CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
China-nexus actors are exploiting VMware, PHP and Linux vulnerability chains while abusing Microsoft 365 identities and rooting firewalls. CISA added the VMware ESX and Linux flaws to its Known Exploited Vulnerabilities catalog; separate active exploitation also affects GitLab, Cisco firewalls and Drupal Commerce Core.
A custom PHP2Shell chain compromised 25 servers, while a separate chain combining PHP2Shell with Fragnesia rooted 25 firewalls. The attackers accessed Active Directory and LDAP credentials and deployed BRICKSTORM and SharpStorm, showing how quickly exploitation of exposed infrastructure can extend into identity systems and persistent access.
Cisco Talos also reports China-linked telecommunications espionage involving CVE-2023-20198, alongside more ransomware and help-desk impersonation. Coruna operators are serving iOS exploit chains through hundreds of domains, while Drupal merchants face an actively exploited authorization bypass. Internet-facing gateways, mobile devices, cloud identities and commerce platforms warrant immediate attention.
Editorial: Recommended Actions
01
PRIORITY
Remediate CVE-2026-109618, CVE-2026-109619, CVE-2026-41709, and CVE-2026-46300 immediately, prioritizing affected VMware, Apache mod_php, Linux kernel, FortiGate, and internet-exposed Palo Alto Networks environments. China-nexus actors are actively chaining vulnerabilities to deploy BRICKSTORM and SharpStorm, gain root access, and reach Active Directory and LDAP credentials. Investigate affected systems for compromise and reset credentials shown to have been accessed.
02
PRIORITY
Install fixed releases for CVE-2026-76418 and CVE-2026-97229 across GitLab, Cisco Adaptive Security Appliance, and Cisco Firepower Threat Defense deployments. Verify that custom GitLab installations use a patched Ruby build; an application upgrade alone may leave them vulnerable. If Cisco updates cannot be applied immediately, temporarily disable secondary authentication on affected tunnel groups, as recommended, because crafted unauthenticated VPN requests can reload appliances and cause denial of service.
03
PRIORITY
Upgrade affected Drupal Commerce Core installations to Commerce Core 3.3.13 or 8.x-2.41, as applicable, without delay. Attackers are actively exploiting CVE-2026-118539 to bypass authorization, potentially exposing protected functionality or data and causing financial harm to Drupal Commerce merchants.
04
PRIORITY
Audit GitHub Actions workflows for paths that pass untrusted GitHub content into shell commands, and revoke or rotate credentials available to any job that executed attacker-controlled input. An attacker used 74 likely compromised GitHub accounts in at least 83 coordinated attempts against 61 public repositories, achieved command execution in two automation environments, and attempted credential theft. Repository owners should treat unexpected workflow execution as a potential CI/CD credential exposure.
05
PRIORITY
Deploy Apple security updates to vulnerable iPhones immediately, including supported devices that cannot upgrade to iOS 26, and remove unpatched devices from sensitive banking, cryptocurrency, and Telegram workflows. Coruna and DarkSword exploit chains are reportedly active across 608 domains; a DarkSword-derived chain targeting iOS 18.6.2 can escape Safari and media-process boundaries and steal Apple Notes and Telegram authentication data.
ROUNDTABLE
Expert Panel Discussion
11 AI experts analyzed this briefing across 3 turns of structured debate
11Agents16Messages23mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_