CYBER THREATCAST

Update or replace Brotli 1.0.3 through 1.2.0 immediately, including copies embedded in Node.js, Bun, .NET, Adobe Commerce, and Apache Arrow deployments. Prioritize internet-exposed Node.js systems and services that process attacker-controlled compressed data, then investigate crashes or anomalous decoder behavior. CVE-2026-111497 and CVE-2026-48356 can corrupt or disclose process memory and potentially enable remote code execution, and CISA has added both flaws to its Known Exploited Vulnerabilities catalog.

Patch affected PHP installations immediately, prioritizing internet-facing Apache mod_php, FrankenPHP, and LiteSpeed deployments. Inventory PHP 8.2 releases before 8.2.35 and PHP 8.3 releases before 8.3.36, and examine exposed servers for compromise rather than treating patching alone as sufficient. CISA confirmed active exploitation of CVE-2026-109618 and CVE-2026-109619, added both to KEV, and directed U.S. civilian federal agencies to remediate within three days; attackers have already compromised 25 servers.

Apply Oracle’s out-of-band fix for CVE-2026-35273 to PeopleSoft Enterprise PeopleTools 8.61 and 8.62 without waiting for a routine maintenance window. Review affected systems for unauthorized activity dating from May 27, when ShinyHunters began exploiting the three-flaw chain as a zero-day. The vulnerability enables unauthenticated remote code execution, has been added to CISA’s KEV catalog, and affects organizations in government, healthcare, technology, transportation, and higher education.

Audit npm dependency trees and OIDC-based publishing workflows for Shai-Hulud activity, including malicious transitive dependencies and unexpected lifecycle-hook execution. Treat affected build or developer environments as credential-exposure incidents: investigate access to SSH keys, GitHub and npm tokens, cloud credentials, Kubernetes credentials, and wallet data, then rotate exposed secrets. Do not rely solely on package provenance or an existing SBOM, because attackers published malicious packages through a legitimate TanStack workflow with authentic provenance and an outdated SBOM incorrectly showed one environment as clean.

Remove publicly exposed Cairn AI penetration-testing panels from internet access and require authentication before restoring service. Operators should inspect associated Linux hosts for unauthorized SSH keys, encoded scripts, API-credential searches, and the Poseidon remote-access trojan, then rotate credentials accessible to compromised agents. Attackers injected malicious tasks into at least 17 exposed panels, gaining code execution and persistent access to defensive infrastructure used by red teams and capture-the-flag environments.