CYBER THREATCAST

Prioritize remediation and compromise assessment for FortiManager, FortiGate, FortiOS, FortiPAM and FortiProxy systems affected by CVE-2024-47575 and CVE-2025-61624. UNC5820 exploited these flaws at a telecommunications managed service provider, stole configuration data covering more than 500 firewalls and deployed the persistent PeerStitch ARM64 implant. Organizations using BeyondTrust Remote Support should also address actively exploited flaws affecting that product; CISA has added CVE-2025-61624 and CVE-2026-102764 to its Known Exploited Vulnerabilities catalog.

Patch affected NetScaler ADC and NetScaler Gateway appliances immediately for CVE-2026-88771 and CVE-2026-88772. CVE-2026-88771 permits unauthenticated command execution, including on default configurations, while CVE-2026-88772 affects deployments using DTLS; Citrix has reported active exploitation. Restrict appliance access, inspect traffic with a web application firewall and prevent direct connections to origin systems as additional safeguards.

Remediate CVE-2026-0257 on PAN-OS GlobalProtect portals and gateways, then review gateway-connected events for unauthorized VPN sessions. Treat successful suspicious connections as potential compromises and initiate incident response. Qilin, Inc and Settra ransomware activity has been associated with exploitation that bypasses authentication and may bypass MFA, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

Restore affected WordPress sites from clean backups and rotate credentials if Rank Math PRO was installed or updated on October 15–16, 2026. Replace compromised version 3.0.123 with clean version 3.0.124, but do not treat that upgrade alone as remediation: the backdoor can restore itself, and malicious accounts or persistence artifacts may remain after installation of the clean release.

Patch every internet-accessible Plex Media Server to version 1.43.3.10861 or later and investigate exposed, unpatched systems for compromise. Attackers began exploiting the four-vulnerability Plex2Shell chain roughly one day after proof-of-concept publication, using unauthenticated remote code execution to deploy XMRig miners and residential reverse-proxy software. Check the Plex Codecs folder for persistent payloads associated with observed attacks.