CYBER THREATCAST

Upgrade Zyxel GS1900-series switches to the .3 firmware release immediately and verify that no affected device remains on a .2 release. CVE-2026-107441 is a pre-authentication out-of-bounds write that may permit OS command execution through a crafted HTTP request; GreyNoise reported 996 compromised switches in 48 countries, although official exploitation confirmation was still pending. Firmware intended to address CVE-2026-7273 reportedly remained vulnerable, so do not treat that earlier update as sufficient.

Update cryptocurrency users’ iPhones to iOS 26.3 or later, prioritizing devices running iOS 18.4 through 18.7. DarkSword can reportedly compromise an unpatched iPhone through a malicious Safari page without a wallet connection or transaction approval, then steal keychain data, browser records, wallet information, recovery phrases, notes, and media. The campaign has reportedly taken $5.57 million from more than 20 wallets and used at least 18 malicious websites.

Patch affected SonicWall SSL-VPN appliances now: deploy SonicOS Gen7 7.3.4-7013 or Gen8 8.2.3-8015. CVE-2026-19868 is being exploited in the wild and may allow an attacker with valid alternative credentials to bypass SAML controls where SAML login is enabled. SonicWall listed no workaround, and CISA reportedly added the vulnerability to its Known Exploited Vulnerabilities catalog.

Prioritize remediation of CVE-2024-27834, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, and CVE-2026-20700 on managed iPhones and Android devices using Chrome. The APT29-linked Poisoned Source campaign selectively fingerprints visitors and delivers no-click exploit chains through compromised sites, reverse proxies, spoofed trusted pages, and a compromised analytics tracker. Merely visiting an affected page may trigger exploitation and lead to AndroSnitch spyware deployment.

Remove Danfoss AK-SM refrigeration controllers from public internet exposure, isolate them from other operational technology, patch the controllers, and replace default or weak credentials. Attackers have used exposed systems, known flaws, and unchanged passwords to force continuous defrost cycles and raise temperatures to roughly 50–55°C. Compromises across at least nine European countries reportedly caused millions of euros in spoilage and affected food, retail, agriculture, healthcare, and blood-storage operations.