CYBER THREATCAST

Patch CVE-2026-0257 on Palo Alto Networks PAN-OS and Prisma Access immediately, prioritizing internet-exposed GlobalProtect gateways and portals. Qilin, INC and Settra ransomware operations are actively exploiting the flaw to bypass authentication and MFA, establish unauthorized VPN access and deploy ransomware; CISA has added it to the Known Exploited Vulnerabilities Catalog.

Remove OVHcloud CLI versions 0.11.0 through 0.15.0, install clean version 0.16.0 and rotate developer secrets potentially exposed on systems that executed the affected binaries. Attackers compromised an OVHcloud developer GitHub account and replaced official release archives with information-stealing malware for macOS, Linux and Windows.

Patch internet-facing Veeam Backup & Replication and SonicWall systems and strengthen controls around VPN and other remote access. SafePay operators have compromised at least 600 organizations using exposed flaws and other access methods, then stolen data, encrypted systems and sabotaged backup and recovery infrastructure; CVE-2024-40711 in Veeam is a critical unauthenticated remote-code-execution flaw rated CVSS 9.8.

Apply Ivanti's patch for CVE-2026-104935 and investigate Connect Secure appliances for compromise. UTA0576 is actively exploiting the flaw to bypass authentication and execute code without credentials or user interaction, reportedly chaining it with a privilege-escalation flaw for root access while using in-memory execution and anti-forensic techniques.

Disconnect internet-exposed Copeland/Dixell Xweb and Danfoss AK-SC or AK-SM refrigeration controllers, or restrict their network exposure with strict filtering as CERT-FR advises. Attackers compromised controllers at hundreds of French supermarkets, in some cases forcing continuous 50°C defrost cycles and causing major food losses; prosecutors reported roughly 700 victims.