWFLY and BARECLAW activity, and artifact deletion. Suspected China-backed attackers exploited CVE-2026-102764 as a zero-day against two customers, and CISA has added it to the Known Exploited Vulnerabilities Catalog.

Upgrade SiteGuard Server Edition or apply the vendor’s replacement-file patch, preserving forensic data before remediation. Prioritize installations protecting Apache, FreeBSD, IIS and Nginx because attackers are actively exploiting CVE-2026-106931; the default-enabled statistics function can permit unauthenticated command execution with root or SYSTEM privileges.

Identify Nextcloud deployments running the built-in Collabora CODE Server app richdocumentscode through version 26.4.302, restrict their exposure, and inspect them for web shells and unauthorized operating-system commands. CVE-2026-110447 is reportedly under active exploitation and can allow unauthenticated command execution as the web-server user. Standalone Collabora servers, Docker or package installations, and Nextcloud All-in-One are reported as unaffected by this specific issue.

Update Apple devices beyond the affected releases: Safari 18.1.1, iOS and iPadOS 17.7.2 or 18.1.1, macOS 15.1.1, and visionOS 2.1.1. Prioritize Intel-based Macs because Apple reported possible active exploitation of CVE-2024-44308. The flaw allows malicious web content to trigger arbitrary code execution; Check Point customers should also install the latest IPS update.

Audit Microsoft Entra ID tenants connected to ConnectWise Cloud Backup or Cloud Management for suspicious sign-ins, elevated privileges, unauthorized application credentials and long-lived secrets. Remove unapproved credentials and enable App Instance Property Lock where applicable. Threat actors allegedly abused a vendor-managed client assertion to access 173 Microsoft 365 tenants; one attacker gained Global Administrator privileges and added persistent application secrets.