CYBER THREATCAST

Patch or mitigate CVE-2026-109618 and CVE-2026-109619 immediately across internet-facing PHP systems, including WordPress, Drupal, and Joomla deployments, and examine them for compromise. Both flaws permit unauthenticated remote code execution with CVSS v4.0 scores of 9.2, and Amazon MadPot observed attempted exploitation four days before patches became available.

Upgrade Nextcloud’s Development Edition Built-in CODE Server to 26.4.303 or later, then search for and remove residual shx*.php web shells. CVE-2026-110447 is in CISA’s KEV catalog, and attackers have exploited it to deploy web shells, access configuration secrets, and search for credentials and cryptocurrency wallets. Standalone Collabora servers are not affected.

Remove LiteLLM 1.107.0 from every environment, including PyPI installations and official Docker Hub or GHCR images, and investigate hosts for credential theft or second-stage payloads. All seven PyPI wheels and corresponding official container images were reportedly malicious, carrying the privcollect credential stealer and a remote loader after attackers compromised the release pipeline.

Complete Microsoft’s additional Secure Boot certificate-revocation mitigation for CVE-2022-21894 rather than relying on routine Windows patch status alone. BlackX exploits the flaw before Windows security controls start, and fully patched systems remained exposed where administrators had not completed the revocation step. Diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan were targeted, with Kaspersky linking the campaign to APT41 at medium confidence.

Upgrade affected Node.js installations to a fixed release and identify applications using Brotli versions 1.0.3 through 1.2.0. Crafted compressed content can trigger an out-of-bounds write, causing memory corruption and potentially remote code execution. Check Point customers should also install the latest IPS update, enable the named protection, and deploy the updated policy; no in-the-wild exploitation was reported.