CYBER THREATCAST

Update affected SonicWall Gen7 and Gen8 appliances to the fixed SonicOS releases immediately; no workaround is listed. Prioritize SSL VPN deployments using SAML, because attackers with valid alternative-method credentials can exploit CVE-2026-19868 to bypass SAML authentication and SAML-enforced MFA. CISA has added the flaw to its Known Exploited Vulnerabilities catalog.

Upgrade vulnerable OpenSSH installations to 10.6p2 or apply vendor-patched packages now, focusing first on Alpine Linux and other musl-based Linux systems with PAM disabled. Attackers reportedly exploited CVE-2026-123158 within nine hours of disclosure and gained root on an Alpine Linux honeypot. Reported unaffected configurations include glibc systems, Dropbear, non-Linux platforms, and PAM-based authentication.

Update iPhones used for cryptocurrency access to iOS 26.3 or later without delay. DarkSword reportedly chains six iOS flaws through malicious Safari pages to compromise unpatched devices and steal data from cryptocurrency wallets; the campaign has been linked to malicious advertisements, fake Polymarket pages, re-registered analytics domains, and at least 18 malicious or compromised websites.

Remove genblaze-atlascloud 0.1.0, genblaze-fal 0.1.0, and pulumi-doppler 0.0.0 or 1.0.0, then treat systems that installed or imported them as compromised. Rotate credentials, inspect logs, block the package names, and assess affected hosts for rebuilding. The packages execute malicious code during installation or import and exfiltrate host information, including usernames and IP addresses; no corrected releases are available.

Upgrade AutomatorWP to version 6.0.5 and inspect WordPress sites for unauthorized privileged accounts. CVE-2026-104768 affects AutomatorWP through 6.0.4 and can let unauthenticated attackers create administrator accounts when attacker-controlled anonymous automation data specifies the administrator role. No active exploitation has been reported.