CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
CISA added Apple Pointer Authentication bypass CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after reported attacks, as Sekoia linked associated web-based espionage activity to APT29. Attackers are also chaining three flaws against exposed PAN-OS management interfaces, while a Web3Auth flaw exposed private keys for some Keplr wallets created through Google or Apple sign-in.
Apple fixed CVE-2024-27834 in iOS 16.7.8, iOS 17.5, macOS Sonoma 14.5 and Safari 17.5. The reported activity used compromised or cloned websites to serve n-day exploit chains to outdated iPhone and Android devices, and an October variant named P7 added bidirectional remote-control capability.
Internet-exposed PAN-OS management interfaces are being compromised and escalated to root; Web3Auth social login exposed Keplr private keys; and internet-connected refrigeration controllers remain reachable through public exposure, unpatched systems and unchanged default passwords. Administrators should treat exposed affected PAN-OS appliances as potentially compromised, while affected Keplr users should create new wallets and move their assets.
Editorial: Recommended Actions
01
PRIORITY
Identify every internet-exposed PAN-OS management interface running versions 10.2, 11.1, 11.2, 12.1, or 12.2, and treat affected appliances as potentially compromised. Attackers are actively chaining CVE-2026-109618, CVE-2026-109619, and CVE-2026-46300 to compromise management interfaces and escalate to root; CISA has added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog.
02
PRIORITY
Update affected Apple devices to iOS 16.7.8, iOS 17.5, macOS Sonoma 14.5, Safari 17.5, or later fixed releases. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after reported attacks, and APT29-linked activity used compromised or cloned websites to deliver web-based exploit chains against outdated iPhones with little or no user interaction.
03
PRIORITY
Upgrade SonicOS SSL-VPN deployments using SAML to the latest release, prioritizing Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier. SonicWall provides no workaround for CVE-2026-19868, which is being exploited to let attackers with valid credentials for another supported login method bypass SAML controls, including MFA enforced through SAML.
04
PRIORITY
Create a new wallet and move assets immediately if the Keplr wallet was created through Google or Apple sign-in. A Web3Auth flaw exposed private keys for some Keplr social-login users, with roughly 20% of those accounts reportedly affected; recovery-phrase and hardware-secured wallets were reportedly not exposed.
05
PRIORITY
Revoke and replace Chainalysis passwords, API keys, session tokens, and OAuth tokens, then investigate associated accounts and integrations for unauthorized activity. Credentials and active authentication tokens for all Chainalysis customers were reportedly exposed, affecting customers that include cryptocurrency exchanges, financial institutions, government agencies, and law-enforcement organizations.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents15Messages23mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_