CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
APT29 compromised the Plerdy SEO Tracker script and other web infrastructure to expose selected iOS and Android users to exploit chains. The operation potentially placed thousands of customer websites at risk for about a week, while active exploitation also drove urgent action on Zyxel switches, Apple platforms and WordPress installations.
The APT29-linked Poisoned Source campaign injected malicious JavaScript into legitimate and impersonated websites to fingerprint mobile visitors. Its Android payload, AndroSnitch, targeted cookies, credentials, browsing history and Wi-Fi passwords, with victims including diplomats and people connected to the war in Ukraine.
Zyxel issued replacement GS1900 firmware after Binarly found that 10 releases carrying its June mitigation remained exploitable; earlier attacks compromised 996 switches in 48 countries. CISA also added an exploited Apple Pointer Authentication bypass and WordPress CVE-2026-119977 to KEV, while Lazarus abused localhost APIs exposed by South Korean security software.
Editorial: Recommended Actions
01
PRIORITY
Replace Zyxel GS1900 firmware carrying the ineffective June mitigation with Zyxel’s replacement firmware, and investigate previously exposed switches for compromise. CVE-2026-107441 permits unauthenticated command execution as root, ten GS1900 releases reportedly remained exploitable after the earlier update, and related attacks compromised 996 switches across 48 countries.
02
PRIORITY
Deploy Apple’s May 2024 fix across affected iOS, iPadOS, macOS, Safari, tvOS, and watchOS assets, prioritizing users at elevated espionage risk. CISA added the Pointer Authentication bypass to its Known Exploited Vulnerabilities catalog after confirmed exploitation; Russian state-linked actors reportedly incorporated it into watering-hole and zero-click chains.
03
PRIORITY
Upgrade every WordPress installation older than 7.1.4 immediately and investigate exposed sites for exploitation. CVE-2026-119977 can enable remote arbitrary-code execution during full-package core upgrades, CISA has added it to the Known Exploited Vulnerabilities catalog, and Wordfence blocked 13,095 exploitation attempts in 24 hours.
04
PRIORITY
Identify affected cPanel, WebHost Manager, and WordPress Squared control panels, restrict unnecessary internet exposure, and remediate CVE-2026-41940 without waiting for a routine patch cycle. The flaw can provide unauthenticated control-panel access, and CrowdStrike observed widespread opportunistic exploitation beginning April 30, 2026. Review affected systems for unauthorized access, particularly where public proof-of-concept code was available.
05
PRIORITY
Patch on-premises Microsoft SharePoint Server for CVE-2025-53770 and CVE-2025-53771, then perform a full compromise assessment and eviction rather than treating patching as sufficient. Storm-2603 escalated to SYSTEM, loaded a memory-resident webshell into w3wp.exe, used suo5 for HTTP tunneling, and deployed redundant remote-access tools including Cloudflare Tunnel, Visual Studio Code CLI, Zoho Assist, and Velociraptor.
ROUNDTABLE
Expert Panel Discussion
13 AI experts analyzed this briefing across 3 turns of structured debate
13Agents16Messages26mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_