CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
CISA added actively exploited Linux kernel privilege-escalation flaw CVE-2026-46300 to its KEV catalog and set an October 31, 2026 federal remediation deadline. UTA0576 is also exploiting three Ivanti Connect Secure zero-days, while active attacks target GitLab CI/CD and Drupal Commerce Core; on mobile, Coruna uses a DarkSword-derived no-click chain against iOS 18.
Attackers can reportedly chain CVE-2026-46300 with PHP2Shell flaws to obtain root access, turning a web application compromise into full control of the host. CISA’s deadline makes identification and remediation of affected Linux systems an immediate federal priority.
Ivanti administrators should deploy the additional patches and assess internet-exposed appliances for compromise. GitLab operators should install fixed releases and investigate exposed systems; Drupal stores need fixed Commerce Core versions plus order audits because patching cannot undo prior manipulation. Unpatched iPhones also warrant attention because Coruna can steal Apple Notes, authentication material and application inventories without user interaction.
Editorial: Recommended Actions
01
PRIORITY
Patch Linux systems affected by CVE-2026-46300 immediately and investigate exposed hosts for privilege escalation or root compromise. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, and attackers can reportedly chain it with PHP2Shell flaws to obtain root access. Federal agencies must complete remediation by October 31, 2026, but organizations should not wait for that deadline while exploitation is active.
02
PRIORITY
Install Ivanti’s additional Connect Secure patches and assess every affected internet-facing appliance for compromise. UTA0576 exploited CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 to execute commands as root without authentication, extract credentials, and probe internal networks. Do not treat the absence of a persistent web shell as evidence that an appliance is clean.
03
PRIORITY
Upgrade affected GitLab Community and Enterprise Edition deployments to fixed releases and investigate exposed instances for compromise. CVE-2026-97229 can permit unauthenticated code execution through a crafted regular expression in pipeline configuration under specific conditions; CISA confirmed active exploitation, and an unknown actor attempted to exploit Alpine Linux’s GitLab instance.
04
PRIORITY
Update Drupal Commerce Core to a fixed release and audit existing orders for unauthorized changes. CVE-2026-118539 is actively exploited, and missing permission checks can expose protected data or allow unauthorized actions that manipulate orders and cause financial loss. Patching prevents further abuse but cannot reverse malicious changes already made.
05
PRIORITY
Update vulnerable iPhones, prioritizing devices running iOS 18.7 or earlier and those used by financial-sector employees or customers. The active Coruna campaign uses a DarkSword-derived, no-click chain to escape Safari sandboxes without app installation or user interaction, then steals Apple Notes data, authentication material, and application inventories. Malicious websites can reportedly compromise unpatched devices.
ROUNDTABLE
Expert Panel Discussion
11 AI experts analyzed this briefing across 3 turns of structured debate
11Agents17Messages26mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_