CYBER THREATCAST

Patch Fortinet FortiGate, FortiOS, and FortiManager systems against CVE-2025-61624 and CVE-2026-102764, then investigate potentially exposed appliances for stolen configurations, root access, and the in-memory PeerStitch implant. UNC5820 used Fortinet vulnerabilities to compromise a telecommunications organization, and CISA added both flaws to its Known Exploited Vulnerabilities catalog; CVE-2026-102764 is reportedly under active exploitation and can support privilege escalation or lateral movement.

Upgrade every internet-facing Plex Media Server to version 1.43.3.10861 or later and examine unpatched hosts for XMRig and myawesomeproxy. Attackers began exploiting the four-vulnerability Plex2Shell chain within 24 hours of public proof-of-concept release, and nearly 49,000 systems were reportedly exposed. Operators of older Plex installations should treat unexplained cryptocurrency-mining or residential-proxy activity as a potential sign of compromise.

Apply Palo Alto Networks’ fix for CVE-2026-0257 to PAN-OS GlobalProtect gateways and portals, and initiate incident response for any successful gateway-connected exploitation event. Qilin- and Inc-associated operators have attempted to exploit the authentication bypass, separate reporting linked activity to Settra ransomware, and successful attacks can establish unauthorized VPN sessions. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.

Deploy SAP’s out-of-band fix for CVE-2025-31324 on NetWeaver Visual Composer 7.50 and inspect the Metadata Uploader endpoint for unauthorized executable uploads or web shells. The CVSS 10.0 flaw permits unauthenticated file upload and remote code execution, has a public proof of concept, and is listed in CISA’s Known Exploited Vulnerabilities catalog. Organizations running the affected component should prioritize compromise assessment alongside patching.

Hunt AOMEI Backupper environments for CROSSROAD and other SHINYROAD payloads, focusing on clients that followed update redirects or executed ZIP files delivered through AOMEI’s servers. UNC7017 altered down_html.ini and Notifycfg.ini on the server side to redirect clients and force malicious package execution during short delivery windows. Because the campaign abused trusted update infrastructure rather than a software vulnerability, vulnerability scanning alone will not identify affected systems.