CYBER THREATCAST

Remediate every Plex Media Server instance older than 1.43.3.10861 immediately and prioritize any internet-facing deployment. Attackers are actively chaining four Plex vulnerabilities to steal administrator tokens, execute elevated code, and install cryptocurrency miners or proxy malware. U.S. federal civilian agencies must also meet CISA’s October 23 remediation deadline.

Upgrade vulnerable PHP runtimes immediately to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart or reload PHP processes so the fixes take effect. CVE-2026-109618 and CVE-2026-109619 can provide unauthenticated remote code execution through a single HTTP request, public PHP2Shell tooling is available, and exploitation attempts are underway. Patch the runtime beneath Drupal, Joomla, Magento, Apache mod_php, FrankenPHP, and LiteSpeed deployments; WAF mitigations do not replace updates, and no generic configuration workaround is available.

Remediate CVE-2026-0257 on PAN-OS GlobalProtect portals, gateways, physical and virtual firewalls, and Prisma Access without delay, then investigate for unauthorized VPN sessions and follow-on credential theft, lateral movement, or data access. Ransomware operators are exploiting insufficient cookie validation to bypass MFA and establish VPN access. Where Veeam Backup & Replication is present, also address CVE-2023-27532 because some operators chained the two flaws before deploying ransomware.

Stop LiteLLM 1.107.0 deployments and affected container tags, isolate and investigate systems that installed the PyPI wheels or pulled the compromised Docker images, and rotate every credential those hosts could access. All seven 1.107.0 wheels and official images contained an information stealer and remote-access payload that polled GitHub for attacker-supplied Python. Treat affected hosts as fully compromised rather than assuming removal or replacement of the package is sufficient.

Patch known exploited vulnerabilities on internet-facing edge devices, VPN infrastructure, firewalls, network-attached storage, and backup servers; require MFA, segment networks, and maintain tested offline backups. SafePay has affected at least 600 organizations and uses credential theft, PsExec, and remote-management tools for lateral movement before exfiltration, encryption, and recovery disruption. Critical-infrastructure operators should prioritize identity controls and separation of backup systems from routinely accessible networks.