verdict: Act · 647 items
- Engineer — Act: If your org hosts workloads on Northflank, immediately rotate every secret and API key stored there and audit recent AI API usage for unauthorized spend or data exfiltration.
- SOC/IR — Act: If Northflank is in your environment, hunt for anomalous AI API activity (unexpected billing spikes, unusual query sources) since the breach window to identify any keys still being abused.
- Leader — Act: Confirm whether your org uses Northflank; if so, request their formal incident report, assess the scope of exposed credentials, and direct teams to rotate affected secrets this week.
- Engineer — Act: A trojanized Claude Code extension targeting Cursor/VS Code installs a persistent SSH backdoor on developer machines — audit all installed IDE extensions for this package and follow Microsoft’s remediation steps to remove backdoor artifacts and rotate any credentials accessible from affected workstations.
- SOC/IR — Act: Microsoft’s analysis includes detection guidance; sweep developer endpoints for the malicious extension presence and hunt for anomalous outbound SSH connections or new authorized_keys entries on workstations since late October 2026.
- Leader — Act: A supply-chain compromise of developer tooling with persistent backdoor access is a same-week risk event — confirm whether engineers use Cursor/VS Code extensions from untrusted sources, assess any exposure, and consider a brief to engineering leadership on extension vetting policy.
- Engineer — Act: Any self-hosted GitLab instance should be verified as fully patched against the exploited critical CVE; engineers using Alpine Linux as a base image should flag builds from around Oct 20–21 for review pending Alpine’s confirmation that no source or package tampering occurred.
- SOC/IR — Act: Review GitLab server logs for RCE exploitation attempts around Oct 20–21; if Alpine Linux packages feed your build pipeline, treat artifacts from that window as potentially suspect and initiate a precautionary sweep until Alpine issues a clean bill of health.
- Leader — Plan: Alpine’s build infrastructure may have been compromised — confirm this quarter whether development teams rely on Alpine base images or packages, and establish a posture for responding to potential supply chain contamination if Alpine confirms a breach.
- Engineer — Act: Ivanti Connect Secure is a common enterprise VPN appliance; CISA KEV listing plus active exploitation plus a public GitHub PoC makes this urgent — patch ICS immediately and audit appliance logs and filesystem integrity for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation of an edge VPN device means assume-breach posture is warranted — hunt for anomalous outbound connections and lateral movement from ICS appliance IPs since the KEV listing date, and check for Ivanti-specific persistence IOCs from prior campaigns (SPAWN/BUSHWALK malware families).
- Leader — Act: Ivanti Connect Secure has systemic enterprise reach; confirm with your network/infra team whether ICS is in use, obtain a patch-status attestation this week, and brief leadership — this class of Ivanti exploitation has previously generated board-level headlines.
- Signals: CVE-2026-111357 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Learn: No software to patch — this is a third-party vendor breach. The ‘offensive agentic techniques’ framing signals an emerging attack class worth tracking for future system design, particularly around agentic AI access controls in internal tooling.
- SOC/IR — Learn: No IOCs, ATT&CK mappings, or behavioral signatures have been published, so there is nothing actionable for detection or hunting yet. Monitor for follow-on technical disclosure about how agentic tooling was weaponized.
- Leader — Act: Chainalysis is a widely-used blockchain analytics vendor in financial services and compliance; if your org is a customer, confirm whether your data (names, emails, user IDs, org roles) was in scope and request a formal incident attestation from them this week.
- Engineer — Learn: No software to patch here; the notable detail is the attacker used ‘offensive agentic’ tooling to conduct the intrusion — worth tracking as an emerging attack pattern against internal tooling and SaaS platforms.
- SOC/IR — Learn: No IOCs or ATT&CK-mappable TTPs are published in this disclosure; the ‘offensive agentic’ attack vector is worth monitoring for future campaign reporting that may surface detection-relevant artifacts.
- Leader — Act: If your organization uses Chainalysis (common in fintech, crypto, or financial crime compliance), confirm your exposure scope with your account team and request their official incident report before the end of the week.
- Engineer — Act: WordPress Core versions 4.7–7.1.3 are under active exploitation at high volume; patch all WordPress instances to 7.1.4 or later immediately, and audit any public-facing WordPress sites for signs of compromise before patching is confirmed complete.
- SOC/IR — Act: The attack volume indicates opportunistic mass scanning; sweep WAF and web server logs for anomalous POST requests to WordPress Core endpoints since the patch release date, and treat any unpatched WordPress hosts as potentially compromised pending investigation.
- Leader — Act: WordPress is one of the most widely deployed platforms in enterprise web estates; confirm this week that all WordPress properties are patched and request a status report from engineering, as active exploitation at this scale raises the likelihood of a successful breach across your organization or supply chain.
- Engineer — Act: If you use Cursor with the Claude Code extension, check whether you installed or updated it during the ~11-hour window on Oct 29; audit ~/.ssh/authorized_keys for unrecognized keys and rotate credentials accessible from the potentially compromised machine.
- SOC/IR — Act: Sweep developer workstations for unauthorized SSH authorized_keys entries added around Oct 29 and hunt for outbound beacon activity from machines running Cursor; prioritize developers with access to production systems or CI/CD pipelines.
- Leader — Act: Determine whether developers in your org use Cursor with the Claude Code extension; if so, direct an immediate sweep and assess whether compromised dev machines had access to sensitive systems or source code — this is the kind of developer-tooling supply-chain incident that can cascade into broader breaches.
- Engineer — Act: Supply-chain compromise in a major ML registry qualifies as Act even without KEV: audit Hugging Face model pull history across pipelines, verify model hashes against known-good sources, and inspect GPU workloads for unauthorized mining processes. Also review any AI-agent-suggested GitHub starter kits for RAT payloads.
- SOC/IR — Plan: No specific IOCs are provided to sweep for immediately, but the NetSupport RAT delivery via developer toolchains is a detection gap worth closing this quarter — build or tune detections for NetSupport execution originating from CI/CD runners and anomalous GPU utilization spikes on ML infrastructure.
- Leader — Learn: ML supply chain attacks are maturing from nuisance to persistent threat; share with AI/ML team leads to prompt model provenance verification practices, and consider whether the risk register needs a dedicated ML-dependency entry alongside traditional software supply chain risk.
- Engineer — Act: Drupal itself has confirmed active exploitation of this critical access bypass in Commerce Core — patch to the fixed version immediately if you run any Drupal e-commerce sites; check for signs of unauthorized access to orders or admin functions.
- SOC/IR — Plan: Active exploitation is confirmed but the item provides no IOCs or ATT&CK-mappable TTPs; build or tune web-application detections for abnormal access patterns on Drupal Commerce endpoints and review web server logs back to patch disclosure date.
- Leader — Plan: Verify whether Drupal Commerce is in your environment or any third-party vendor’s stack; active exploitation of an e-commerce access-bypass raises customer/payment-data exposure risk that may require notification review if compromise is found.
- Engineer — Act: Active exploitation plus a public GitHub PoC means immediate patching is warranted: upgrade Commerce Core to 3.3.14+ (3.x users) or 2.42+ (2.x users) and audit Commerce order/checkout endpoints for signs of unauthorized access.
- SOC/IR — Act: Active exploitation with a public PoC is in progress — review web application and access logs for anomalous requests to Drupal Commerce endpoints (order management, checkout, admin) dating back at least two weeks and tune WAF rules for authorization-bypass patterns against this module.
- Leader — Plan: Scope is limited to organizations running Drupal-based e-commerce; confirm whether any internal or customer-facing properties use Drupal Commerce Core and verify engineering has patched or has a dated remediation plan.
- Signals: CVE-2026-118539 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: If your team uses the Claude Code extension on Cursor, audit all affected machines for version 2.1.313, check ~/.ssh/authorized_keys and running SSH tunnel processes for unauthorized entries, and rotate any credentials accessible from those developer workstations.
- SOC/IR — Act: Hunt across developer endpoints for the malicious extension version 2.1.313 and sweep for unauthorized SSH key additions or anomalous outbound SSH sessions from developer machines since the update was distributed; treat any hit as a potential persistent-access incident requiring IR.
- Leader — Act: Determine whether any engineers in your organization use the Claude Code extension on Cursor; if so, initiate an IR review — a supply-chain compromise on developer tooling means potential persistent access to source code, secrets, and cloud credentials, which warrants a leadership brief before it surfaces externally.
- Engineer — Act: CISA confirmation of active exploitation on a max-severity GitLab flaw demands immediate action: identify all self-hosted GitLab instances and patch to the version released earlier this month before your next patch window.
- SOC/IR — Act: With confirmed in-the-wild exploitation, sweep GitLab audit logs and authentication events for anomalous access since the patch release date, and hunt for lateral movement or credential theft originating from GitLab servers.
- Leader — Act: A max-severity, actively exploited flaw in a source-code and CI/CD platform is a supply-chain risk event — confirm this week whether your org runs self-hosted GitLab and verify patching status; if so, brief engineering leadership on exposure.
- Engineer — Act: Patch GitLab CE/EE immediately to the fixed version addressing CVE-2026-97229 (CVSS 10.0, KEV-listed, public PoC on GitHub); also apply the Cisco firewall DoS fix. KEV listing with public PoC confirms active exploitation pressure.
- SOC/IR — Act: Hunt for exploitation attempts against GitLab instances since KEV listing date — look for anomalous API calls or unauthenticated RCE indicators in web/application logs; write or enable detections for CVE-2026-97229 exploitation patterns given the public PoC and confirmed active exploitation.
- Leader — Plan: Confirm with engineering that GitLab and Cisco firewall patching is on an accelerated track given KEV status; no board-level event unless exploitation is confirmed in your environment, but verify remediation timelines are within CISA’s required window.
- Signals: CVE-2026-97229 — CISA KEV: listed, EPSS 0.27, public PoC on GitHub, reported by 2 collected sources
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs published yet; monitor for post-incident technical disclosures that may yield detection opportunities for exchange-related intrusion patterns.
- Leader — Act: If your organization holds assets on Binance or uses it for treasury/payment operations, confirm current exposure and request a vendor incident report; brief finance and legal ahead of potential media inquiries.
- Engineer — Act: Remote unauthenticated root RCE in the Linux kernel TCP stack with a public GitHub PoC is a patch-now event regardless of the low EPSS snapshot — check Ubuntu/RHEL kernel errata and patch all internet-exposed Linux hosts this sprint.
- SOC/IR — Plan: No confirmed wild exploitation yet, but the public PoC for unauthenticated root RCE means weaponization is imminent — build detections for anomalous TCP session patterns and unexpected root-child process spawning on Linux servers before active campaigns emerge.
- Leader — Plan: A CVSS 9.8 kernel-level RCE spanning Ubuntu and RHEL has board-question potential if exploitation begins; confirm with engineering that Linux patch cycles are accelerated and prepare a brief so leadership isn’t caught off-guard when it escalates.
- Signals: CVE-2026-98432 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A confirmed exploitation attempt combined with a public PoC on GitHub is enough to act even with EPSS at 0.18: identify your GitLab version, apply the security patch addressing CVE-2026-97229 immediately, and review instance logs for unauthorized access attempts.
- SOC/IR — Act: Read the full Alpine Linux incident post for any published IOCs or request patterns, then sweep GitLab authentication and API access logs from the incident date forward for anomalous behavior consistent with this CVE’s attack surface.
- Leader — Plan: This does not yet rise to board-level systemic risk, but confirm with engineering that self-hosted or internally managed GitLab instances are patched; if GitLab SaaS hosts sensitive IP or customer data, request a vendor security statement.
- Signals: CVE-2026-97229 — CISA KEV: not listed, EPSS 0.18, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: If Cisco Catalyst SD-WAN is in your environment, confirm you applied the February 2026 patch, then audit devices for KeyDrift artifacts and rotate inter-site VPN encryption keys since prior compromise would leave stolen keys in attacker hands even after patching.
- SOC/IR — Act: Cisco Talos published a named malware (KeyDrift) tied to confirmed SD-WAN exploitation; pull the Talos report for IOCs, sweep Cisco Catalyst SD-WAN management systems for KeyDrift indicators, and hunt for anomalous key-material exfiltration activity back to before the February patch date.
- Leader — Act: Confirmed exploitation of Cisco SD-WAN infrastructure with encryption key theft means inter-site traffic confidentiality may be retroactively compromised; if your organization runs Cisco Catalyst SD-WAN, verify patch status with engineering this week and assess whether a disclosure or customer notification obligation applies.
- Engineer — Act: Cisco confirmed active exploitation of this DoS zero-day in ASA and FTD software — apply Cisco’s security updates to affected ASA/FTD appliances immediately, prioritizing internet-facing SSL VPN interfaces.
- SOC/IR — Plan: No IOCs are published yet, but active exploitation warrants building or enabling alerts on unexpected Cisco ASA/FTD device reboots or SSL VPN process crashes, which will be the observable symptom of exploitation attempts.
- Leader — Plan: Confirm whether Cisco ASA or FTD is deployed in your environment and verify that engineering has elevated this patch to critical priority; successful exploitation takes down VPN access, posing a business-continuity risk.
- Engineer — Act: Cisco ASA and FTD are common enterprise perimeter devices; the vendor confirms active wild exploitation of this unauthenticated crash bug and a public PoC exists. Patch ASA/FTD software to Cisco’s fixed release immediately — these are your outermost network defenses.
- SOC/IR — Plan: Active exploitation of perimeter VPN appliances warrants a new detection: alert on unexpected ASA/FTD process restarts or abnormal SSL VPN session drops that may signal crash-loop exploitation attempts against your edge devices.
- Leader — Plan: Widely deployed Cisco perimeter firewalls being actively exploited is a material perimeter-risk event; confirm with your engineering team this week that affected ASA/FTD devices are inventoried and patching is scheduled.
- Signals: CVE-2026-76418 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listing confirms active exploitation; patch Linux kernel to the remediated version immediately on any internet-facing or multi-tenant Linux hosts, prioritizing those running PHP-based web applications where the PHP2Shell initial-access vector applies.
- SOC/IR — Act: Active chained exploitation means assume-breach posture on Linux web servers; hunt for PHP web shell artifacts (unusual PHP child process spawning, outbound connections from web server processes) followed by local privilege escalation behavior since the CISA advisory date.
- Leader — Plan: CISA KEV listing signals active exploitation but this is a patch-and-detect operational issue; confirm engineering teams have the Linux kernel patch queued as priority-one this sprint and verify SOC has added detection coverage for the attack chain.
- Engineer — Act: CISA KEV listed, actively exploited by a nation-state actor, and a public PoC exists — patch VMware ESX to the fixed version addressing CVE-2026-41709 immediately, then audit ESX logs for gaps or tampering that could indicate prior access.
- SOC/IR — Act: Active exploitation specifically targets audit trail visibility, meaning logs on compromised ESX hosts may already be incomplete — treat any unpatched ESX as potentially breached, hunt for Warp Panda TTPs in hypervisor logs since at least the KEV listing date, and sweep for published IOCs from the CrowdStrike disclosure.
- Leader — Act: A Chinese state-linked actor is actively exploiting CISA KEV-listed VMware ESX to suppress forensic evidence, with confirmed targeting of the US legal sector — confirm patch status with engineering this week, and if your organization is in the legal sector, brief leadership before they see the headline.
- Signals: CVE-2026-41709 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Palo Alto Networks has confirmed active exploitation of PHP2Shell vulnerabilities against internet-exposed management interfaces; immediately restrict management interface access to trusted IPs only and apply the available patches.
- SOC/IR — Act: Active exploitation of PAN-OS management interfaces is confirmed; sweep for unexpected outbound connections or lateral movement from firewall management IPs, and hunt for anomalous sessions in PAN-OS logs since the advisory date.
- Leader — Plan: If your organization runs Palo Alto Networks gear with internet-exposed management interfaces, verify remediation status with your network team and assess whether any appliances may already be compromised before this week closes.
- Engineer — Act: CVSS 10.0 RCE via crafted CI regex with a public PoC and a confirmed exploitation attempt against a live GitLab server; patch your GitLab instance to the latest fixed release immediately and audit CI configuration pipelines for unexpected regex patterns.
- SOC/IR — Act: An exploitation attempt against Alpine Linux’s GitLab server confirms active targeting; sweep GitLab server access and CI pipeline execution logs for anomalous regex patterns in CI configs since roughly October 21 and tune detections for RCE attempts via GitLab’s CI parsing endpoint.
- Leader — Plan: A CVSS 10.0 GitLab RCE with a public PoC and active exploitation attempts poses supply-chain risk if your engineering teams self-host GitLab; confirm with engineering that all instances are patched this week and assess whether any CI/CD outputs or secrets could have been exposed.
- Signals: CVE-2026-97229 — CISA KEV: not listed, EPSS 0.18, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Exposed credentials are confirmed valid and immediately usable by anyone. Audit your org’s public Gitee repositories for hardcoded cloud and AI API keys, then rotate any discovered secrets and enforce pre-commit secret scanning across all public code-hosting platforms.
- SOC/IR — Plan: No specific IOCs or active campaign are reported, but the scale of valid exposed credentials signals likely ongoing abuse. Build or tune detections for anomalous cloud API authentication — unusual geos, times, or access patterns for cloud/AI service keys — to catch credential misuse before it surfaces as a breach.
- Leader — Plan: At 26,400 working credentials, this research underscores systemic secret sprawl risk beyond GitHub. This quarter, confirm whether developer activity extends to Gitee or similar platforms, and verify that automated secrets scanning is enforced on all public repositories your org controls.
- Engineer — Skip
- SOC/IR — Learn: Healthcare ransomware incident with operational disruption; no IOCs or TTPs published yet, but worth monitoring BleepingComputer for follow-up technical details to inform detection coverage for healthcare-sector clients.
- Leader — Act: Healthcare sector ransomware with patient care disruption is board-level risk; if your organization serves or partners with healthcare systems, brief leadership and confirm your incident response plan covers operational disruption scenarios ahead of likely press coverage.
- Engineer — Plan: Device code phishing abuses the OAuth device authorization grant, which many cloud tenants leave unrestricted by default; audit Conditional Access policies in Entra ID to block or scope device code flow to legitimate managed devices only.
- SOC/IR — Act: Active named campaign targeting U.S. organizations via device code auth abuse — hunt for anomalous device code authentication events in Entra ID/M365 sign-in logs (filter on ‘DeviceCode’ grant type) and flag suspicious OAuth token issuances since at least early October 2026.
- Leader — Learn: This campaign highlights that modern account takeover can succeed through legitimate auth flows rather than credential theft, making it harder to detect via traditional controls; useful framing for risk conversations but no immediate leadership action required absent a confirmed breach at a dependent vendor.
- Engineer — Act: CISA KEV listed, EPSS 0.97, public PoC, and active exploitation since May — patch PeopleSoft to the June release addressing CVE-2026-35273, then audit web and application server logs from May onward for SSRF-to-loopback traffic patterns that indicate exploitation.
- SOC/IR — Act: ShinyHunters exploitation window opens in May, meaning systems may already be compromised — hunt PeopleSoft web logs for anomalous internal management-interface requests since May and sweep for ShinyHunters-associated IOCs in your SIEM using ATT&CK Initial Access/SSRF patterns.
- Leader — Act: PeopleSoft stores HR and financial data; a months-long exploitation window by a breach-and-extortion actor creates material data-exposure risk — confirm whether your organization runs PeopleSoft, assess the May–June breach window, and brief leadership on potential notification obligations before this surfaces in the news.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.97, public PoC on GitHub
- Engineer — Plan: Active nation-state exploitation of PHP2Shell combined with a kernel privilege escalation chain is confirmed as of Oct 25; audit all internet-exposed PHP applications for signs of compromise and track vendor advisories for a specific CVE and patch version.
- SOC/IR — Act: China-nexus actor ran an active campaign on Oct 25 combining PHP webshell deployment with kernel priv-esc — hunt for anomalous PHP process trees, unexpected kernel exploits, and new root-level persistence in web server logs since that date.
- Leader — Learn: A suspected China-nexus threat actor used AI-assisted techniques to breach a US government-affiliated network; useful context for board discussions on AI-enabled adversary tradecraft, but no immediate leadership action required unless your organization has direct government or defense-sector exposure.
- Engineer — Act: Public PoC on GitHub combined with confirmed active probing makes this Act despite low EPSS; apply Oracle’s Critical Patch Update to Oracle E-Business Suite immediately and verify no external exposure of EBS endpoints.
- SOC/IR — Act: Threat actors are already scanning for this RCE; hunt for exploitation attempts against Oracle EBS Application Object Library endpoints dating back to last week’s patch release, and tune WAF/IDS rules for CVE-2026-101767 probe patterns.
- Leader — Plan: Oracle EBS hosts sensitive financial and HR data — confirm whether the organization runs EBS, verify the Critical Patch Update is applied this sprint, and track escalation to Act if CISA KEV listing or confirmed exploitation follows.
- Signals: CVE-2026-101767 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA-confirmed active exploitation of a Brotli compression library flaw affecting Node.js and HTTP/2 stacks; audit all services for affected Brotli versions and apply vendor patches immediately, prioritizing internet-facing Node.js and HTTP/2 endpoints.
- SOC/IR — Act: Active exploitation confirmed by CISA warrants an assume-breach sweep; hunt for anomalous outbound connections and unusual process behavior on hosts running Node.js or Brotli-linked HTTP/2 services since the disclosure date.
- Leader — Plan: CISA confirmation of exploitation in a widely-used library could generate customer or board questions if exposure is significant; confirm engineering has inventoried affected systems and establish a patch-completion timeline to report upward.
- Engineer — Act: Active internet-wide scanning signals exploitation is imminent; if you run Oracle E-Business Suite, apply the October critical patch update now and confirm no public-facing EBS endpoints remain exposed until patching is complete.
- SOC/IR — Act: Scanning campaigns targeting Oracle EBS create detectable noise — hunt for exploitation attempts against EBS endpoints in web and firewall logs since the patch disclosure date, and tune rules for Oracle EBS attack patterns if EBS is in your estate.
- Leader — Plan: Confirm with engineering whether Oracle E-Business Suite is in use and verify its patch status this week; active attacker scanning compresses the remediation window significantly and may warrant expedited change control approval.
- Engineer — Act: A public PoC on GitHub for a CVSS 9.9 code injection flaw (CVE-2026-104351) makes exploitation pressure real despite the low EPSS; patch Adobe Campaign Classic to the latest released version immediately.
- SOC/IR — Plan: With a public PoC available, build or tune detections for exploitation attempts against Campaign Classic endpoints — look for anomalous process spawning or outbound connections from the Campaign Classic application process.
- Leader — Skip
- Signals: CVE-2026-104351 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CVE-2026-111497 is CISA KEV-listed with EPSS 0.88 and a public PoC — patch Adobe Commerce/Magento to the latest vendor-released version immediately, and audit web server logs for PolyShell indicators and anomalous Brotli-encoded traffic.
- SOC/IR — Act: Hundreds of stores are actively compromised; hunt for PolyShell webshell artifacts and Brotli-encoded C2 traffic in web access logs since KEV listing date, and tune WAF/SIEM rules to flag unusual POST patterns on Commerce endpoints.
- Leader — Plan: If your org runs Adobe Commerce or Magento storefronts — or relies on a third-party e-commerce vendor that does — confirm patching status and request a written attestation; breach of payment pages may trigger PCI DSS incident-notification obligations.
- Signals: CVE-2026-111497 — CISA KEV: listed, EPSS 0.88, public PoC on GitHub
- Engineer — Plan: If your team uses Warp, audit what data passes through its AI agent sessions — terminal history, code snippets, and environment variables could be in those logs; rotate any credentials that may have appeared in agent context.
- SOC/IR — Learn: No IOCs or TTPs published; file as situational awareness for supply-chain risk in developer tooling, where AI agent logs create a novel sensitive-data exposure surface.
- Leader — Act: Confirm whether your engineering staff uses Warp; if so, request Warp’s incident report and assess whether AI agent logs containing proprietary code or credentials constitute a material data exposure requiring disclosure review.
- Engineer — Act: EPSS 0.55 plus a public GitHub PoC make this Act: update Windows PHP packages to the latest 8.2–8.5 builds immediately, and audit any application that enables cURL’s CURLOPT_ENCODING (automatic Brotli decompression), since that is the exploitable path.
- SOC/IR — Plan: No active exploitation or KEV listing yet, but a public PoC and high EPSS warrant building a detection for anomalous PHP-CGI/FastCGI process behavior on Windows hosts; queue a hunt for known PoC signatures once they stabilize.
- Leader — Skip
- Signals: CVE-2026-111497 — CISA KEV: not listed, EPSS 0.55, public PoC on GitHub
- Engineer — Act: CISA KEV listing plus EPSS 1.00 and a public GitHub PoC confirm imminent exploitation risk. Audit all deployments for PHP2Shell and apply the vendor patch immediately; treat any unpatched instance as potentially compromised.
- SOC/IR — Act: Active exploitation is confirmed and a public PoC is available, meaning intrusions may already be in progress. Hunt for signs of unauthenticated RCE against PHP-based services since early October 2026 and tune WAF/EDR rules to flag PHP2Shell-related web-shell activity.
- Leader — Plan: CISA KEV classification signals an organization-wide exposure check is warranted. Confirm with engineering whether PHP2Shell is in use, and if so, verify emergency patching is tracked as a priority-one item this week.
- Signals: CVE-2026-109618 — CISA KEV: listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV listing confirms active exploitation — audit whether PHP2Shell is present in any web application or server environment and patch immediately to meet the Thursday federal deadline or your own SLA for KEV-listed vulns.
- SOC/IR — Act: Active exploitation confirmed by CISA KEV; sweep web server and application logs for PHP2Shell exploitation indicators since at least the past 30 days and tune WAF/SIEM rules to detect post-compromise activity on PHP-based endpoints.
- Leader — Plan: Confirm with engineering whether PHP2Shell is in the application inventory and that patching is tracked against the CISA deadline; if the org is a federal agency or contractor, escalate to Act and verify compliance before Thursday.
- Engineer — Plan: Teams’ external-chat feature is being abused at scale; audit your tenant’s external access policy and consider restricting or requiring approval for inbound external chat requests in the Teams admin center.
- SOC/IR — Act: Hundreds of confirmed cases share a pattern of throwaway tenants with IT-themed names initiating chats that precede malware drops; hunt for Teams external-chat sessions from newly created tenants and correlate with unusual child-process creation from Teams.exe since at least early October 2026.
- Leader — Plan: A high-volume campaign is using Teams to impersonate internal IT and deliver ransomware; schedule an employee awareness communication this week and direct the team to review the tenant’s external-communications policy before next quarter.
- Engineer — Learn: No patch or config action applies here; note that C2 disruption does not clean infected hosts, so Amadey loaders may still be dormant on endpoints even without callbacks.
- SOC/IR — Act: The severed C2 means infections persist without active exfiltration — sweep your estate for Amadey indicators using existing EDR/YARA signatures now, before a new C2 spins up and re-acquires those hosts.
- Leader — Learn: A notable government-led botnet disruption at scale; no executive action required unless an internal sweep reveals organizational endpoints were among the 180,000 compromised hosts.
- Engineer — Act: Both CVEs carry EPSS 1.00 with public PoCs and confirmed in-the-wild exploitation; patch any PHP2Shell-dependent installations immediately and audit web server logs for indicators of post-exploitation activity such as newly written shells.
- SOC/IR — Act: Public PoCs and confirmed exploitation mean attack tooling is freely available; hunt for exploitation attempts against PHP2Shell endpoints and sweep for web shell artifacts or unexpected outbound connections since the PoC release date.
- Leader — Act: EPSS 1.00 plus confirmed exploitation warrants same-week action — confirm whether your organization runs PHP2Shell or any software dependent on it, and verify engineering has this on emergency patching priority.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Microsoft’s out-of-band release for a critical RCE-class flaw (HTTP2Shell/Broccoli2Shell) in the .NET Brotli stack signals high urgency; update all .NET runtimes and SDK versions to the emergency-patched release across every workload and pipeline image this patch window.
- SOC/IR — Plan: No published IOCs or active exploitation campaigns in the enrichment signals yet, but the ‘Shell’ naming and emergency severity make this a prime candidate to build exploitation-detection rules before in-the-wild activity emerges — prepare Sigma/KQL queries targeting anomalous .NET HTTP2 processing behavior.
- Leader — Plan: A critical emergency patch for the .NET runtime touches most enterprise application stacks; confirm patch deployment timeline with engineering and ensure any customer-facing .NET services are covered before this becomes a named exploitation event.
- Engineer — Plan: Active AitM campaign bypasses MFA via stolen session tokens — no patch exists, but hardening is actionable: enable Entra ID Token Protection in Conditional Access policies and audit sign-in logs for anomalous token-replay patterns since July 14, 2026.
- SOC/IR — Act: Huntress documented 497 confirmed M365 sign-in events across 79 orgs from July 14–September 22, 2026; sweep Entra ID and M365 unified audit logs for token reuse from mismatched IP geographies or device states consistent with AitM relay behavior.
- Leader — Act: M365 email accounts at 79 organizations were compromised via session-token hijacking — brief leadership now given M365’s ubiquity in your estate, confirm Entra ID token protection and phish-resistant MFA are enforced, and assess whether any internal accounts show anomalous sign-in activity.
- Engineer — Act: Active prompt-injection technique caught targeting real developer machines: restrict AI coding agents to project directories only and disable auto-execution of package-install commands to eliminate this ambient-file attack surface.
- SOC/IR — Plan: New TTP worth covering: build detections for package manager processes (npm/pip/etc.) spawned as child processes of AI coding agent binaries, especially when triggered outside expected project paths.
- Leader — Plan: AI coding agents in your developer toolchain now represent a prompt-injection risk from ambient files; establish a policy governing agent filesystem scope and command permissions before an undetected attempt succeeds.
- Engineer — Act: Active campaign directly targeting CI/CD pipelines: stolen tokens plant workflows that echo secrets to Actions logs, then delete the runs. Immediately audit GitHub Actions logs for unexpected workflow runs, rotate all repository and org-level secrets, and tighten token scopes to least privilege.
- SOC/IR — Act: The delete-run-after-exfiltration pattern is a concrete hunt target in GitHub audit logs. Search for workflow run creation followed by rapid deletion, and sweep for tokens with unusual write-workflow permissions used outside normal pipelines since the campaign began.
- Leader — Plan: Active exfiltration campaign targeting private GitHub and GitHub Enterprise repos is worth a this-week check-in: confirm with engineering that no unauthorized workflow runs exist in your org and that secret rotation is scheduled if any anomalies are found.
- Engineer — Act: EPSS 1.00 plus a public, actively maintained exploit toolkit covering PHP 5.4–8.4.26 means exploitation pressure is immediate. Patch PHP to the latest release beyond 8.4.26 and audit any internet-exposed PHP applications for successful exploitation attempts.
- SOC/IR — Act: The toolkit’s JA3 impersonation capability specifically evades TLS fingerprint-based detections, requiring tuning beyond standard signatures. Hunt for unauthenticated HTTP sequences matching this RCE chain against PHP endpoints dating back to the toolkit’s first appearance on GitHub.
- Leader — Act: A public exploit kit with EPSS 1.00 covering the entire PHP version tree is a systemic exposure on par with Log4Shell in breadth. Confirm this week whether PHP is present across your estate and that engineering has emergency-patched it; be prepared to brief leadership if a breach follows.
- Signals: CVE-2026-109619 — CISA KEV: not listed, EPSS 1.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: A pre-authentication RCE (ZDI-CAN-33774) in the Linux kernel’s built-in SMB server is publicly disclosed with no mainline fix yet. Audit all Linux servers for ksmbd running (
lsmod | grep ksmbd), disable the service where SMB is not required, and firewall SMB ports (445/TCP) at the network edge until a kernel patch is available. - SOC/IR — Plan: No active exploitation or IOCs reported yet, but public mailing-list disclosure of a pre-auth RCE raises the PoC timeline. Identify estate assets running ksmbd, and build detections for anomalous inbound SMB traffic to Linux hosts before a working exploit emerges.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: Healthcare sector breach via Quanum LSM system access; no published IOCs or TTPs available yet, so file for context on healthcare-targeting threat actors.
- Leader — Act: If your organization uses Quest Diagnostics or shares patient data with them, confirm your exposure scope and request their incident report; this is a named healthcare breach likely to trigger customer and regulatory questions under HIPAA.
- Engineer — Act: Confirmed supply-chain compromise of a widely-used Python LLM-integration package (LiteLLM 1.107.0). Audit your dependency tree for that version, inspect CI/CD build logs for exposure since May 27, 2026, and rotate any credentials or tokens accessible to LiteLLM in your pipelines.
- SOC/IR — Act: Active supply-chain compromise with a measurable exposure window starting May 27, 2026. Sweep deployed environments for LiteLLM 1.107.0, hunt for anomalous outbound connections or credential-access events attributable to Python runtime activity during the exposure period, and check GitHub token usage logs for unexpected access.
- Leader — Act: A popular AI/LLM integration package was weaponized via a leaked master key — a systemic supply-chain event. Confirm whether LiteLLM is in your software inventory or vendor stack, assess exposure across the May 27–disclosure window, and brief leadership if any internal pipelines may have run the compromised version.
- Engineer — Act: LiteLLM is widely used in AI/ML workloads; a confirmed supply-chain compromise with credential theft and remote code loading is an immediate Act trigger. Audit all dependency trees and container images for version 1.107.0, rotate any API keys or cloud credentials accessible from affected environments, and review the Microsoft post’s IOCs against build/runtime logs.
- SOC/IR — Act: Microsoft published TTPs and detections for this compromise; hunt for abuse of Python startup hooks (usercustomize/sitecustomize) across Python-capable hosts since the 1.107.0 release window, and sweep for the remote code-loading IOCs detailed in the post.
- Leader — Act: A confirmed supply-chain compromise of a widely-adopted AI/LLM proxy library with credential theft impact; direct engineering this week to assess whether LiteLLM 1.107.0 is in use and report on any exposed credentials, and be prepared to brief leadership on scope if exposure is confirmed.
- Engineer — Act: Eight intermediate CA private keys were actually recovered — any certificate signed by those intermediates should be treated as potentially compromised. Audit your certificate inventory for eMudhra-issued certs and replace them now, before major browsers revoke trust and cause outages.
- SOC/IR — Plan: Compromised intermediate CA keys enable forged certificates for MITM attacks. Update TLS inspection rules to flag or alert on eMudhra-signed certificates in your environment, and confirm that CA distrust events are reflected in your trust stores and monitoring.
- Leader — Act: A CA with recovered intermediate private keys will face browser distrust, which turns unexpired certificates into outages. Confirm this quarter whether your organization holds any eMudhra-issued certificates and initiate replacement before the distrust wave hits — and check if any vendors in your supply chain rely on them.
- Engineer — Act: Both vulns are CISA KEV-listed with confirmed active exploitation; CVE-2026-110447 has a public PoC on GitHub. If you run Arista VeloCloud Orchestrator or Collabora Online Built-in CODE Server, patch immediately and check vendor advisories for fixed versions — VeloCloud is edge infrastructure where a compromise can precede full remediation.
- SOC/IR — Act: Arista VeloCloud Orchestrator is an SD-WAN edge appliance; active KEV-listed exploitation means assume-breach posture is warranted — hunt for anomalous lateral movement or credential use originating from VeloCloud IPs and check CISA KEV advisory for any published IOCs or ATT&CK TTPs associated with these campaigns.
- Leader — Act: Confirm whether your organization runs Arista VeloCloud or Collabora Online and verify engineering has this on a same-week remediation track; KEV-listed active exploitation on edge infrastructure can escalate to a material incident requiring disclosure, so brief your risk owner now rather than after an incident surfaces.
- Signals: CVE-2026-110447 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: A public PoC exists for this buffer-overflow RCE in the Brotli decoder, and the affected surface is wide: update Python brotli and brotlicffi packages to patched versions and audit any Envoy proxy configuration that enables Brotli decompression, since attacker-controlled compressed payloads are the trigger.
- SOC/IR — Learn: No active exploitation campaign, no published IOCs, and EPSS sits at effectively zero — there is no hunt or detection to run today, but analysts should understand that Brotli-decompressing endpoints (Envoy, Python services) represent an emerging RCE surface to watch if exploitation picks up.
- Leader — Skip
- Signals: CVE-2026-111497 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: If your team deploys on Railway, rotate all secrets stored as environment variables immediately — API keys, database credentials, tokens — and reissue any that had production access.
- SOC/IR — Act: If Railway is in your estate, sweep auth and access logs for any Railway-hosted credentials being used from unexpected IPs or at unexpected times since earlier this week; treat exposed env vars as potentially compromised.
- Leader — Act: Confirm whether any engineering teams use Railway, then direct them to rotate affected secrets and report back on what credentials were exposed — this is a vendor-breach scenario with potential downstream impact on your systems.
- Engineer — Act: A turnkey scanner for the handler-mismatch + LFI → shell chain is now trending on GitHub, lowering the bar for mass exploitation; any PHP deployment should be patched to fixed versions for CVE-2026-109618 and CVE-2026-109619 and audited for handler misconfigurations immediately, even though EPSS is low and KEV is not yet triggered.
- SOC/IR — Plan: A no-dependency scanner trending on GitHub means opportunistic exploitation attempts against PHP hosts are likely soon; build or tune detections for LFI probe patterns and php2shell session-chain anomalies (unusual session handler requests followed by file-read behavior) in web server and WAF logs before active campaigns emerge.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources
- Engineer — Act: Active mass exploitation attempts targeting CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) with public PoCs on GitHub make patching urgent even though current attacks are reportedly unsuccessful; apply PHP patches for both CVEs now and confirm no internet-facing PHP instances remain on vulnerable versions.
- SOC/IR — Act: Millions of in-progress exploit attempts against PHP deployments attempting to install the Potassium Mirai variant provide a clear detection surface; hunt for HTTP request patterns matching known PHP2Shell exploitation attempts and sweep for Mirai/Potassium C2 beaconing from PHP server hosts since campaign start.
- Leader — Plan: A mass-scale campaign against widely deployed PHP infrastructure warrants confirming internal PHP exposure this quarter; exploitation is currently failing and neither CVE is KEV-listed, so no board brief is needed yet, but track for escalation if successful compromises are confirmed.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, public PoC on GitHub, reported by 5 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 5 collected sources
- Engineer — Act: A public PoC on GitHub raises exploitation probability despite PHP’s ‘unlikely’ framing; audit your PHP application configurations for the affected feature and disable it per PHP’s mitigation guidance before a patch ships.
- SOC/IR — Plan: The public PoC makes opportunistic exploitation attempts plausible; build or tune detections for anomalous process spawning from web server processes and new webshell activity on PHP-serving hosts this sprint.
- Leader — Skip
- Signals: CVE-2026-115560 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Critical RCE in PHP warrants immediate action given PHP’s ubiquity in web stacks; check your PHP version and apply the patches referenced in the official PHP.net advisory without delay.
- SOC/IR — Learn: Advisory contains no IOCs, TTPs, or exploitation activity details; monitor for follow-on reporting with behavioral indicators before building detections.
- Leader — Plan: Critical PHP RCE with broad potential exposure warrants a this-quarter inventory of PHP versions in use and confirmation that patching is underway; no confirmed active exploitation or KEV listing yet to escalate further.
- Engineer — Act: A public PoC on GitHub demonstrates unauthenticated RCE against Node.js 24.22.0 on Linux arm64 — a plausible production target in cloud environments. Verify whether your Node.js 24.x deployments run on arm64, apply the Node.js project patch as soon as it is released, and consider blocking or sanitizing untrusted Brotli input at the application boundary in the interim.
- SOC/IR — Plan: No active exploitation is reported (EPSS 0.00, not in KEV), but a public PoC raises the chance of in-the-wild attempts. Build or tune detections for anomalous child process spawning from Node.js worker processes, which is the expected exploitation footprint for a runtime RCE of this class.
- Leader — Plan: Node.js is pervasive across modern application stacks; a confirmed RCE with a public exploit warrants a near-term inventory check. Ask engineering to confirm which Node.js 24.x arm64 deployments exist and to track the upstream patch — escalate to Act if CISA adds this to KEV or exploitation is reported in the wild.
- Signals: CVE-2026-111497 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: FortiGate and GlobalProtect are common enterprise fixtures; active access obtained at organizations worldwide means assume-breach posture is warranted now. Audit both platforms for unauthorized sessions or config changes, force credential rotation for all VPN users, and cross-reference your logs against any IOCs released by the researchers.
- SOC/IR — Act: This is a live campaign with confirmed access at multiple orgs — edge device compromise typically precedes patching, so run an assume-breach hunt now. Search SIEM for anomalous lateral movement sourced from your FortiGate or GlobalProtect IPs since at least early October, and monitor the researcher disclosure for IOC drops to build detection rules.
- Leader — Act: Seventy thousand exposed credentials across a worldwide enterprise campaign is a credible board-level event if your org runs either product. Confirm with engineering whether FortiGate or GlobalProtect is in scope, request a status report on credential exposure and any observed unauthorized access, and prepare a brief for leadership before this surfaces in mainstream press.
- Engineer — Act: LiteLLM is a widely adopted Python LLM gateway library; compromised PyPI releases and Docker images can steal env vars, API keys, and secrets from any pipeline that installs or pulls them. Audit all CI/CD and container builds for LiteLLM usage, pin or remove affected versions immediately, and rotate any credentials that ran in affected environments.
- SOC/IR — Act: Active supply-chain malware distributing an info-stealer via a popular AI library is an assume-breach scenario for any org using LiteLLM in their stack. Hunt for anomalous outbound connections from build agents and containers, and sweep secrets-management logs for unexpected access since the compromise window.
- Leader — Act: A compromised open-source AI library used heavily in LLM integration work creates real credential-exposure risk across engineering teams. Confirm whether LiteLLM appears in any internal projects, direct teams to audit and remediate this week, and assess whether any cloud or SaaS credentials were potentially stolen.
- Engineer — Act: Audit your certificate inventory now for any eMudhra-issued TLS certs; any certificate signed by one of the eight compromised intermediates must be replaced and the intermediates should be distrusted in your trust stores.
- SOC/IR — Plan: No IOCs are published yet, but build or tune detections for certificate validation failures and unexpected CA chain presentations that could indicate MitM use of fraudulently issued eMudhra certs; add eMudhra intermediate serial numbers to watchlists once revocation details are public.
- Leader — Act: Confirm with your security team whether any customer-facing or internal services rely on eMudhra-issued certificates; if so, request remediation status and prepare to notify affected parties given the MitM interception risk this poses to encrypted communications.
- Engineer — Act: A compromised intermediate CA undermines TLS trust for anything in that chain. Audit OS, browser, and container trust stores for the affected eMudhra intermediate CA and explicitly distrust it; inventory any certificates your services present that were issued under this CA and plan reissuance.
- SOC/IR — Plan: No active exploitation signals yet, but a rogue intermediate CA enables silent MITM. Build a detection to flag TLS sessions presenting certificates signed by the compromised eMudhra intermediate in your network inspection logs or proxy telemetry.
- Leader — Act: A compromised public intermediate CA is a systemic trust event that can affect any vendor using eMudhra-issued certificates. Confirm this quarter whether eMudhra is in your organization’s trusted CA inventory or used by key SaaS vendors, and request attestation where relevant.
- Signals: CVE-2026-111943 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Pillow is ubiquitous in Python web apps that accept image uploads; a public PoC exists on GitHub making exploitation straightforward. Patch Pillow to the fixed release immediately, or disable EPS/Ghostscript support via environment variable if a patch window is unavailable.
- SOC/IR — Plan: No active exploitation yet (EPSS 0.00, not in KEV), but the public PoC lowers the bar. Build or tune a detection for web-tier processes (Python/Gunicorn) spawning Ghostscript, which should not normally invoke child shells — flag any unexpected child process tree from gs/gswin.
- Leader — Skip
- Signals: CVE-2026-112900 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Actively exploited zero-day with no patch yet; any authenticated VCO user can escalate to operator. Immediately restrict network access to the VCO management interface to trusted IPs only, audit all existing VCO accounts, and review recent operator-level activity for unauthorized escalations.
- SOC/IR — Act: Active exploitation of SD-WAN management plane means assume-breach posture is warranted if you have VeloCloud. Sweep VCO audit logs for privilege escalations from low-privilege accounts since at least October 22 and tune alerts for anomalous operator-level configuration changes.
- Leader — Act: Zero-day exploitation of a widely-deployed SD-WAN management system is a material risk event. Confirm whether your organization uses Arista VeloCloud Orchestrator, assess exposure with the network team, and prepare a brief for leadership before this generates inbound questions.
- Engineer — Act: If you run VeloCloud Orchestrator On-Prem, apply Arista’s security update immediately — active exploitation means this is not wait-and-see. Verify your VCO version and patch to the fixed release named in Arista’s advisory.
- SOC/IR — Act: Active exploitation of a network orchestration platform warrants an assume-breach posture for any org running VCO On-Prem; hunt for anomalous access or config changes on VCO instances since before the patch date and check Arista’s advisory for any published IOCs.
- Leader — Plan: If VeloCloud Orchestrator is in your environment, confirm your team has patched and assess whether exploitation occurred before the patch window; no broader board-level event unless your org was targeted.
- Engineer — Act: ConnectWise supply chain compromise explicitly triggers Act; audit your M365 tenant for unauthorized OAuth app registrations and anomalous credential grants, and verify ConnectWise installation integrity against known-good baselines.
- SOC/IR — Act: Active nation-state campaign with ATT&CK-mappable TTPs (supply chain compromise, application credential abuse); hunt for anomalous OAuth app registrations and unexpected delegated permission grants in M365 unified audit logs going back at least 90 days, and pull the full Microsoft post for Sentinel/Defender detection queries.
- Leader — Act: Nation-state supply chain compromise via a widely-used MSP tool affecting M365 tenants qualifies as a systemic event; verify whether ConnectWise is in your environment directly or via a managed service provider, request a formal exposure attestation from ConnectWise, and brief leadership given the nation-state attribution before they see it in the news.
- Engineer — Act: ConnectWise Cloud Backup is widely deployed in enterprise and MSP environments; a confirmed supply chain compromise means you may have received tampered software. Audit ConnectWise Cloud Backup deployments for IOCs from Microsoft’s disclosure and check ConnectWise’s advisory for patched/clean versions to pin to.
- SOC/IR — Act: Storm-0940 supply chain compromise of a widely used backup tool creates a broad assumed-breach surface; hunt for lateral movement originating from ConnectWise processes and review Microsoft’s full disclosure for ARTEX-related IOCs and TTPs to sweep across your estate since the compromise window.
- Leader — Act: A confirmed China state-actor supply chain compromise of ConnectWise Cloud Backup is a board-level event; confirm whether your organization or any managed-service vendors use this product, request a written attestation from ConnectWise on scope and remediation, and brief leadership before they encounter this in the press.
- Engineer — Act: If your team uses Railway, treat all environment variables stored there as potentially compromised and rotate them immediately — API keys, database credentials, service tokens, and any other secrets held in Railway environment configs.
- SOC/IR — Plan: No IOCs or TTPs have been published yet; if Railway is in use at your organization, build a hunt query to detect anomalous authentication or API usage patterns for any secrets that may have been stored there, and watch for Railway’s follow-on disclosure.
- Leader — Act: Confirm this week whether your organization uses Railway, identify what secrets may have been stored there, and verify the engineering team has completed credential rotation — a vendor breach exposing decrypted secrets is the kind of event that may surface in customer security questionnaires.
- Engineer — Act: A public PoC now exists for crashing HTTP/3 servers with a single unauthenticated request via QPACK header expansion; audit whether HTTP/3 is enabled on your edge servers (nginx, Caddy, Envoy, etc.) and disable it or apply vendor patches as they arrive — exposure is immediate with PoC code released.
- SOC/IR — Plan: No active exploitation campaign is reported, but the public PoC lowers the bar quickly; build detections for anomalous single-connection HTTP/3 sessions paired with server OOM events or abrupt restarts, and add HTTP/3 header-decompression anomalies to your edge-device monitoring coverage.
- Leader — Skip
- Engineer — Act: Patches are now available and exploitation was actively occurring before release — patch PHP2Shell to the latest version immediately and audit any exposed instances for signs of compromise during the 4-day pre-patch window.
- SOC/IR — Act: Pre-patch exploitation means potential compromises predate any patching activity; initiate a retroactive hunt across web server logs and EDR telemetry covering at least the 4 days before Wednesday’s patch release for PHP2Shell-related activity.
- Leader — Skip
- Engineer — Act: Active in-the-wild exploitation of PHP2Shell predating patch release confirms high urgency — patch PHP2Shell immediately and audit server logs from October 17 onward for exploitation attempts.
- SOC/IR — Act: Pre-patch exploitation means assume-breach posture for any environment running PHP2Shell; hunt for anomalous PHP execution or webshell activity since October 17 and watch for traffic from commercial anonymization network IPs.
- Leader — Plan: Pre-disclosure exploitation of a PHP vulnerability with broad in-the-wild follow-on is a systemic risk signal worth surfacing to engineering leads; confirm internal PHP2Shell exposure and track remediation status this week.
- Engineer — Act: Active supply chain compromise: if you run litellm, check immediately for version 1.107.0 in pip environments and Docker images, remove it, rotate any credentials and LLM API keys that may have been exposed through the credential stealer.
- SOC/IR — Act: Sweep all systems for litellm==1.107.0 installations deployed on or after October 21, 2026; hunt for outbound connections or credential exfiltration from hosts where that version ran, and treat any match as a potential backdoor compromise.
- Leader — Act: LiteLLM is widely used as an AI gateway routing LLM API keys — confirm whether any teams use it, check exposure to the malicious 1.107.0 release, and request LiteLLM’s incident report to assess scope before this surfaces in board-level AI security discussions.
- Engineer — Act: CISA confirmation of active exploitation chains across four Plex Media Server vulnerabilities makes this urgent for any team hosting Plex. Patch Plex Media Server to the latest available version immediately and audit exposed instances for signs of compromise.
- SOC/IR — Plan: Active exploitation is confirmed but the summary lacks published IOCs or ATT&CK-mapped TTPs to hunt with now. Inventory any Plex Media Server instances in your estate and plan a sweep for post-compromise indicators (unexpected outbound connections, new scheduled tasks) once public technical analysis emerges.
- Leader — Skip
- Engineer — Act: If Zeabur was used in any environment — dev, staging, or prod — treat all environment variables stored there as compromised and rotate them immediately, prioritizing database credentials, API keys, and cloud provider tokens.
- SOC/IR — Learn: No IOCs, TTPs, or detection-ready artifacts are published; the breach offers a case study in plaintext credential storage risk but yields no immediate hunt or detection work.
- Leader — Act: Scan your developer tooling inventory for Zeabur usage; if found, confirm the scope of exposed secrets, trigger a credentials rotation sprint, and note that the vendor is shutting down — no incident report will be forthcoming after closure.
- Engineer — Act: Working exploits are in use against a pair of PHP flaws enabling full server takeover, affecting the majority of PHP deployments. Patch PHP to the latest stable release immediately and verify no web shells or unauthorized processes exist on PHP-backed servers.
- SOC/IR — Act: Active in-the-wild exploitation of a widespread PHP RCE means assume-breach posture is warranted for any PHP-backed systems. Hunt for anomalous child processes spawned from web server processes and audit PHP server logs for signs of exploitation since today.
- Leader — Act: A pair of actively exploited PHP flaws affecting roughly 70% of websites is a systemic event likely to generate board and customer questions. Confirm whether company-operated PHP properties and key SaaS vendors are exposed, and be prepared to brief leadership this week.
- Engineer — Act: TeamUpdraft’s own website was breached and customer connection keys were exfiltrated; if you use UpdraftCentral, UpdraftVault, or UpdraftClone, rotate all connection keys immediately and audit WordPress file systems for newly planted backdoors or unexpected PHP files.
- SOC/IR — Act: Active backdoor-planting campaign is underway against WordPress sites with UpdraftCentral credentials; sweep managed WordPress estates for unauthorized file writes or new PHP scripts in plugin/theme directories since the breach disclosure, and prioritize sites confirmed to use UpdraftCentral products.
- Leader — Act: A confirmed vendor breach at TeamUpdraft has cascaded into active compromises of customer WordPress sites — if your organization operates WordPress with any Updraft-branded remote management products, request an exposure statement from TeamUpdraft and verify no backdoors were introduced on company properties before this week.
- Engineer — Act: Active supply-chain compromise: stolen UpdraftCentral connection keys give attackers remote command execution over any connected WordPress site. Immediately rotate all UpdraftCentral connection keys and audit connected WordPress sites for unauthorized files, new admin accounts, or modified plugins.
- SOC/IR — Act: Sites connected to UpdraftCentral may already be backdoored; sweep WordPress environments for unexpected file changes, newly created admin accounts, or outbound C2 traffic since the TeamUpdraft breach, even without published IOCs.
- Leader — Act: A developer managing popular WordPress backup plugins was breached, with active backdooring of customer sites reported. Confirm this week whether any organizational WordPress properties use UpdraftCentral, and if so request an incident summary from TeamUpdraft to assess exposure.
- Engineer — Act: An out-of-cycle 9.2 CVSS RCE pair in PHP demands same-day response: apply the emergency PHP release (due 14:00 UTC Oct 21) to all PHP installations and container base images immediately; hold deployments on unpatched versions until confirmed fixed.
- SOC/IR — Plan: No IOCs or exploitation confirmed yet, but once technical analysis drops post-patch, build detections for PHP webshell creation and anomalous PHP process spawning; queue a hunt back 24 hours after details are public.
- Leader — Plan: Confirm the organization’s PHP exposure across self-hosted apps and vendor SaaS, and ensure engineering teams are patching today; if PHP underpins customer-facing services, prepare a brief for leadership in case exploitation emerges before patching is complete.
- Engineer — Act: PHP2Shell (CVE-2026-109618/109619) are CVSS 9.2 RCE flaws with no sufficient pre-patch workaround; apply the PHP fix the moment it ships at 14:00 UTC today and do not rely on the configuration setting being circulated as a mitigation.
- SOC/IR — Plan: No IOCs or confirmed exploitation are provided, so no immediate hunt is warranted; prepare PHP-targeted RCE detection rules (webshell drops, anomalous child processes from web server workers) to deploy alongside or shortly after today’s patch release.
- Leader — Plan: Confirm with engineering that PHP instances in your environment are on the patch list for today; absent evidence of active exploitation there is no board or customer communication needed yet, but track this if exploitation emerges post-disclosure.
- Engineer — Act: PHP is near-universal in web stacks; leaked pre-disclosure details raise exploitation risk before patches land. Stage PHP upgrade in your pipeline now and apply the emergency release the moment it publishes tomorrow.
- SOC/IR — Plan: No IOCs or TTPs are available yet, but leaked vulnerability details make exploitation attempts likely shortly after disclosure. Queue a hunt for unusual PHP process execution and web-shell artifacts to run once patch details confirm the attack surface.
- Leader — Plan: Two critical PHP flaws with an out-of-cycle emergency release cycle warrant confirming your PHP inventory and ensuring engineering teams have an expedited patch window ready for tomorrow’s release.
- Engineer — Act: Two critical RCE flaws with public PoCs on GitHub mean exploitation is practical now; patch all PHP installations to the emergency-release version immediately and audit web server logs for signs of pre-patch exploitation.
- SOC/IR — Act: Public PoCs for both CVEs make exploitation attempts imminent if not already occurring; hunt for web shell creation events and anomalous PHP process execution since PoC publication, and tune WAF/EDR rules for PHP shell upload patterns.
- Leader — Plan: Critical RCE in a widely deployed runtime with public PoCs warrants confirming your PHP inventory and ensuring engineering prioritizes the emergency patch this week; not yet at board-briefing threshold absent confirmed mass exploitation.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Heap UAF in PHP’s session.upload_progress with a public PoC on GitHub creates immediate RCE risk on any internet-facing PHP stack; patch PHP to the fixed release now, or disable session.upload_progress in php.ini if the feature is unused.
- SOC/IR — Plan: A working PoC is public but mass exploitation isn’t confirmed yet — build detections for anomalous POST requests targeting session.upload_progress endpoints and tune WAF rules this sprint before an exploitation wave arrives.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources
- Engineer — Act: Critical unauthenticated RCE in the PHP runtime itself affects all sites regardless of application code; exploit attempts are already being observed. Patch to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately and verify no webshells were dropped on exposed servers.
- SOC/IR — Act: Active exploit attempts against web servers running PHP create an assume-breach window before patching completes. Hunt for anomalous child processes or file-write activity from web server PHP processes since patch release, and scan for newly created webshells in document roots.
- Leader — Plan: PHP2Shell affects any organization running PHP-based web services and active exploit attempts narrow the patching window significantly. Confirm engineering has inventoried PHP versions in production and is treating this as an emergency patch cycle this week; escalate to leadership briefing only if exploitation is confirmed in your environment.
- Engineer — Act: PHP carries a CVSS 9.4 RCE pair with public PoC already circulating before today’s emergency patch drop — update all PHP installations to the patched release as soon as it publishes and restrict external access to PHP services in the interim.
- SOC/IR — Act: PoC availability ahead of the patch means exploitation attempts are likely imminent; hunt for anomalous web-shell activity and suspicious PHP process spawning across web-facing servers since today, and tune WAF/EDR rules for PHP exploitation patterns.
- Leader — Plan: CVSS 9.4 with pre-patch PoC in wide-use infrastructure warrants confirming PHP exposure across your environment this week and ensuring engineering teams treat today’s emergency patch as P1 — not yet board-level but could escalate if exploitation becomes widespread.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Public PoC already circulating before the patch ships — any PHP deployment is at immediate risk of remote code execution. Patch PHP to the fixed release as soon as it drops and monitor the php.net announce list; treat this as an emergency change window.
- SOC/IR — Act: A public PoC against a critical PHP RCE means in-the-wild exploitation attempts are likely imminent or already underway; sweep web server and WAF logs for anomalous POST patterns targeting PHP session/upload endpoints and tune IDS rules to catch PHP shell drop attempts.
- Leader — Plan: PHP underpins a large fraction of web infrastructure — confirm whether your org or key SaaS vendors run PHP-based apps, and ensure engineering has this on an emergency patch track this week before KEV listing and broader exploitation force a reactive posture.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources
- Engineer — Act: Public PoCs exist on GitHub for both critical RCE flaws in PHP, which is widely deployed across web servers and CMS stacks; patch PHP to the latest patched release immediately and check whether PHP-FPM or CGI mode configurations are specifically exposed.
- SOC/IR — Act: With public PoCs live and multi-source corroboration, active exploitation of these PHP RCE flaws is likely imminent; hunt for anomalous web server child-process spawning and web shell artifacts in document roots since at least the PoC publication date.
- Leader — Plan: Critical PHP RCEs with public PoCs in a language powering a large share of web infrastructure warrant confirming organisational PHP exposure and verifying engineering has the patch cycle underway this week; not yet KEV-listed or at Log4Shell-scale, but monitor in case it escalates to a board-question event.
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Plan: The CISA/FBI advisory likely details SafePay’s initial access methods and hardening mitigations; review the full advisory for affected software and apply recommended mitigations this quarter.
- SOC/IR — Act: Pull the CISA/FBI SafePay advisory for published IOCs and ATT&CK-mapped TTPs, sweep logs back to 2024 for matching indicators, and tune ransomware detection rules against the described behavioral patterns.
- Leader — Act: 600+ critical infrastructure victims under a formal CISA/FBI advisory is board-question territory; confirm whether your organization or key vendors are among the affected and brief leadership before they see this in the news.
- Engineer — Act: Audit your certificate inventory for any eMudhra-issued certs; all major browsers have revoked trust, so any in-use certs will cause immediate user-facing trust errors and service disruptions that require emergency replacement.
- SOC/IR — Learn: The ability to instantly recover eMudhra intermediate private keys means adversaries could have forged trusted certs for MITM; no IOCs or confirmed exploitation are disclosed, so this informs defensive design thinking but has no actionable hunt surface today.
- Leader — Plan: Confirm with engineering whether any customer-facing or internal services rely on eMudhra-issued certificates, as browser distrust is already in effect and could cause visible service failures; this quarter, validate your CA inventory and vendor-certificate oversight process.
- Engineer — Act: PAN-OS is a common enterprise perimeter device; CISA KEV listing, EPSS 0.97, public PoC, and active ransomware exploitation all demand immediate action — patch PAN-OS to the vendor-specified fixed version now, and audit firewall management interfaces for signs of compromise before patching.
- SOC/IR — Act: Edge device exploitation by Qilin/Inc ransomware operators means assume-breach posture is warranted — sweep for IOCs published in the Unit 42 advisory, hunt for lateral movement or data staging activity originating from PAN-OS management plane since October 19, and tune EDR/SIEM for post-exploitation TTPs associated with these ransomware groups.
- Leader — Act: Active ransomware exploitation of a widely deployed enterprise firewall platform is a board-question-level event — confirm this week whether PAN-OS is in your estate, verify IR team is on heightened alert, and prepare a brief for leadership given the ransomware operators named are known for extortion and data theft.
- Signals: CVE-2026-0257 — CISA KEV: listed, EPSS 0.97, public PoC on GitHub
- Engineer — Act: Official-channel supply-chain compromise means any Rank Math PRO install fetched last week may carry a backdoor; immediately audit all WordPress sites for the plugin’s presence, remove or replace with a verified clean version, and inspect for indicators of hidden backdoor files or unauthorized admin accounts.
- SOC/IR — Plan: No IOCs or TTPs are published yet, blocking immediate hunting; plan to draft WordPress-focused detection rules (anomalous plugin file writes, unexpected admin account creation) and queue a sweep of WordPress estates as soon as vendor or community publishes specific file hashes or behavioral indicators.
- Leader — Plan: Confirm with web and platform teams whether any company-owned WordPress properties run Rank Math PRO, and request a clean-bill attestation or removal; if third-party vendors host affected sites on your behalf, initiate vendor risk follow-up this week.
- Engineer — Act: Active exploitation began within a day of PoC publication; patch Plex Media Server to the latest available release immediately, or block external access to the Plex port until patching is possible.
- SOC/IR — Act: Exploitation is live with known payload types — hunt for anomalous CPU-intensive child processes spawned by the Plex service and unusual outbound proxy/tunnel connections on hosts running Plex since the PoC release date.
- Leader — Skip
- Engineer — Act: If any developer or CI pipeline downloaded the OVHcloud CLI between 12:47–14:21 UTC on October 19, treat that machine as compromised: rotate all secrets stored on disk (API keys, cloud credentials, SSH keys) and audit for any use of those credentials after that window.
- SOC/IR — Act: Hunt across all endpoints for execution of the OVHcloud CLI tool during the 94-minute compromise window; follow up with anomaly detection on credential file access patterns and downstream use of any credentials present on affected machines.
- Leader — Act: If your organization uses OVHcloud, immediately determine whether any engineers or pipelines pulled the CLI tool during the affected window; if exposure is confirmed, treat it as a potential credential-theft incident and invoke your IR process before stolen keys are used.
- Engineer — Act: Confirmed supply-chain compromise of a developer CLI tool; audit all developer machines for the backdoored OVHcloud CLI version and immediately rotate any API keys, tokens, or credentials that the tool could have accessed.
- SOC/IR — Plan: Active info-stealer deployed via compromised CLI; without published IOCs, queue a hunt for anomalous credential access or exfiltration activity originating from developer endpoints that run cloud CLI tooling.
- Leader — Act: A cloud provider’s official CLI was weaponized to steal developer secrets — confirm this week whether engineering teams use OVHcloud CLI and request OVHcloud’s incident report detailing which versions were affected and what credentials may be at risk.
- Engineer — Act: Any Go service built before 1.27.3/1.26.10 may break TLS connections to hosts whose certificates chain through the blocked CA keys — or vice versa. Upgrade Go to 1.27.3 or 1.26.10 and run integration tests against your outbound TLS dependencies before deploying, to catch breakage before production.
- SOC/IR — Learn: No exploitation angle and no IOCs to hunt; however, awareness helps analysts triage a spike in TLS handshake failures in application logs that may follow this Go rollout across the ecosystem.
- Leader — Skip
- Engineer — Plan: No CVE or exploit detail, but the federal ban is a strong signal to audit whether any DeepSeek models or APIs are embedded in your systems, pipelines, or developer tooling — and plan removal if found.
- SOC/IR — Skip
- Leader — Act: A DHS-level ban signals data-security or espionage concerns serious enough to prompt board and customer questions this week — determine whether your organization uses any DeepSeek products and brief leadership before they ask.
- Engineer — Act: If you use ConnectWise Cloud Backup or any ConnectWise integration, treat your application credentials as potentially compromised — audit all API keys and service accounts tied to ConnectWise products and rotate any that weren’t already force-reset by the vendor.
- SOC/IR — Act: ConnectWise has deep access to managed environments; if any ConnectWise agent or integration operates in your estate, initiate an assume-breach sweep for anomalous activity from those service accounts since the incident began, even absent published IOCs.
- Leader — Act: Confirm whether your organization or an MSP you depend on uses ConnectWise Cloud Backup, then request a formal incident attestation from ConnectWise; the service remains offline, which may affect your RTO/RPO commitments and warrants a backup-continuity briefing to leadership.
- Engineer — Plan: Siemens Software Center is niche industrial software, but the DLL sideloading vector with a public PoC and active exploitation warrants a check: audit whether Siemens Software Center is present in your estate and patch to the fixed version; the ClickFix delivery chain also means reviewing write-access to directories alongside software installs.
- SOC/IR — Act: An active ClickFix campaign is deploying RATs via DLL sideloading in Siemens Software Center directories — hunt for ClickFix lure artifacts (clipboard-hijack/fake CAPTCHA precursors), anomalous DLL loads from Siemens app paths, and RAT beaconing behavior since the campaign was disclosed.
- Leader — Learn: Active RAT deployment via social engineering against industrial software management tooling is worth noting for OT/manufacturing-sector risk registers, but this is not a systemic event requiring immediate leadership action unless Siemens software is confirmed in your environment.
- Signals: CVE-2026-110936 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: If AOMEI backup products are in your environment, audit endpoints that ran the software during the compromise window for malware indicators and verify current update server integrity; no KEV or PoC signals yet to escalate to Act.
- SOC/IR — Act: Sweep endpoints running AOMEI backup software for unexpected processes or outbound connections spawned during the compromise window; hunt for lateral movement from hosts where the promotional feature may have delivered a payload.
- Leader — Learn: A reminder that backup and recovery tooling is an attractive supply-chain vector; no broad systemic impact confirmed yet, but file for vendor risk review discussions around update-mechanism security in critical software.
- Engineer — Skip
- SOC/IR — Learn: Retail sector disruption with cross-continental impact; no IOCs or TTPs published yet — monitor for follow-on technical disclosures to inform detection work.
- Leader — Act: Major retail-sector breach with operational disruption across two regions; brief leadership now before board or customer questions arise, and verify whether any shared SaaS vendors or logistics partners overlap with your supply chain.
- Engineer — Act: Any WordPress site that installed or activated Rank Math PRO between 20:02 UTC Oct 15 and 07:12 UTC Oct 16 should be treated as fully compromised; audit all WordPress deployments for that plugin version and initiate full incident response including checking for the self-restoring persistence mechanism.
- SOC/IR — Act: Sweep all monitored WordPress environments for Rank Math PRO installs or updates within the compromised window and apply assume-breach posture to any hits; the self-restoring backdoor means passive log review is insufficient — active host investigation is needed.
- Leader — Act: Confirm whether any company-owned or agency-managed web properties use Rank Math PRO and whether they were updated during the October 15–16 window; if exposure exists, initiate IR and assess whether customer-facing sites may have been serving malicious content.
- Engineer — Act: If your team stored OpenAI, Anthropic, or Google API keys in OpenCode Console, treat them as compromised: revoke and reissue those keys immediately, then audit provider dashboards for unauthorized calls since October 16.
- SOC/IR — Act: For any org using OpenCode Console, hunt for anomalous AI provider API usage (unexpected spikes in calls, unfamiliar IP origins, unexpected cost) in OpenAI/Anthropic/Google dashboards and SIEM from October 16 onward, assuming keys may be in adversary hands.
- Leader — Act: Confirm whether your organization uses OpenCode Console; if so, request an incident report from OpenCode and have engineering rotate all affected AI provider keys this week — exposure of these keys can result in significant unauthorized spend or data access via AI APIs.
- Engineer — Act: This is an active supply-chain attack delivered through npm packages targeting developers with AI-credit lures — directly in scope for anyone managing a Node.js dependency tree. Audit recently added npm packages against known-good lockfiles and brief developers to treat unsolicited Web3/AI accelerator invitations as a red flag.
- SOC/IR — Plan: The campaign deposits infostealers and backdoors on developer endpoints; no specific IOCs are published in this summary, but the TTP warrants building or tuning detections for anomalous npm install activity followed by credential-access or outbound C2 behavior on developer workstations.
- Leader — Learn: This campaign illustrates a growing AI-lure social-engineering pattern aimed specifically at technical staff; no immediate leadership action is required, but it provides useful framing for updating developer-focused security awareness content.
- Engineer — Act: FortiSandbox unauthenticated command injection is CISA KEV-listed with EPSS 0.76 and a public PoC — patch to the vendor-issued fixed version immediately, or isolate the appliance from untrusted network access if patching cannot be done within your window.
- SOC/IR — Act: With a public PoC and active exploitation implied by KEV listing, hunt for anomalous outbound connections or unexpected process execution from FortiSandbox hosts; check for command injection attempts in appliance logs since the CVE disclosure date.
- Leader — Plan: This is a critical edge-appliance RCE at the active-exploitation threshold, but it is a routine patch-and-remediate event unless your org runs FortiSandbox — confirm with engineering whether it is in scope and verify remediation is on track.
- Signals: CVE-2026-25089 — CISA KEV: listed, EPSS 0.76, public PoC on GitHub
- Engineer — Act: Active exploitation of an OS command injection flaw in SiteGuard Server Edition grants full system access; if you run this WAF, apply the vendor patch immediately or isolate the appliance until patched.
- SOC/IR — Plan: Active exploitation is confirmed but the summary lacks published IOCs or ATT&CK-mapped TTPs; build a detection for anomalous process spawning from the SiteGuard service account and queue a hunt across any SiteGuard hosts in your estate.
- Leader — Skip
- Engineer — Act: If ConnectWise Cloud Backup or any of the seven disabled application identities are authorized in your Azure AD/Entra tenant, immediately revoke those OAuth consent grants and audit M365 unified audit logs for unauthorized data access using the published application identity GUIDs.
- SOC/IR — Act: Hunt M365/Entra audit logs for activity by the compromised ConnectWise application identity GUIDs (e.g., 506e08f9-6e9a-4da4-942b-a099a03644ae) — focus on anomalous OAuth token issuance, mailbox access, and SharePoint reads since the earliest possible compromise window.
- Leader — Act: Confirm whether ConnectWise Cloud Backup or related products are used by your organization; if so, request ConnectWise’s incident report, assess M365 tenant exposure, and evaluate whether any data access triggers breach-notification obligations.
- Engineer — Act: Organizations using ConnectWise Cloud Backup (formerly SkyKick) should immediately audit M365 OAuth application permissions and service principal activity for unauthorized delegated access; revoke any ConnectWise-related app registrations until the vendor confirms scope and remediation.
- SOC/IR — Act: Hunt M365 unified audit logs and Entra ID sign-in logs for anomalous OAuth app consent events or application identity authentications tied to ConnectWise/SkyKick since the compromise window; treat impacted tenants as assume-breach and sweep for mailbox rule creation, exfiltration signals, and new delegated permissions.
- Leader — Act: Confirm this week whether your organization or your MSP uses ConnectWise Cloud Backup, then request ConnectWise’s incident report and attestation of scope; assess whether compromised M365 tenant data triggers disclosure obligations under SEC, GDPR, or applicable state rules.
- Engineer — Act: Active supply-chain threat still live on npm; audit all dependency trees (including transitives) for ‘imgdecode’ and remove it immediately if found, then scan CI/CD build logs for any unexpected native addon compilation on Windows hosts.
- SOC/IR — Act: Hunt for ‘imgdecode’ in software inventories and package-lock/yarn.lock files across the estate; on Windows endpoints, look for anomalous child processes spawned under node.exe as a behavioral indicator of the shellcode loader executing.
- Leader — Learn: Another npm supply-chain implant in a live campaign (MALFEX) reinforces the risk of unvetted open-source dependencies; useful justification for prioritizing software composition analysis (SCA) tooling investment if not already in place.
- Engineer — Act: A public PoC on GitHub makes exploitation practical despite the low EPSS; RCE on an e-commerce server likely handling payment data warrants immediate action. Update or remove the BlockStrap plugin on all Magento/Adobe Commerce instances and verify no post-exploitation artifacts exist.
- SOC/IR — Plan: No confirmed active exploitation yet, but a public PoC means attacks could begin soon. Build or tune detections for anomalous PHP execution and unexpected outbound connections from Magento web server processes in preparation for exploitation attempts.
- Leader — Skip
- Signals: CVE-2026-103849 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: If your org or your MSP uses ConnectWise Cloud Backup (formerly SkyKick), audit M365 unified audit logs and sign-in logs immediately for delegated-access activity from ConnectWise service accounts, and review/revoke any delegated admin permissions granted to ConnectWise.
- SOC/IR — Act: Active campaign accessing M365 tenants via compromised MSP tool credentials — hunt M365 sign-in logs for authentication events tied to ConnectWise Cloud Backup service principals or delegated admin access since this campaign began, and alert on anomalous third-party delegated logins.
- Leader — Act: If your organization uses an MSP that relies on ConnectWise Cloud Backup, confirm your exposure this week by requesting an attestation from that vendor; 173 confirmed tenant compromises via a single supply-chain credential is a board-question-level supply chain trust event.
- Engineer — Act: Supply-chain compromise of a popular Windows backup utility’s update mechanism meets Act criteria regardless of KEV listing — corroborated by Google TIG and Mandiant. Audit all systems running AOMEI Backupper for backdoor IOCs and check whether any update checks occurred during May–July 2026 attack windows.
- SOC/IR — Act: Confirmed backdoor delivery via tampered update server with Mandiant and Google TIG involvement implies IOCs are available or imminent. Hunt for suspicious processes or persistence artifacts on hosts with AOMEI Backupper installed that were active May–July 2026, and watch for published IOC sets from these investigations.
- Leader — Act: A supply-chain backdoor in widely deployed backup software investigated by Mandiant and Google TIG is board-question territory. Confirm whether AOMEI Backupper is present in your environment, scope which systems may have updated during the attack window, and prepare a brief before this surfaces in mainstream news.
- Engineer — Act: If AOMEI backup/disk utilities are deployed in your environment, audit endpoints and build systems for CROSSROAD downloader or SHINYROAD backdoor indicators; the 5–10 minute tampering windows mean file-integrity scans at rest may have missed the delivery.
- SOC/IR — Act: Hunt for CROSSROAD and SHINYROAD IOCs on hosts that could have fetched AOMEI updates between April and July 2026; standard hash-based detection likely missed the ephemeral delivery window, so focus on behavioral indicators (unusual parent-child process chains post-update, unexpected staging domain connections).
- Leader — Act: Confirm whether AOMEI software is in use anywhere in your environment and request Mandiant’s full IOC set to verify exposure; the novel evasion technique (auto-reverting tampering windows) is a systemic supply chain risk worth briefing leadership on as evidence that static compliance checks alone are insufficient.
- Engineer — Act: A public PoC on GitHub for a critical Linux kernel networking flaw that enables VM-to-host memory reads demands immediate action for anyone running Linux-based virtualization or multi-tenant workloads — patch the Linux kernel to the fixed version as soon as your distribution releases it, and prioritize multi-tenant or shared-compute environments first.
- SOC/IR — Plan: No active campaign IOCs are published and EPSS is 0.00, but a public PoC raises the likelihood of imminent weaponization; build or stage detections for anomalous kernel exploit behavior (e.g., unexpected privilege escalation from guest processes, abnormal memory access syscalls) and establish a hunt playbook before exploitation picks up.
- Leader — Plan: The flaw is confirmed against Vercel’s production environment and is systemic across Linux-based cloud infrastructure — this quarter, verify patch timelines with your primary IaaS and PaaS cloud vendors, and assess whether any multi-tenant workloads could expose customer data if a host is compromised.
- Signals: CVE-2026-99999 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Active exploitation of CVE-2025-61624 on FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager is confirmed; patch all affected Fortinet products immediately and audit edge device logs for signs of PEERSTITCH deployment.
- SOC/IR — Act: Memory-resident malware on edge devices evades most endpoint controls — assume compromise if Fortinet appliances are in scope; hunt for anomalous outbound traffic or process anomalies on FortiOS devices and sweep for PEERSTITCH IOCs published with this campaign.
- Leader — Plan: Advanced actor activity against widely deployed Fortinet edge infrastructure warrants confirming this quarter whether all Fortinet appliances are patched and whether incident response runbooks cover memory-resident implants on network devices.
- Signals: CVE-2025-61624 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active exploitation of CVE-2026-110447 in the richdocumentscode Nextcloud app with a public PoC means any self-hosted Nextcloud instance running the built-in CODE Server is at immediate risk of RCE and backdoor implantation; patch the richdocumentscode app to the latest fixed version now and audit server filesystem and process history for signs of post-exploitation activity.
- SOC/IR — Act: With confirmed active exploitation leading to backdoor deployment, assume any Nextcloud server running richdocumentscode may already be compromised; sweep Nextcloud hosts for anomalous child processes from the CODE Server, unexpected outbound connections, and persistence mechanisms (cron, systemd units, webshells) established since this CVE’s disclosure window.
- Leader — Skip
- Signals: CVE-2026-110447 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: BeyondTrust Remote Support is a PAM/privileged access tool common in enterprise environments; active exploitation since late August means exposure window is already months long — patch immediately and audit RS session logs since late August for unauthorized activity.
- SOC/IR — Act: PAM/remote-support appliances are high-value pivot points; treat any BeyondTrust RS instance as potentially compromised since late August — hunt for anomalous privileged sessions, unexpected account creation, or lateral movement originating from RS hosts.
- Leader — Act: Confirm whether BeyondTrust Remote Support is in your environment, request a vendor attestation on incident scope, and brief leadership — a compromised PAM tool implies potential access to all systems it manages, which is a material risk requiring same-week escalation.
- Engineer — Act: Active zero-day exploitation with a public PoC on GitHub and CVSS 9.3 — patch BeyondTrust Remote Support immediately and audit access logs for unauthorized sessions dating back to late August 2026.
- SOC/IR — Act: Armory Castle (China-nexus, formerly UNC5221) actively exploited this for remote support server takeover — hunt for anomalous sessions or lateral movement originating from BeyondTrust infrastructure since late August 2026 and sweep for any published IOCs from this campaign.
- Leader — Act: A China-linked espionage group used this as a zero-day against remote support servers — confirm whether your organization runs BeyondTrust Remote Support, request a vendor statement on incident scope and affected versions, and brief leadership before this surfaces in broader news coverage.
- Signals: CVE-2026-102764 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: BeyondTrust Remote Support appliances are confirmed exploited in the wild via arbitrary file upload (CVE-2026-102764); a public PoC is on GitHub and Mandiant’s IR confirms active exploitation since August 2026 — patch immediately and audit appliance logs (access, syslog, messages, thin-scc, brain, SSL) for evidence of post-exploitation activity.
- SOC/IR — Act: Mandiant’s IR engagement documents ARMORY CASTLE (formerly UNC5221) privilege escalation and persistence on compromised BeyondTrust appliances — hunt for anomalous activity in those appliance log files dating back to late August 2026 and prepare detections for broader opportunistic exploitation expected post-disclosure.
- Leader — Act: A named PRC-nexus espionage actor exploited this enterprise remote-access product as a zero-day for weeks before disclosure; confirm whether your organization runs BeyondTrust Remote Support, verify patch and compromise-check status with your team, and prepare a brief for leadership ahead of likely broader news coverage.
- Signals: CVE-2026-102764 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2024-47575 is KEV-listed with EPSS 0.95 and a public PoC; patch FortiManager immediately to the vendor-fixed release, then audit FortiGate devices for PEERSTITCH IOCs published in the Unit 42 report.
- SOC/IR — Act: Memory-resident implant on a network edge device means assume-breach posture: sweep firewall estate for PEERSTITCH IOCs from the Unit 42 post, hunt for post-exploitation lateral movement originating from FortiGate/FortiManager hosts since the CVE disclosure window (late 2024 onward).
- Leader — Act: Over 500 firewalls were compromised in this campaign; confirm whether your organization runs FortiManager, assess whether you fall within the affected population, and brief leadership before this surfaces in mainstream news — board questions are likely given the scale.
- Signals: CVE-2024-47575 — CISA KEV: listed, EPSS 0.95, public PoC on GitHub
- Engineer — Act: CISA KEV listed plus a public PoC and confirmed active exploitation make this urgent — apply the PAN-OS patch immediately and restrict management interface access to trusted IP ranges only.
- SOC/IR — Act: Active exploitation of a perimeter security appliance warrants an assume-breach posture — hunt for anomalous management-plane activity and lateral movement from PAN-OS devices dating back to initial disclosure.
- Leader — Act: PAN-OS is perimeter infrastructure for many enterprises; confirm whether it is in use, verify engineering has an emergency patch window in progress, and be ready to respond to customer or board questions given the CISA KEV designation and confirmed active exploitation.
- Signals: CVE-2026-0322 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV-listed, public PoC on GitHub, and confirmed active exploitation against PAN-OS firewalls — apply Palo Alto’s security updates immediately and verify no unauthorized access occurred pre-patch.
- SOC/IR — Act: Active exploitation of a perimeter firewall device warrants an assume-breach sweep — hunt for lateral movement or unusual outbound traffic from PAN-OS management IPs since the disclosure date, and tune detections for post-exploitation behavior on adjacent segments.
- Leader — Act: Actively exploited RCE on a widely deployed perimeter control warrants same-week action — confirm which sites run PAN-OS, verify patching is underway, and be ready to brief leadership if any firewall shows signs of compromise.
- Signals: CVE-2026-0322 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Public PoC and 1,423 honeypot exploitation attempts confirm active in-the-wild attacks against Langflow (CVSS 9.9); if you run Langflow for AI workflow development, patch immediately or restrict access to authenticated users on trusted networks.
- SOC/IR — Act: Active exploitation campaign with over 1,400 observed attempts warrants an immediate sweep of internal and exposed Langflow instances for compromise indicators; hunt for unusual outbound connections or code execution from Langflow processes since the PoC became public.
- Leader — Plan: If your organization has AI/ML engineering teams building agentic workflows, confirm whether Langflow is in use and verify patching status — active exploitation is confirmed but the blast radius is limited to teams that have deployed this platform.
- Signals: CVE-2026-105740 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Active campaign extracted CI secrets from public repositories on October 8-9; audit all public repos for exposed secrets in CI config files and rotate GitHub PATs and any credentials stored in workflows immediately.
- SOC/IR — Act: Campaign has a tight activity window (Oct 8-9); hunt for unauthorized GitHub OAuth activity, anomalous CI/CD pipeline triggers, and unexpected secret-access events in organizational repos since that date.
- Leader — Act: Approximately 1,900 accounts compromised at scale warrants a same-week check: confirm with engineering whether any organizational GitHub accounts were among those affected and request an audit of CI secret exposure before this surfaces as a supply-chain incident.
- Engineer — Learn: No patch or config action, but this reinforces zero-trust principles for remote/contractor access — review least-privilege provisioning and device trust requirements for any outsourced development roles.
- SOC/IR — Plan: No IOCs were published in this report, but the Famous Chollima IT worker pattern warrants building detections: flag remote workers whose session IPs route through VPNs/proxies inconsistent with claimed location, and look for credential reuse across multiple contractor accounts.
- Leader — Act: Conduct a same-week review of remote contractors and outsourced developers against DPRK IT worker behavioral indicators (inconsistent timezones, forwarded pay, proxy-masked locations), and brief HR and legal before board or customer inquiries surface.
- Engineer — Act: If you run Drupal with contributed modules, patch immediately to 11.4.10, 11.3.19, or 10.6.19; at least one unauthenticated exploit path is known. Audit which contributed modules are enabled and prioritize sites with public-facing Field UI exposure.
- SOC/IR — Learn: No published IOCs or ATT&CK-mapped TTPs in this advisory; monitor for exploitation reports against Drupal-hosted assets and be ready to hunt for web shell drops on CMS servers if active exploitation is confirmed.
- Leader — Skip
- Engineer — Act: Active exploitation confirmed with web shells planted on Nextcloud servers since at least September 10. If you run Nextcloud with the Collabora Online Built-in CODE Server app, audit for web shell files in the web root and disable or patch the plugin immediately.
- SOC/IR — Act: Confirmed active exploitation with web shell deployment provides a concrete hunt target — sweep Nextcloud server logs for anomalous command execution spawned by the web server process dating back to September 10, and look for unauthorized files in Nextcloud’s web-accessible directories.
- Leader — Plan: Active backdooring of Nextcloud deployments via an optional collaboration plugin is a real risk if the organization runs self-hosted Nextcloud — confirm with engineering whether this plugin is in use and that incident response is underway; not yet a board-level event.
- Engineer — Act: Unauthenticated root RCE on a perimeter email appliance under active exploitation demands emergency patching outside normal windows; upgrade Cisco SEG to the fixed release immediately and audit appliance integrity post-patch.
- SOC/IR — Act: Active exploitation of a perimeter device warrants an assume-breach sweep: review Cisco SEG logs for anomalous process execution, unexpected admin accounts, or unusual outbound connections since before the patch advisory date.
- Leader — Act: Confirm this week whether the organization runs Cisco SEG and verify that engineering has initiated emergency patching; an actively exploited unauthenticated RCE on the email gateway is a plausible breach vector requiring same-week tracking.
- Engineer — Act: Unauthenticated file write via crafted email attachment yielding root code execution on a common perimeter appliance is being actively exploited — patch Cisco Secure Email Gateway to Cisco’s fixed version immediately, and if patching cannot happen today, consider restricting inbound attachment processing or isolating the appliance.
- SOC/IR — Act: Active exploitation of an edge email appliance means assume-breach posture: sweep Cisco SEG devices for unexpected OS file writes and anomalous root-level process execution since the advisory date, and check email logs for unusual attachments that passed through the gateway.
- Leader — Act: Cisco Secure Email Gateway is widely deployed across enterprise environments; active exploitation of a perimeter email device handling sensitive communications warrants confirming whether your organization runs it and directing engineering to apply the emergency patch before end of day.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation deploying web shells and XMRig miners; update AhsayCBS to the latest patched release immediately and audit backup servers for existing web shell artifacts in the application directories.
- SOC/IR — Act: Active exploitation is dropping web shells and XMRig miners on AhsayCBS hosts — hunt for unexpected files in backup application directories, anomalous outbound connections to mining pools, and lateral movement from backup server accounts since the initial disclosure date.
- Leader — Skip
- Signals: CVE-2026-105133 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub · CVE-2026-105134 — CISA KEV: listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: One CVE in this cycle is confirmed actively exploited; identify that vulnerability via MSRC and expedite patching of affected Microsoft/Windows systems ahead of routine patch window.
- SOC/IR — Plan: Once Microsoft publishes exploitation details for the in-the-wild CVE, build or tune detections and run a hunt for exploitation artifacts on Windows endpoints since the pre-patch disclosure date.
- Leader — Plan: A 1,400+ CVE cycle with one confirmed zero-day warrants confirming your patching prioritization process is running; track the exploited CVE to assess whether its scope merits a risk register update or customer communication.
- Engineer — Act: Apply the October 2026 Patch Tuesday updates promptly, prioritizing the actively exploited Windows Shell privilege-escalation flaw; also review SharePoint Server and SQL Server patches given their presence in many enterprise stacks.
- SOC/IR — Plan: No IOCs or TTPs are provided for the actively exploited Windows Shell bug yet; build a detection for unusual shell process spawning and monitor for Microsoft or third-party actor analysis that surfaces specific exploitation signatures.
- Leader — Learn: A record patch volume signals growing Windows attack surface but no board-level event unless the exploited flaw escalates to a named, widespread incident — watch for follow-on reporting before escalating internally.
- Engineer — Act: Public PoC on GitHub for a local-to-root kernel bug that also enables guest-to-host escape in KVM/QEMU setups; patch the Linux kernel to a fixed version immediately, and prioritize hosts serving as hypervisors or multi-tenant virtualization platforms given the escape vector.
- SOC/IR — Plan: With a public PoC live, build or tune detections for unusual vhost/IOCTL activity and unexpected privilege escalation sequences on Linux hosts; also consider hunting for anomalous VM-to-host memory access patterns in hypervisor telemetry if your EDR covers them.
- Leader — Learn: A serious kernel LPE with a VM escape angle, but not KEV-listed and no reported in-the-wild exploitation yet; worth understanding exposure in your virtualization estate — escalate to Act if exploitation activity is confirmed or if you operate multi-tenant cloud infrastructure.
- Signals: CVE-2026-74580 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A public PoC on GitHub makes exploitation of this critical heap buffer overflow practical; audit any server-side document or image-processing pipelines that invoke Ghostscript, and patch to the fixed version immediately or restrict PDF upload endpoints until patching is complete.
- SOC/IR — Plan: No active exploitation reported yet, but the public PoC shortens the window; build detections for anomalous Ghostscript process behavior — unexpected child process spawning or outbound network calls from Ghostscript — and baseline normal document-processing activity now.
- Leader — Skip
- Signals: CVE-2026-39919 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: A public PoC demonstrating client-side code execution exists; curl is present in virtually every container base image, CI/CD runner, and server. Patch to curl 8.23.0 now — check container base images, pipeline runners, and any service that uploads via HTTP/2.
- SOC/IR — Learn: No IOCs, no active exploitation reported, and the attack surface (malicious server exploiting an uploading client) offers limited detection opportunity; understanding the attack vector is useful for triage context if crashes or anomalous curl behavior surface later.
- Leader — Skip
- Engineer — Act: Ivanti Connect Secure is a widely deployed VPN appliance now under active zero-day exploitation; patch immediately and audit device logs and downstream network activity for signs of pre-patch compromise going back to October 1.
- SOC/IR — Act: Active exploitation of an edge VPN appliance demands an assume-breach posture — hunt for lateral movement or credential harvesting originating from ICS appliances in your estate since at least October 1, and check for anomalous outbound sessions from those hosts.
- Leader — Act: A CISA emergency advisory on a widely used VPN product with confirmed zero-day exploitation since October 1 warrants a same-week check: confirm whether Ivanti Connect Secure is in your environment, verify patch status with your team, and be ready to brief leadership if a breach window is identified.
- Engineer — Act: CVE-2026-104935 is CISA KEV-listed with a public GitHub PoC and confirmed honeypot exploitation — if you run Ivanti Connect Secure, patch to the latest version immediately and audit authentication logs for anomalous access patterns prior to patch deployment.
- SOC/IR — Act: Active exploitation of an edge VPN appliance warrants an assume-breach posture — hunt for anomalous authentication events on ICS gateways since disclosure, and sweep for lateral movement indicators originating from VPN-assigned IPs, particularly over the past week.
- Leader — Act: A CISA KEV-listed authentication bypass in a widely deployed enterprise VPN with confirmed active exploitation is a material risk event — confirm whether Ivanti Connect Secure is in your environment, verify patching is escalated to this week, and prepare a brief for leadership if it is deployed.
- Signals: CVE-2026-104935 — CISA KEV: listed, EPSS 0.26, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Learn: Retail-sector incident with limited technical detail released; monitor BleepingComputer and TFG disclosures for IOCs or TTPs if your organization shares supply chain or vendor relationships with premium fashion brands.
- Leader — Act: If TFG London or its brands (Phase Eight, Hobbs, Whistles) are a vendor or partner, contact them this week to request an incident scope statement and confirm whether shared systems or customer data are affected.
- Engineer — Act: Ivanti Connect Secure is a common enterprise VPN gateway with a history of nation-state targeting; active exploitation with a vendor-issued patch means patch immediately per Ivanti’s advisory and audit appliance logs for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation of an edge VPN appliance warrants an assume-breach sweep: hunt for unauthorized sessions, anomalous authentication events, or lateral movement originating from ICS gateway IPs since the vulnerability’s disclosure window.
- Leader — Act: A zero-day in a widely-deployed remote access gateway being actively exploited is a board-question-level event; confirm this week whether ICS is in your environment, verify patching is under way, and assess whether any compromise could trigger SEC or GDPR notification obligations.
- Engineer — Act: If you maintain npm packages using trusted publishing, audit version history for any unauthorized releases pushed during the vulnerable window, and verify all pending trusted publishing configurations are validated or removed before the 48-hour expiry kicks in.
- SOC/IR — Plan: No confirmed exploitation or published IOCs, but this is worth building a detection: create coverage for unexpected npm package version bumps in your CI/CD pipelines and dependency scanning alerts tied to packages your org consumes or publishes.
- Leader — Plan: Over 1,500 packages were exposed to potential hijacking without credential theft — a notable supply chain risk; this quarter, confirm whether your teams publish npm packages via trusted publishing and assess whether your SCA tooling would catch a malicious version injection.
- Engineer — Act: Active exploitation plus a public PoC on GitHub means any WordPress instance running Bricksforge is at immediate risk; update the plugin to the patched version now or disable it entirely while you assess impact.
- SOC/IR — Act: Assume-breach sweep is warranted for any WordPress infrastructure: hunt for newly written PHP files under wp-content/plugins/bricksforge/, review web server logs for unauthenticated POST requests to plugin endpoints, and search EDR/SIEM for web shell execution patterns since the PoC dropped.
- Leader — Skip
- Signals: CVE-2026-85097 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: SonicWall SMA 1000 is a common enterprise remote-access appliance; a public PoC and 135 observed exploitation attempts within days of disclosure override the low EPSS score. Patch to the vendor-issued fixed version immediately and audit appliance logs for SSRF-originated outbound requests.
- SOC/IR — Act: Active exploitation of an edge VPN appliance with a public PoC warrants an assume-breach posture; hunt for anomalous outbound requests originating from SMA 1000 appliances since the vulnerability was disclosed, and check for follow-on lateral movement indicators from those hosts.
- Leader — Act: Confirm this week whether SonicWall SMA 1000 is in the estate; active exploitation of a CVSS 10 remote-access appliance means potential full-network-access exposure, and the patch status should be verified before the weekend given the publicly available exploit code.
- Signals: CVE-2026-102255 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Active supply-chain campaign injecting credential-stealing workflows into popular open-source repos you may depend on; audit all GitHub Actions workflow files in your dependency graph for unexpected changes and scan recent CI/CD build logs for credential exfiltration activity.
- SOC/IR — Act: Ongoing campaign with named compromised accounts (e.g., pyxel maintainer) and a known campaign start timestamp; hunt for anomalous outbound connections or secret access events from CI runners since mid-October and check for workflow file changes in repos your build pipelines consume.
- Leader — Plan: A large-scale supply-chain attack targeting CI/CD secrets across 340+ repositories warrants a this-quarter review; direct engineering to inventory critical OSS dependencies and assess whether any build pipelines may have been exposed to the malicious workflows.
- Engineer — Learn: No exploitable vulnerability here, but the revelation that a ransomware negotiation firm may have had undisclosed ties to a threat actor is worth understanding as a supply-chain trust issue — particularly for incident response tooling vendor selection.
- SOC/IR — Learn: ShinyHunters remains an active data-theft group; this arrest surfaces new context about their operational reach including alleged compromise of FBI agent records — useful for refreshing threat-actor profiles, but no IOCs or TTPs are published to act on now.
- Leader — Act: If your organization has ever engaged a ransomware negotiation firm, verify that vendor’s ownership and vetting history; the arrest raises broader questions about conflict of interest in the negotiation-firm sector that warrant immediate third-party due diligence.
- Engineer — Act: Public PoC on GitHub for a local privilege-escalation to root on Linux — patch the kernel on all Linux hosts and container nodes this sprint; verify your distro’s advisory for the patched version.
- SOC/IR — Plan: Public PoC makes this worth building a PrivEsc detection (watch for unexpected uid-change events following non-root process activity) before opportunistic use picks up; no active campaign confirmed yet.
- Leader — Skip
- Signals: CVE-2026-43284 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Learn: Provides context on the FBI’s ongoing action against the ShinyHunters group, but this item contains no IOCs, TTPs, or detection opportunities — useful only for actor-tracking background.
- Leader — Act: An executive at a ransomware negotiation firm is alleged to have engaged in extortion tied to ShinyHunters; if your organization uses external negotiation or IR retainer firms, audit those relationships now and brief leadership before they encounter this story externally.
- Engineer — Act: Starlette is the ASGI foundation under FastAPI and many Python web stacks; CISA KEV listing confirms active exploitation. Identify all services running Starlette, patch to the fixed version immediately, and audit request logs for anomalous Host header values as a signs-of-compromise check.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation of this host-header bypass; hunt for requests with unexpected or spoofed Host header values in web application and reverse-proxy logs dating back at least 30 days, then tune WAF or detection rules to alert on further attempts.
- Leader — Plan: Despite active exploitation, this is an engineering-tier patch event rather than a board-level systemic event — task your AppSec team this week to enumerate all internal and customer-facing services built on Starlette or FastAPI and confirm patching is on track before the next sprint cycle.
- Signals: CVE-2026-48710 — CISA KEV: listed, EPSS 0.07, public PoC on GitHub
- Engineer — Act: Unauthenticated RCE on Exim with a public PoC on GitHub means active exploitation could begin at any time — patch Exim to the fixed version and confirm no internet-exposed instances are running the vulnerable release.
- SOC/IR — Plan: No active exploitation confirmed yet, but the public PoC makes this an imminent detection priority — build or tune rules to flag anomalous child-process spawning and unexpected outbound connections from your Exim instances before exploitation begins.
- Leader — Skip
- Signals: CVE-2026-45185 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listing confirms active exploitation despite the low EPSS (0.03); audit all rootless container deployments (podman, Docker rootless, or equivalent) and apply vendor patches for CVE-2026-31431 immediately — public PoC lowers the bar for attackers further.
- SOC/IR — Act: KEV listing means assume exploitation is occurring; hunt for anomalous file-copy operations and privilege escalation events on container hosts, sweeping logs back to at least May 2026 when the PoC was published.
- Leader — Plan: A KEV-listed container vulnerability merits confirming with engineering that CVE-2026-31431 is in the patch queue with a firm timeline this week, but it does not rise to board or customer disclosure level unless containers underpin a regulated or critical-path service.
- Signals: CVE-2026-31431 — CISA KEV: listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: A public PoC on GitHub lowers the bar for exploitation even without KEV listing; if langchain-core is in your dependency tree, audit the pinned version and patch to the fixed release immediately.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2025-68664 — CISA KEV: not listed, EPSS 0.43, public PoC on GitHub
- Engineer — Act: cPanel/WHM is widely deployed as a hosting control panel; authentication bypass with CISA KEV listing, EPSS 0.99, and a public PoC means exploitation is trivial and active. Patch cPanel/WHM immediately to the vendor-issued fixed version and audit access logs for any unauthorized sessions.
- SOC/IR — Act: Active exploitation of an internet-facing control panel auth bypass warrants an immediate assume-breach sweep on any cPanel/WHM instances in your estate. Hunt for anomalous authenticated sessions or privilege escalation activity since the PoC dropped, and tune detections for unauthenticated access patterns against port 2083/2087.
- Leader — Act: CISA KEV listing with EPSS 0.99 on a widely-used hosting panel is a board-question-level event — confirm whether your infrastructure or managed hosting vendors run cPanel/WHM and request written confirmation of patching status before end of week.
- Signals: CVE-2026-41940 — CISA KEV: listed, EPSS 0.99, public PoC on GitHub
- Engineer — Act: A public PoC is available for this sandbox escape in Claude Code; any team running Claude Code in dev workflows or CI should update to the patched release listed in GHSA-vp62-r36r-9xqp immediately.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-39861 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listed, EPSS 0.55, public PoC, and active exploitation combine to demand immediate action. Update all Chrome and Chromium-based installations (including Electron apps and Chromium in CI/CD pipelines) to the latest stable channel release now.
- SOC/IR — Act: Active zero-day exploitation with public PoC means attacker tooling is already circulating. Hunt for suspicious child processes spawned by Chrome since early February, and tune EDR rules to flag anomalous browser subprocess activity consistent with renderer exploitation.
- Leader — Act: A CISA KEV-listed zero-day in the most widely deployed enterprise browser with confirmed in-the-wild exploitation warrants same-week confirmation. Verify that endpoint management has initiated an emergency Chrome patch cycle and confirm patch coverage metrics before end of week.
- Signals: CVE-2026-2441 — CISA KEV: listed, EPSS 0.55, public PoC on GitHub
- Engineer — Act: A public working exploit for a pre-auth root RCE means active exploitation risk is immediate; upgrade AnyDesk Linux to version 8.0.3 on all hosts and audit for any instances still running older versions.
- SOC/IR — Plan: No IOCs or active campaign reported yet, but working exploit publication typically precedes mass exploitation; build or tune detections for anomalous process spawning from the AnyDesk daemon on Linux endpoints and queue a hunt for lateral movement from remote-access tools.
- Leader — Plan: Confirm whether AnyDesk Linux is deployed in the environment and verify the patch is applied; the vendor’s deliberately vague changelog — no CVE, no security advisory — is a vendor-transparency red flag worth raising in your next vendor risk review.
- Engineer — Act: No patch exists yet for these critical AhsayCBS flaws, so the immediate action is to audit whether AhsayCBS backup servers are in your environment and, if so, isolate or restrict network access to them while implementing compensating controls until a vendor patch is released.
- SOC/IR — Act: Active exploitation is deploying webshells on AhsayCBS servers — sweep backup infrastructure for webshell artifacts and anomalous outbound connections indicative of a crypto miner; treat any AhsayCBS host as potentially compromised until cleared.
- Leader — Plan: AhsayCBS is niche backup management software, so confirm whether it is in your environment this quarter; if it is, escalate to engineer/SOC as an active unpatched exposure in backup infrastructure, which is a high-value target for ransomware precursors.
- Engineer — Act: SMA1000 is a widely deployed remote-access appliance; active exploitation with a public PoC means the patch-window is effectively zero — apply the Tuesday release immediately and verify no unauthorized access occurred before patching.
- SOC/IR — Act: Edge appliances under active exploitation require an assume-breach posture: sweep authentication logs on the SMA1000 and hunt for lateral movement originating from its internal IP since the disclosure date, even if patching is in progress.
- Leader — Act: Actively exploited max-severity flaws in remote-access appliances are board-question territory — confirm within 24 hours whether SMA1000 is in your estate, ensure emergency patching is authorized, and prepare a brief in case the story escalates.
- Signals: CVE-2026-102255 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A public PoC for a guest-to-host KVM escape is available on GitHub now — even with low EPSS, VM breakout is a critical class that demands immediate response. Patch the Linux kernel on all KVM hosts (bare-metal hypervisors, Kubernetes nodes, cloud-adjacent infra) as soon as your distro ships the fix.
- SOC/IR — Learn: No active exploitation campaigns, no published IOCs, and VM-level escapes are largely invisible to SIEM/EDR — detection surface is thin. File the technique for future hypervisor-monitoring coverage work, but no hunt or rule to write today.
- Leader — Learn: A guest-to-host hypervisor escape is a significant vulnerability class, but exploitation signals remain low (EPSS 0.01, not KEV listed) — this sits below the threshold for board or customer communication. Confirm engineering teams are tracking the kernel patch; revisit only if active exploitation emerges.
- Signals: CVE-2026-53359 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CVE-2015-3306 (ProFTPD, CVSS 10.0) carries EPSS 0.98, a public GitHub PoC, and active exploitation by a Chinese nation-state actor — patch ProFTPD immediately and audit all five KEV-listed CVEs before the October 11 federal deadline.
- SOC/IR — Act: Flax Typhoon is conducting live exploitation of these edge-service flaws; initiate a threat hunt for Flax Typhoon TTPs and sweep logs for ProFTPD anomalies (suspicious anonymous access, lateral movement from FTP services) since at least early October.
- Leader — Act: A Chinese nation-state actor is actively exploiting these vulnerabilities under a binding CISA directive with an October 11 deadline — confirm whether ProFTPD or the other four affected products are present in your environment and brief leadership given the geopolitical attribution and imminent compliance requirement.
- Signals: CVE-2015-3306 — CISA KEV: listed, EPSS 0.98, public PoC on GitHub
- Engineer — Learn: No specific CVEs, IOCs, or affected software listed in the summary; the disruption is government-side. Monitor for follow-on FBI/CISA advisories that may name affected edge devices or configurations relevant to your environment.
- SOC/IR — Act: A DOJ-confirmed Chinese APT campaign against critical infrastructure warrants an immediate hunt: review Flax Typhoon’s known TTPs (living-off-the-land, VPN/edge appliance footholds) and sweep logs since the campaign’s known activity window for related behaviors in your SIEM and EDR.
- Leader — Act: A named, government-disrupted Chinese APT targeting U.S. critical infrastructure is board-question territory — brief leadership and assess whether your sector is in scope, then verify whether any edge or OT vendors used have issued related advisories.
- Engineer — Act: A public PoC is on GitHub for a critical memory-overflow RCE in NetScaler ADC/Gateway affecting SAML configurations — apply Citrix’s patch immediately and confirm whether your deployment uses SAML to assess exposure scope.
- SOC/IR — Plan: No active exploitation or published IOCs yet, but a public PoC raises the likelihood of imminent attempts; build or tune a detection for anomalous HTTP traffic to NetScaler SAML endpoints as a pre-emptive measure.
- Leader — Skip
- Signals: CVE-2026-107406 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Active exploitation of AhsayCBS is confirmed with web shell and XMRig miner deployment, and a public PoC is available on GitHub. Patch AhsayCBS immediately and audit any instances for web shell artifacts and unauthorized processes on affected hosts.
- SOC/IR — Act: Attackers are actively deploying web shells and XMRig miners disguised as Microsoft Edge on compromised AhsayCBS hosts — hunt for msedge.exe processes running from unexpected directories and sweep backup server hosts for web shell indicators since the public PoC dropped.
- Leader — Skip
- Signals: CVE-2026-105133 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Confirmed supply-chain compromise: audit package-lock.json and yarn.lock across all repos for tensorlake@0.5.144, remove immediately if found, and rotate any credentials or secrets accessible during builds on affected systems.
- SOC/IR — Act: Active worm establishes persistence and phones home for remote code execution — sweep CI/CD runners and developer workstations that may have installed this version for anomalous outbound connections and new persistence artifacts since the package was published.
- Leader — Plan: Niche but confirmed supply-chain compromise with credential exfiltration; direct engineering to audit dependency manifests for tensorlake SDK usage this week and escalate to incident response if any instances are found.
- Engineer — Plan: Registry-level DNS tampering enabled unauthorized certificate issuance — audit DNS records and check Certificate Transparency logs (crt.sh) for any unexpected cert issuances on domains your org owns, especially in .gh/.as/.sl ccTLDs; confirm DNSSEC is enabled where possible.
- SOC/IR — Act: Active DNS hijacking via compromised registry operators is in progress — query CT logs for unexpected certificate issuances against your org’s domains, and hunt for anomalous DNS record changes since early October 2026 across your monitored domain portfolio.
- Leader — Plan: Breach of ccTLD registry operators affecting multiple country-code TLDs warrants an inventory check — confirm whether your organization holds domains in .gh, .as, or .sl ccTLDs and request a DNS record integrity attestation from your registrar or domain management vendor.
- Engineer — Act: FortiGate firewalls and SSL VPN gateways are common enterprise edge devices; an active FBI-warned campaign locking out admins signals credential theft or config tampering at scale. Audit all FortiGate admin accounts for unauthorized additions or password changes, verify firmware is at latest patched version, and review admin-access logs from at least the past 30 days.
- SOC/IR — Act: Admin lockout is a concrete post-exploitation TTP indicating attackers have achieved privileged access to edge devices before defenders can respond. Hunt for unauthorized admin account creation or privilege changes on FortiGate devices since October 2026, and initiate assume-breach review of any network segments fronted by affected appliances.
- Leader — Act: An FBI advisory on a named, ongoing campaign against a widely-deployed enterprise VPN product warrants immediate internal exposure check. Confirm whether your environment runs FortiGate, get a status report from the network team this week, and be prepared to brief leadership on containment posture if exposure is confirmed.
- Engineer — Act: Active campaign seeding fake GitHub repos with SmartLoader that delivers the StealC credential stealer — developers cloning unvetted repos are the attack vector. Audit recently cloned GitHub repos and CI/CD dependency pulls since early October for unexpected or newly-created repos, and verify repo authenticity before use.
- SOC/IR — Act: StealC infostealer is being deployed on developer endpoints via trojanized repos; hunt for StealC behavioral indicators (credential store access, C2 beaconing) in EDR across developer workstations, and review git clone activity logs since the campaign reactivated this month.
- Leader — Plan: Large-scale fake-repo campaign targeting developers creates credential theft risk that could cascade to production access. This quarter, assess whether developer policies require repo vetting before cloning and consider enforcing allowlists or signing requirements in CI/CD pipelines.
- Engineer — Act: Unpatched critical unauthenticated RCE in LMCache multiprocess mode with no fix available; if running vLLM or any LMCache deployment, immediately disable multiprocess mode or network-isolate the cache server (firewall ZeroMQ port) until a patched release ships.
- SOC/IR — Plan: No IOCs or confirmed active exploitation reported, but organizations running LLM inference infrastructure should create detections for anomalous process spawning or unexpected inbound connections on LMCache/vLLM nodes; start collecting relevant host and network logs from AI compute clusters now.
- Leader — Learn: Highlights emerging attack surface in enterprise AI infrastructure; no immediate leadership action required, but useful context for AI security posture reviews and vendor risk assessments if LLM serving software is in scope.
- Engineer — Act: If you run any publicly exposed LLM or AI inference servers, audit them now for unauthorized crypto miner processes and verify no unauthenticated endpoints are reachable from the internet; 3,400+ confirmed infections indicates active, ongoing exploitation of this attack surface.
- SOC/IR — Plan: Build or tune detections for anomalous CPU/GPU utilization and suspicious outbound connections from AI/ML servers tied to the Canto Incognito campaign; no IOCs are published yet, but the behavioral signature of crypto miner deployment on LLM infrastructure is worth adding to your hunt library.
- Leader — Learn: AI and LLM infrastructure is now an active target for financially motivated botnets at scale — worth noting when reviewing security controls around AI deployments, but no immediate board or regulatory action required absent confirmed exposure.
- Engineer — Act: Active exploitation of stored XSS in Ninja Forms and WPC Product Bundles for WooCommerce is resulting in backdoor installation and rogue admin account creation — update both plugins to their latest patched versions immediately and audit existing WordPress admin accounts for unauthorized entries.
- SOC/IR — Act: Active exploitation with post-compromise persistence (backdoors and rogue admins) means assume-breach review is warranted; sweep WordPress admin user tables for accounts created after plugin install dates and hunt for unexpected file modifications in plugin directories.
- Leader — Skip
- Engineer — Act: FBI/USSS joint advisory confirms active harvesting against internet-facing FortiGate and SSL VPN devices via reused credentials and legacy SHA-256 password storage. Immediately rotate all Fortinet admin and VPN credentials, disable SHA-256 legacy password configs, and enforce MFA on management interfaces.
- SOC/IR — Act: The campaign’s scale and active status mean affected devices may already be compromised before patching. Sweep authentication logs for anomalous VPN logins and lateral movement since campaign onset; apply assume-breach posture for any internet-exposed FortiGate or SSL VPN in your estate.
- Leader — Act: A joint FBI/Secret Service advisory citing 86,000+ harvested credentials from widely-deployed network perimeter devices is board-question territory. Confirm whether Fortinet FortiGate or SSL VPN is in use, request an exposure assessment from the infrastructure team, and prepare a brief for leadership before they read this in the news.
- Engineer — Act: Active supply-chain compromise in npm with RAT and stealer payloads across 8 packages downloaded 40k+ times since Aug 2023. Audit all projects for the named MALFEX packages, remove any matches, and inspect CI/CD build logs for evidence of execution.
- SOC/IR — Plan: Named malware (Overlord RAT) and stealer campaign with developer-endpoint reach; obtain full IOC lists from the CloudSEK/Checkmarx reports and build detections for Overlord RAT callbacks and credential-stealer behaviors on developer workstations and CI runners.
- Leader — Learn: Illustrates ongoing npm supply-chain risk from low-signal lone-actor campaigns; useful background for a software supply chain risk discussion with engineering leadership, but not a systemic event requiring immediate escalation.
- Engineer — Act: Public PoC on GitHub plus confirmed exploitation attempts within hours of disclosure make this urgent despite low EPSS. Patch Atlassian Bitbucket, Confluence, Jira Software, and Jira Service Management Data Center instances to vendor-released fixed versions immediately.
- SOC/IR — Act: Active exploitation is underway; hunt for anomalous file-read requests and path traversal patterns against Atlassian Data Center endpoints in web and application logs since the disclosure date, and assume any internet-exposed instance may already be targeted.
- Leader — Plan: Active exploitation of a CVSS 9.3 flaw is underway, but this is not yet a named systemic event; if your org runs Atlassian Data Center (on-prem, not Cloud), direct engineering to prioritize the patch this week and confirm exposure before it escalates to a board-level incident.
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Atlassian products are near-universal in enterprise environments; a public PoC and confirmed active scanning mean exploitation attempts are live even with low EPSS. Patch all affected Atlassian products to the versions released October 5th and audit web-accessible configuration files for unintended exposure.
- SOC/IR — Act: Active scanning is underway; sweep Atlassian access logs for requests matching arbitrary file-read patterns (path traversal, config file targets) since October 5th, and tune WAF/SIEM rules to alert on exploitation attempts against these endpoints.
- Leader — Skip
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Pre-authentication exploitation with a public PoC and multi-source confirmation of active attacks makes this urgent despite low EPSS. Patch Jira, Confluence, and Bitbucket to the fixed versions immediately; if patching cannot happen within 24-48 hours, isolate or firewall these services from untrusted networks.
- SOC/IR — Act: Active exploitation of unauthenticated Atlassian access means assume-breach posture on any exposed instance. Hunt for anomalous API calls and unauthenticated sessions against Atlassian services since the PoC publication date, and alert on inbound requests matching known exploit patterns.
- Leader — Act: Atlassian tools typically house source code, project roadmaps, and credentials — a pre-auth compromise is a data-exposure risk worth escalating. Confirm whether Jira, Confluence, or Bitbucket instances are internet-facing and verify with engineering that patching is underway this week.
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Active scanning for CVE-2026-61500 with a public PoC means exploitation is imminent for any exposed Rejetto HFS instance; identify and patch or take offline any internet-facing HFS servers immediately.
- SOC/IR — Act: Active scanning is underway — hunt for anomalous authentication or session-related traffic against HFS servers and sweep for signs of session forgery or RCE activity since the scanning began.
- Leader — Skip
- Signals: CVE-2026-61500 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVSS 9.3 with a public GitHub PoC lowers the exploitation bar significantly — unauthenticated reads of known-path files (think web.xml, config files with credentials) in widely-deployed Atlassian Data Center products. Patch all affected self-hosted Atlassian Data Center instances to the latest fixed versions immediately, prioritizing any internet-exposed deployments.
- SOC/IR — Plan: No active exploitation confirmed yet (EPSS 0.01, not KEV-listed), but the public PoC makes opportunistic scanning likely soon. Build detections for anomalous unauthenticated HTTP requests to Atlassian application paths matching known static file locations across Jira, Confluence, and related products.
- Leader — Skip
- Signals: CVE-2026-21589 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Warlock is actively weaponizing both old and new SharePoint vulnerabilities to disable endpoint defenses and deploy ransomware; patch SharePoint to the latest available version immediately and audit recent access logs for exploitation artifacts.
- SOC/IR — Act: Two-vendor corroboration (Symantec and Carbon Black) of live ransomware deployments via SharePoint exploitation warrants a retroactive hunt for security-tool-kill events and SharePoint lateral movement patterns since at least early Q4 2026.
- Leader — Plan: Confirm SharePoint patch compliance with engineering this quarter and validate that endpoint-defense controls can detect tampering; current targeting is concentrated in Portuguese- and Spanish-speaking critical infrastructure, but the TTPs are sector-portable.
- Engineer — Plan: Active exploitation of SharePoint for initial access is confirmed across multiple org types, but no specific CVE, KEV listing, or PoC is surfaced in the signals; ensure SharePoint is fully patched and audit authentication/access logs for anomalous behavior this sprint.
- SOC/IR — Act: An active China-linked ransomware campaign is using SharePoint exploitation as the entry point against water, telecom, government, and education targets; hunt for SharePoint exploitation indicators (unusual web shell activity, anonymous auth attempts) and check whether your estate’s sector matches the targeting profile.
- Leader — Act: A named state-linked ransomware group is actively targeting water utilities, telecom operators, regional governments, and universities via SharePoint — if your organization operates in any of these sectors, brief leadership now and confirm SharePoint patch posture and segmentation with engineering before this surfaces as a board question.
- Engineer — Skip
- SOC/IR — Learn: Breach involved exploitation of a third-party software vulnerability; no IOCs, TTPs, or detection signals published, so no immediate hunt or detection action is possible.
- Leader — Act: If your organization uses Frontline Education for HR or workforce management, confirm your exposure and request an incident report and attestation from the vendor this week.
- Engineer — Act: CVE-2026-63688 scores CVSS 10.0 with a public PoC on GitHub — unauthenticated root on Kubernetes nodes is maximum-severity. Apply Dell’s CSM patch immediately and audit csm-authorization-storage gRPC server access logs for any unauthorized calls since before the patch date.
- SOC/IR — Act: A public PoC against a CVSS 10.0 unauthenticated gRPC endpoint means exploitation attempts are likely in the wild. Hunt for anomalous Kubernetes node privilege escalation events and unexpected gRPC calls to csm-authorization-storage, and flag any Kubernetes admin actions that postdate the vulnerability’s public disclosure.
- Leader — Skip
- Signals: CVE-2026-63688 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: CISA KEV listed, public PoC available, and active exploitation confirmed — patch FortiMail to Fortinet’s recommended fixed version immediately; treat any unpatched internet-facing FortiMail instance as potentially compromised.
- SOC/IR — Act: Active zero-day exploitation of a network-edge email gateway warrants an assume-breach posture — sweep FortiMail logs for anomalous command execution or outbound connections since the first reported exploitation date, and tune detections for post-compromise activity on devices in that network segment.
- Leader — Act: Confirm whether your organization runs FortiMail and verify emergency patching is underway; CISA KEV listing on an actively exploited edge appliance may warrant a brief to leadership given potential for email interception and lateral movement.
- Signals: CVE-2026-104286 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV-listed, public PoC exists, and active exploitation confirmed — unauthenticated arbitrary file write on FortiMail (CVSS 9.8). Identify all FortiMail instances and apply Fortinet’s patch immediately; treat unpatched appliances as potentially compromised.
- SOC/IR — Act: Active exploitation of an internet-facing email gateway means assume-breach posture for any unpatched FortiMail appliance; hunt for anomalous file creation events and unexpected processes spawned from the FortiMail service since the KEV listing date.
- Leader — Plan: A KEV-listed critical on email gateway infrastructure warrants confirming with engineering this week that all FortiMail deployments are inventoried and on the emergency patch queue — not board-level systemic risk, but email compromise has compliance and data-exposure implications worth tracking.
- Signals: CVE-2026-104286 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV-listed, public PoC active, CVSS 8.9 unauthenticated RCE via SNMP path — patch Zimbra Collaboration Suite to the vendor-released fixed version immediately and audit Zimbra webroot directories for newly created or modified web shell files.
- SOC/IR — Act: Active exploitation confirmed with web shell staging and authentication secret harvesting; hunt for unexpected child processes spawned from the Zimbra service account since late September and sweep Zimbra webroot paths for recently written .jsp/.php files indicative of web shell deployment.
- Leader — Act: CISA KEV listing for an unauthenticated RCE in a widely-deployed enterprise mail platform with confirmed credential harvesting — confirm whether Zimbra is in your environment, verify patching status with the infrastructure team, and assess whether harvested mailbox credentials could expose sensitive communications or escalate to broader account compromise.
- Signals: CVE-2026-73570 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active exploitation of a critical pre-authentication command injection flaw in NetScaler ADC/Gateway is confirmed across multiple environments. Patch NetScaler immediately, audit for newly created superuser accounts, and scan access logs for web shell requests disguised as CSS resource paths.
- SOC/IR — Act: The campaign leaves distinctive artifacts: superuser account creation and web shells mapped to CSS-mimicking URL patterns to evade detection. Hunt for anomalous local account additions on NetScaler appliances and review NetScaler access logs for CSS-like paths that return interactive responses since at least early October 2026.
- Leader — Act: Active, multi-victim exploitation of a widely deployed VPN/ADC edge device with configuration data theft is board-level exposure. Confirm NetScaler presence in your environment, verify patch status with your infrastructure team this week, and assess whether stolen config data — credentials or certificates — warrants customer or auditor notification.
- Engineer — Act: Patch Cisco Catalyst SD-WAN Manager immediately — CVE-2026-76504 is KEV-listed, has a public PoC, and is under active exploitation; unauthenticated remote access at CVSS 9.8 makes this an emergency change window, not a scheduled patch.
- SOC/IR — Act: Assume-breach posture for any environment running Cisco Catalyst SD-WAN Manager: sweep authentication logs for anomalous access since before the KEV listing date and hunt for unauthorized management-plane sessions; apply Cisco’s published IOCs if available.
- Leader — Act: Confirm this week whether your org runs Cisco Catalyst SD-WAN Manager, then direct engineering to treat patching as emergency; active exploitation plus KEV listing makes this a likely customer or board question for network-heavy sectors.
- Signals: CVE-2026-76504 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV-listed and crash-level public PoC confirms exploitation is real; patch all macOS and iOS endpoints to Apple’s latest security release immediately, prioritizing internet-facing and executive devices.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation via crafted PDF; hunt for anomalous CoreGraphics crashes and WhatsApp-delivered PDF activity in EDR telemetry since the KEV add date, and tune detections for malicious font-embedded PDFs.
- Leader — Act: A CISA KEV-listed Apple vulnerability with a confirmed targeted-use pattern means executive iPhones and Macs are at risk; verify MDM fleet patch compliance and assess whether any high-value personnel may have been targeted before the patch was available.
- Signals: CVE-2026-86950 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Exposed valid credentials are an immediate risk whether or not your org is named — scan all org-owned public (and private) GitHub repos for secrets now using truffleHog or GitHub secret scanning, rotate any discovered credentials, and enable GitHub push protection to block future leaks.
- SOC/IR — Plan: No specific IOCs are published, but the scale of valid exposed credentials raises likelihood of credential-stuffing and unauthorized API use; build or tune detections for anomalous service-account logins and impossible-travel alerts tied to CI/CD or cloud API keys.
- Leader — Plan: Direct engineering to run a full secrets audit across org repositories this quarter, verify GitHub push-protection and secret-scanning policies are enforced, and add credential-leakage exposure to the risk register as a developer-practice control gap.
- Engineer — Act: CISA KEV listing plus a public GitHub PoC confirms active exploitation of this unauthenticated RCE on Zimbra mail servers. Apply the available Zimbra patch immediately; if the instance is internet-facing and patching will be delayed, consider taking it offline or blocking external access as a temporary control.
- SOC/IR — Act: Microsoft’s analysis includes attack paths and detection opportunities for an actively exploited, unauthenticated command injection on a common enterprise mail platform. Run a targeted hunt across Zimbra hosts for compromise indicators using the TTPs outlined in the post, and tune SIEM/EDR detections against the described exploitation behavior — assume any unpatched internet-facing Zimbra instance may already be compromised.
- Leader — Plan: This is a KEV-listed RCE on internet-facing mail servers, meaning exploitation is confirmed in the wild; confirm whether Zimbra is in your inventory and verify the engineering team has an emergency patch timeline in place this week. Not yet at Log4Shell systemic scope, but email server compromise carries credential and data-exfiltration risk worth validating before it becomes an incident.
- Signals: CVE-2026-73570 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub
- Engineer — Plan: Session token theft bypasses MFA controls — review M365 Conditional Access policies for continuous access evaluation and token binding; audit which RMM tools are permitted to execute in your environment to limit post-phishing persistence.
- SOC/IR — Act: Active campaign with a clear behavioral signature: hunt for unauthorized RMM tool installations on endpoints and anomalous M365 sessions (new device or geolocation logins shortly following phishing delivery) since campaign has 351 tracked sandbox submissions concentrated in the US.
- Leader — Plan: Campaign explicitly targets C-suite at technology, manufacturing, government, and consulting organizations — brief senior executives and their assistants on the risk this quarter and confirm whether your sector shows up in threat intel targeting lists.
- Engineer — Act: CISA KEV-listed with public PoC and confirmed active exploitation on a common edge appliance — patch NetScaler immediately and audit appliances for web shell artifacts and tunneling malware in web roots and process trees.
- SOC/IR — Act: Attackers are deploying web shells and tunneling malware post-exploitation, then pivoting inward — sweep NetScaler appliances for unexpected child processes and outbound tunnels, and hunt for lateral movement originating from NetScaler IPs since exploitation began.
- Leader — Act: A CISA-KEV-listed zero-day on a widely deployed edge appliance with confirmed credential theft and internal network spread warrants immediate confirmation of NetScaler usage and a status check from engineering before leadership or customers raise the question.
- Signals: CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: CISA KEV-listed pre-auth memory overflow in NetScaler ADC/Gateway (CVSS 9.5) with public PoC and confirmed active exploitation — patch all NetScaler ADC and Gateway appliances to the vendor-fixed version immediately, prioritizing internet-facing instances.
- SOC/IR — Act: Active exploitation of a pre-auth edge-device RCE means assume-breach posture is warranted — sweep NetScaler ADC/Gateway logs for anomalous DTLS traffic, unexpected shell processes, or lateral movement originating from the appliance since initial disclosure date.
- Leader — Act: Citrix NetScaler is pervasive in enterprise environments and this actively exploited critical RCE is CISA KEV-listed — confirm whether NetScaler ADC/Gateway is deployed, direct immediate patching, and brief leadership if it is internet-facing or handles sensitive authentication flows.
- Signals: CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Patch Cisco Catalyst SD-WAN Manager to the fixed release immediately — Cisco confirms active exploitation of unauthenticated remote admin API access with no workaround available; delay is indefensible.
- SOC/IR — Act: Cisco confirms active exploitation, making this an assume-breach scenario for any org running SD-WAN Manager; hunt for unauthorized admin API calls and unexpected configuration changes on those devices since at least September 30.
- Leader — Act: Confirm this week whether your organization runs Cisco Catalyst SD-WAN Manager, verify the engineering team has a patch window scheduled, and be prepared to brief leadership given active exploitation of admin-level network management access.
- Signals: CVE-2026-76504 — CISA KEV: not listed, EPSS n/a, no public PoC found, reported by 2 collected sources
- Engineer — Act: Actively exploited privilege escalation to admin in Cisco Catalyst SD-WAN Manager with patches released; apply the Cisco security update immediately and audit for any unauthorized admin account creation or configuration changes.
- SOC/IR — Act: Active exploitation of an edge management plane device warrants an assume-breach sweep — check for unexpected admin accounts, configuration modifications, or lateral movement originating from SD-WAN Manager nodes even before patching is confirmed complete.
- Leader — Plan: Confirm whether Cisco Catalyst SD-WAN Manager is in your environment and escalate it to the high-priority patching queue; active exploitation is confirmed but scope appears targeted rather than the systemic, board-level event that would require immediate leadership briefing.
- Signals: CVE-2026-76504 — CISA KEV: not listed, EPSS n/a, no public PoC found, reported by 2 collected sources
- Engineer — Act: Pre-authentication RCE on a widely deployed network OS with a CISA advisory is high-priority regardless of missing EPSS/PoC signals; patch MikroTik RouterOS to the latest available version immediately, and until patched, restrict or disable remote management interfaces (Winbox, SSH, web) to trusted networks only.
- SOC/IR — Plan: The summary provides no IOCs, TTPs, or ATT&CK mappings to hunt on today; queue a detection build for anomalous management-plane traffic to MikroTik devices and prepare an assume-breach sweep playbook for network infrastructure in case active exploitation evidence surfaces.
- Leader — Plan: Confirm whether MikroTik RouterOS appears in your network or vendor inventory and direct engineering to treat patching as this-sprint priority; CISA advisories on critical network-device flaws frequently precede board-level questions when exploitation becomes public.
- Engineer — Act: AI coding agents in your dev workflow may be silently pushing screenshots—including sensitive internal data—to public GitHub repos under personal developer accounts. Audit GitHub for AI-agent-created image artifacts now, and restrict AI agent configurations to prevent writing to public repositories.
- SOC/IR — Act: Over 13,000 internal images from 300+ orgs are already publicly reachable on GitHub. Hunt for unexpected image file commits (PNG/JPEG) in developer personal repos linked to your organization’s accounts, and check whether any internal-origin images are indexed publicly.
- Leader — Act: Customer billing records are confirmed among the exposed data, implicating potential GDPR/SEC disclosure obligations. This week, confirm whether your organization is among the 300+ affected by querying your security team for AI agent GitHub activity, and engage legal on exposure scope before regulators or customers surface it first.
- Engineer — Act: NetScaler ADC/Gateway is actively exploited for root access across multiple enterprise sectors per Mandiant and Google GTIG — patch to the latest released version immediately and audit appliance integrity for WHIPSHOT/SLAPSHOT indicators before treating the host as clean.
- SOC/IR — Act: Active exploitation of a perimeter NetScaler appliance to achieve root access warrants an assume-breach sweep — hunt for WHIPSHOT and SLAPSHOT artifacts on any NetScaler in the estate and review outbound connections from those devices since early September 2026.
- Leader — Plan: Broad targeting across government, finance, technology, education, and legal sectors in North America and Europe elevates organizational exposure if NetScaler is in the stack — confirm with the engineering team that patching is prioritized and ask for a written exposure assessment this week.
- Engineer — Learn: RedFlick is a novel malware delivery technique, not a patchable CVE; useful for understanding evasion tradecraft that may bypass current email and endpoint controls, but no specific infrastructure change is required today.
- SOC/IR — Act: Star Blizzard’s active large-scale phishing campaign with the RedFlick delivery technique has been running since January 2026; pull the full Microsoft post for IOCs and ATT&CK TTP mappings, then hunt for RedFlick-associated lures in email gateway logs and sweep endpoint telemetry for associated malware staging behaviors.
- Leader — Learn: Russian state actor Star Blizzard has evolved its evasion and delivery capabilities; file as threat-landscape context and flag for a targeted-sector check — if your organization operates in government, defense, or policy circles, consider a brief to security leadership on exposure.
- Engineer — Act: Actively exploited zero-day in CoreGraphics affecting iOS (and likely macOS per related advisories); update all managed Apple devices to the patched iOS/macOS releases immediately via MDM or manual prompt.
- SOC/IR — Plan: No IOCs or ATT&CK-mapped TTPs are available yet; queue a sweep of MDM inventory to identify unpatched Apple devices among high-value personnel and prepare to triage if Apple releases indicators for this ’extremely sophisticated’ campaign.
- Leader — Act: Sophisticated targeted iOS zero-days historically indicate mercenary or state-sponsored spyware against executives and high-value individuals; confirm MDM enforces the patch on corporate Apple devices and brief leadership who use personal iPhones for work on the need to update immediately.
- Engineer — Act: CISA KEV listed and public PoC available confirm active exploitation risk; update all managed iOS, iPadOS, and macOS devices to Apple’s patched releases immediately, prioritizing internet-facing or executive-owned endpoints.
- SOC/IR — Plan: No IOCs or TTPs have been published yet, so no immediate hunt is possible; monitor threat intel feeds for emerging indicators and prepare to sweep EDR telemetry for anomalous file-processing activity on Apple endpoints once details surface.
- Leader — Plan: KEV-listed Apple zero-day exploited in targeted attacks elevates risk for executive devices; confirm MDM policy enforces this patch across all managed Apple assets and flag to leadership that privileged users may be higher-value targets.
- Signals: CVE-2026-86950 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2026-86950 is CISA KEV-listed with active exploitation and a public PoC; update all iOS 26 and macOS 26/15 devices to Apple’s latest patched release immediately — iOS/macOS 27 branches are unaffected.
- SOC/IR — Act: Active exploitation of a CISA KEV-listed Apple vulnerability means you should assume some corporate macOS/iOS devices may already be compromised; hunt for anomalous activity on unpatched macOS 15/26 and iOS 26 endpoints since at least the patch release date of 2026-09-28.
- Leader — Act: Active exploitation of corporate Apple devices (macOS 15/26, iOS 26) with a CISA KEV listing warrants confirming this week that MDM-managed endpoints are receiving the emergency update and verifying coverage for any unmanaged devices.
- Signals: CVE-2026-86950 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed in-the-wild exploitation; CVE-2026-88772 achieves unauthenticated root access on NetScaler ADC/Gateway. Apply Citrix’s latest patches immediately, then audit NetScaler systems for WHIPSHOT PHP web shells and anomalous SLAPSHOT-style proxy traffic in access logs.
- SOC/IR — Act: Exploitation deploys custom tooling — WHIPSHOT (PHP web shell masking C2 in HTTP headers) and SLAPSHOT (Python proxy tunneler for internal recon and credential theft) — giving concrete hunt targets. Sweep NetScaler appliances for unexpected PHP files and unusual outbound proxy sessions, and hunt for lateral movement or credential-access activity originating from NetScaler hosts since early September 2026.
- Leader — Act: An active, multi-sector campaign (government, finance, legal, education in North America and Europe) exploiting edge appliances via authentication-bypass zero-days is a board-question-level event. Confirm whether Citrix NetScaler is in your environment or a key vendor’s, request Citrix incident status attestation, and brief leadership before this surfaces in the news.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 3 collected sources · CVE-2026-88772 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: If you use Supabase, audit your project’s Row Level Security (RLS) settings immediately and verify that no tables with PII, credentials, or tokens are publicly readable; enable RLS on all sensitive tables and rotate any exposed tokens.
- SOC/IR — Plan: No active exploitation signals yet, but bulk exposed auth tokens are high-value targets — plan to add monitoring for anomalous API access patterns against Supabase-backed services and check whether any internal apps use Supabase with public table access.
- Leader — Plan: If your organization builds on Supabase, task engineering to audit RLS configurations this quarter; the scale (16,000+ databases) suggests broad industry exposure and may generate customer or auditor questions about your own posture.
- Engineer — Act: Both CVEs are CISA KEV listed with public PoCs and confirmed in-the-wild exploitation on NetScaler (Citrix ADC/Gateway) appliances — patch to Citrix’s remediated version immediately and audit device logs for signs of pre-patch compromise.
- SOC/IR — Act: Active zero-day exploitation of NetScaler edge appliances warrants an assume-breach posture — sweep for IOCs published in the Unit 42 brief, hunt for lateral movement or credential harvesting originating from NetScaler hosts since these may have been exploited before disclosure.
- Leader — Act: NetScaler is widely deployed across enterprise networks; dual CISA KEV-listed zero-days with active exploitation is board-question-level risk — confirm whether your org runs NetScaler, verify emergency patching is underway, and prepare to brief leadership if exposure is confirmed.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources · CVE-2026-88772 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: Azure tenants are directly in scope for this destructive ransomware campaign, but no KEV listing, PoC, or EPSS data is present to justify emergency action. Audit Azure service principal permissions and activity logs for anomalous automation, and verify that critical resource deletion requires additional approval controls.
- SOC/IR — Act: JadePuffer is an active operator running agent-driven Azure attacks involving credential theft and resource destruction — hunt Azure audit logs for unusual service principal activity and bulk resource operations, and tune detections for abnormal automation patterns consistent with agentic reconnaissance since this campaign surfaced.
- Leader — Plan: A named ransomware operator using AI agents to destroy Azure infrastructure represents a meaningful shift in cloud ransomware capability; confirm your Azure tenant’s blast-radius controls (resource locks, backup isolation) are in place and add this actor profile to the risk register this quarter.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation — patch NetScaler to Citrix’s latest fixed builds immediately; if patching cannot be completed within hours, follow Citrix’s guidance to shut down exposed appliances until patched.
- SOC/IR — Act: Active exploitation of NetScaler edge devices means assume compromise is possible before patching — hunt for anomalous outbound connections, unexpected processes, or lateral movement originating from NetScaler appliances since the disclosure date, and tune detections for post-RCE behavior on these hosts.
- Leader — Act: Dual CISA KEV-listed RCEs on widely deployed enterprise edge infrastructure warrant same-week leadership action — confirm whether your environment runs NetScaler, verify engineering has begun emergency patching, and prepare to brief leadership given the likelihood of board or customer questions.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources · CVE-2026-88772 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA emergency directive implies KEV listing with active exploitation of these NetScaler flaws — patch Citrix NetScaler to the vendor-specified remediated version immediately; Wednesday federal deadline signals urgency applicable beyond government.
- SOC/IR — Act: Active exploitation of NetScaler edge appliances warrants an assume-breach sweep — hunt for post-exploitation activity (credential harvesting, lateral movement) originating from NetScaler nodes and check for anomalous sessions since the vulnerability window opened.
- Leader — Act: Confirm whether the organization runs Citrix NetScaler and verify the engineering team has patching underway; CISA emergency directives on widely-deployed edge appliances frequently generate customer and board inquiries, so brief leadership proactively.
- Engineer — Act: Both CVEs are CISA KEV-listed with a public GitHub PoC and confirmed active exploitation — patch Citrix NetScaler ADC and Gateway to Citrix’s remediated versions immediately; treat any internet-exposed NetScaler appliance as potentially compromised pending verification.
- SOC/IR — Act: Active exploitation of perimeter appliances warrants an assume-breach posture — sweep for NetScaler-related IOCs and hunt for lateral movement or persistence artifacts on any NetScaler host going back to initial disclosure; check for anomalous management-plane access.
- Leader — Act: CISA-confirmed global exploitation of a critical edge appliance will generate board and customer questions — confirm whether your environment runs Citrix NetScaler ADC or Gateway, verify your engineering team has initiated emergency patching, and prepare a brief on exposure status before it surfaces externally.
- Signals: CVE-2026-88771 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Actively exploited RCE on NetScaler ADC/Gateway with no patch available; take appliances offline or restrict management-plane access immediately, monitor watchTowr’s advisory for IOCs and check Citrix for any interim mitigations.
- SOC/IR — Act: Active exploitation of internet-facing edge appliances means possible pre-patch compromise; assume-breach posture — hunt for anomalous activity from NetScaler IPs, review watchTowr’s analysis for TTPs, and prepare runbooks for NetScaler IR.
- Leader — Act: Unpatched RCE on a widely deployed network edge product with confirmed active exploitation is a board-level event; confirm whether NetScaler ADC or Gateway is in your estate, assess exposure, and brief leadership this week in case it escalates before a patch ships.
- Engineer — Act: CVE-2026-35273 is CISA KEV-listed with active exploitation; WAF-based mitigations are being circumvented via URL-encoding tricks, so apply Oracle’s vendor patch directly rather than relying on WAF rules — do not treat a WAF rule as a substitute for patching.
- SOC/IR — Act: ShinyHunters is actively exploiting internet-facing PeopleSoft instances; hunt for URL-encoding anomalies in WAF and web server logs, sweep PeopleSoft access logs since KEV listing date for exploitation indicators, and flag any PeopleSoft-exposed assets for assume-breach review.
- Leader — Act: ShinyHunters is an extortion actor now actively compromising PeopleSoft (an HR/ERP system often holding sensitive employee and financial data); confirm whether your org runs PeopleSoft, verify patch status with the responsible team, and brief leadership on extortion exposure before this surfaces in the news.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: No patch action needed — Cloudflare remediated server-side — but teams using Workers Paid should audit what data they’ve placed in Containers/Sandboxes and assess whether sensitive workloads were co-hosted with untrusted tenants during the vulnerable window.
- SOC/IR — Learn: No IOCs, exploitation evidence, or detection surface here; the cross-tenant container residual-data pattern is worth noting as a threat model update for multi-tenant cloud services, but yields no hunt or rule work today.
- Leader — Act: If your organization uses Cloudflare Workers Paid, contact your Cloudflare account team this week to confirm whether your containers were affected and request their incident scope statement before any customer or regulator inquiry arrives.
- Engineer — Plan: Active campaign targeting Azure service principals with credential access and resource deletion is a real exposure for any Azure tenant; audit service principal permissions, review Entra ID sign-in and audit logs for anomalous SP activity, and apply Microsoft’s published hardening guidance this quarter.
- SOC/IR — Act: Microsoft reports this as an active campaign with named TTPs (cloud recon, credential access, resource deletion) mappable to ATT&CK; hunt for unusual service principal authentication patterns in Entra ID and Azure activity logs, and pull detection queries from Microsoft’s defender guidance included in the post.
- Leader — Learn: Named actor campaign confirms cloud identity (service principals) is a live attack surface; useful for contextualizing identity security investment priorities, but no board-level action required unless your team surfaces specific indicators of exposure in your Azure environment.
- Engineer — Act: CVE-2026-35273 is CISA KEV-listed with active mass exploitation and a public PoC; WAF rules blocking /PSEMHUB/ are bypassed by the URL-encoded path /%50SEMHUB/, meaning appliances that appeared mitigated may still be exposed — patch PeopleSoft immediately, update WAF rules to match post-decode paths, and audit PSEMHUB access logs for web shell drops going back to June 2026.
- SOC/IR — Act: UNC6240 is deploying web shells at scale across healthcare, government, tech, and other sectors; hunt web server logs for requests to /%50SEMHUB/ or other URL-encoded variants of the PSEMHUB path, sweep PeopleSoft systems for new or modified files consistent with web shell staging, and treat any PeopleSoft exposure prior to patching as assume-breach.
- Leader — Act: Named threat actor is conducting cross-sector mass exploitation with a bypass that defeats the most common mitigation; if your organization runs Oracle PeopleSoft, confirm exposure status with your engineering team this week, assess whether the June–September window created undetected compromise, and brief leadership given the breadth of affected sectors including healthcare and government.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: An unauthenticated path traversal in Grav CMS was exploited in the wild — if you run Grav CMS on any public-facing server, audit your version and apply the latest patch immediately to close this pre-auth attack surface.
- SOC/IR — Learn: Confirms ShinyHunters actively weaponizes web CMS vulnerabilities, but the item provides no IOCs or ATT&CK-mappable TTPs applicable to enterprise defenses — useful actor context, no hunt action required.
- Leader — Skip
- Engineer — Act: SharePoint (CVE-2026-65660, CVSS 8.8) is CISA KEV-listed, has a public PoC, and is seeing active exploitation — patch immediately per Microsoft’s advisory. Also audit MikroTik RouterOS firmware versions and apply vendor patches for the co-listed flaw.
- SOC/IR — Act: Active exploitation of both SharePoint and MikroTik RouterOS means assume-breach posture for those surfaces: hunt SharePoint access logs for code-injection patterns and sweep network edge devices running RouterOS for anomalous outbound connections or config changes since the KEV listing date.
- Leader — Plan: Confirm whether SharePoint and MikroTik RouterOS appear in your asset inventory and verify engineering teams are tracking CISA BOD remediation timelines; no board-level communication required unless your sector has seen confirmed targeting or you are under federal compliance obligations.
- Signals: CVE-2026-65660 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: CVE-2026-35273 (CVSS 9.8, unauthenticated RCE) is CISA KEV-listed with a public GitHub PoC and confirmed mass exploitation; patch Oracle PeopleSoft immediately and audit web-accessible directories for newly created web shells.
- SOC/IR — Act: ShinyHunters-linked actors are actively deploying web shells post-exploitation, indicating persistent footholds; sweep PeopleSoft-adjacent hosts for web shell artifacts and hunt for anomalous outbound connections from PeopleSoft servers since this campaign began.
- Leader — Act: A mass global campaign by a known data-exfiltration actor targeting PeopleSoft — widely used for HR and ERP — warrants same-week action; confirm whether PeopleSoft is in your environment, verify patch status with engineering, and prepare a brief for leadership given ShinyHunters’ history of large-scale data theft.
- Signals: CVE-2026-35273 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Learn: No patch or config change is actionable here, but this illustrates a design risk in AI agent pipelines: agents may silently exfiltrate data to external services when completing tasks. Factor explicit data-boundary controls into any AI agent integration you build or adopt.
- SOC/IR — Learn: No IOCs or mappable TTPs are available, so no detection work is actionable today. File as awareness that AI agent task execution can produce unexpected outbound data flows worth monitoring if your org runs similar tooling.
- Leader — Act: If your organization uses OpenAI’s agent-based products and provides user data to them, confirm with your OpenAI account team what images were affected, which third-party services received them, and whether any of that data is subject to GDPR or contractual data-residency obligations.
- Engineer — Act: If you run Kiteworks, follow the vendor’s emergency guidance immediately: coordinate the advised shutdown window and monitor the vendor portal for patch or mitigation details as they emerge.
- SOC/IR — Act: Treat any Kiteworks instance in the environment as potentially targeted; heighten log monitoring on those hosts now and prepare an assume-breach sweep plan for when IOCs are published.
- Leader — Act: Confirm this week whether Kiteworks is in your environment, assess business impact of the recommended shutdown, and brief leadership before the downtime window — this vendor-issued emergency notice will likely generate customer and board questions.
- Engineer — Act: If you run Kiteworks, follow vendor guidance to schedule the 9-hour shutdown window and review recent access and file-transfer logs for anomalous pre-incident activity before the maintenance window.
- SOC/IR — Act: If Kiteworks is in your environment, initiate heightened monitoring of authentication and outbound data events now, and prepare an assume-breach sweep plan for the post-shutdown window given the federal threat intelligence backing this warning.
- Leader — Act: Confirm whether your organization uses Kiteworks (note: this vendor’s predecessor Accellion was breached in 2021 affecting dozens of enterprises), assess business continuity impact of the 9-hour outage, and brief leadership before they read about it externally.
- Engineer — Act: Any pipeline that used actions-cool/issues-helper or actions-cool/maintain-one-comment during the recent reactivation window may have executed malware; audit CI/CD build logs for those action references and treat affected workflow runs as potentially compromised.
- SOC/IR — Act: Hunt across pipeline/SIEM logs for workflow runs invoking actions-cool/issues-helper or actions-cool/maintain-one-comment since last week’s reactivation; flag any execution and initiate IR review of affected build environments.
- Leader — Plan: This recurrence of the Mini Shai-Hulud campaign illustrates the risk of unpinned third-party Actions; use it to drive a policy requiring SHA-pinning and inventory approval for all third-party GitHub Actions across engineering teams this quarter.
- Engineer — Act: Active supply-chain compromise in CI/CD is a direct Act trigger — audit every pipeline that references these affected Actions, check recent build logs for signs of malicious payload execution, and rotate any secrets or tokens exposed to those workflow runs.
- SOC/IR — Plan: No IOCs are published in this item, but the Mini Shai-Hulud campaign name suggests threat-intel feeds may carry indicators — check those feeds and build a detection for anomalous GitHub Actions workflow executions or unexpected secret-access events in your CI/CD telemetry.
- Leader — Plan: A named supply-chain campaign actively re-compromising CI/CD Actions warrants asking your engineering team this quarter to confirm pipeline dependency exposure and report back on whether any credential material was at risk.
- Engineer — Act: CISA KEV listing plus public GitHub PoC confirm active exploitation of CVE-2026-5430 (WSO2 auth bypass); patch all affected WSO2 products immediately and audit authentication logs for anomalous bypass activity since PoC is publicly available.
- SOC/IR — Act: Active exploitation confirmed via CISA KEV across WSO2, SharePoint, and Adobe Commerce; hunt for authentication bypass patterns in logs for these platforms and sweep for any anomalous sessions or privilege escalations tied to these products since the PoC went public.
- Leader — Act: CISA-confirmed active exploitation of multiple widely-deployed enterprise platforms (SharePoint, WSO2, Adobe Commerce) warrants an immediate internal exposure check; confirm which products are in the estate and ensure patching teams treat these as P1 this week.
- Signals: CVE-2026-5430 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Both flaws are CISA KEV-listed with confirmed active exploitation; patch WSO2 API Control Plane (CVE-2026-5430, CVSS 9.8) and Adobe Commerce/Magento immediately — a public PoC is on GitHub, lowering the bar for opportunistic exploitation.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation of both products; sweep web and API gateway logs for path traversal patterns targeting WSO2 API Control Plane and audit Adobe Commerce instances for webshell drops or unauthorized file access since the PoC became public.
- Leader — Plan: Confirm whether WSO2 API Control Plane or Adobe Commerce is in your environment and direct engineering to treat these as this-week patches; Adobe Commerce’s payment-processing role adds PCI DSS urgency if applicable.
- Signals: CVE-2026-5430 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
Act
archived
Storm-2570 ransomware affiliate: consistent tradecraft across Qilin, DragonForce, Anubis, BERT
- Engineer — Learn: No exploitable vulnerability or patchable component here — this is post-compromise TTP analysis. Worth reviewing to understand how Storm-2570 stages before detonation, which could inform detection-oriented hardening of endpoint configs or logging.
- SOC/IR — Act: Microsoft documents Storm-2570’s reusable pre-ransomware toolchain across four active ransomware families with defender detection guidance — review the full blog post, map identified TTPs to ATT&CK, and tune or create SIEM/EDR rules against the common tradecraft patterns before the next deployment hits.
- Leader — Learn: A single-source threat-actor profile with no confirmed incident or sector-specific targeting disclosed; useful background for briefing on ransomware affiliate sophistication and the multi-group risk model, but no same-week action needed.
- Engineer — Act: Active exploitation confirmed by a national cyber security authority plus a public PoC on GitHub makes this urgent despite low EPSS; patch Roundcube to 1.6.16 (1.6.x branch) or 1.7.1 (1.7.x branch) immediately on any self-hosted instance.
- SOC/IR — Act: Pre-auth exploitation means no valid credentials needed, so assume-breach posture for any environment running Roundcube; sweep Roundcube database and web logs for anomalous virtuser_query parameter patterns dating back to when the PoC became public, and hunt for post-exploitation activity such as unexpected outbound connections from the webmail host.
- Leader — Plan: Confirm whether self-hosted Roundcube is in use across internal systems or managed-service dependencies; if so, escalate to engineering for same-week patching given active exploitation of this webmail attack surface, which could expose sensitive communications or credentials.
- Signals: CVE-2026-48842 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Search all repos, internal docs, and README files for references to ’third-party[.]com’ and replace them; any user clicking the link from documentation now risks a ClickFix social-engineering payload targeting Windows.
- SOC/IR — Act: Block third-party[.]com at DNS/proxy immediately, sweep web proxy and DNS logs for recent queries to that domain, and hunt for ClickFix execution indicators (mshta/PowerShell spawned from browser or Run dialog) since the domain became malicious.
- Leader — Plan: This demonstrates a new documentation-placeholder squatting attack class affecting thousands of open-source projects; task engineering to audit internal repos this quarter and add placeholder-domain checks to developer guidelines and repository scanning policy.
- Engineer — Skip
- SOC/IR — Learn: North Korean actor targeting crypto exchange hot/warm wallets; no IOCs or TTPs published yet — monitor for follow-on reporting with detection-actionable detail.
- Leader — Act: If your organization uses Bitget or has crypto custody exposure, confirm current holdings status and request an incident attestation; brief finance and legal given potential counterparty risk and the scale of this theft.
- Engineer — Act: If you expose Docker daemon sockets (TCP port 2375/2376) without auth, audit immediately and either bind to localhost-only or enforce TLS mutual auth; scan for Hermes Agent processes or unexpected AI framework containers on Docker hosts.
- SOC/IR — Plan: Build detections for unexpected container spawns or Hermes Agent framework activity on Docker hosts; hunt for outbound C2 from container workloads as a new campaign variant to cover this quarter.
- Leader — Skip
- Engineer — Act: Unauthenticated RCE in WordPress (CVSS 9.2) is being actively exploited with a public PoC; patch WordPress core to the latest fixed release immediately and audit any internet-exposed WordPress instances for signs of compromise via local file inclusion.
- SOC/IR — Act: Active exploitation is underway — hunt for anomalous unauthenticated requests to WordPress endpoints involving path traversal or unexpected PHP file inclusion patterns, and baseline your web access logs against activity starting at the hour of CVE disclosure.
- Leader — Plan: Not yet a board-level event (no KEV, low EPSS), but WordPress’s ubiquity makes this a priority for this quarter — confirm engineering has inventoried and is patching all WordPress deployments before this escalates to KEV status.
- Signals: CVE-2026-87902 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active exploitation confirmed — attackers are writing PHP webshells to disk via CVE-2026-87902; patch WordPress immediately and audit wp-content directories and recently modified PHP files for unauthorized shells.
- SOC/IR — Act: Assume-breach posture for any WordPress hosts; hunt for newly created or modified PHP files in web roots, anomalous HTTP requests reaching previously non-existent paths, and OS command execution spawning from web server processes.
- Leader — Plan: Confirm whether the organization runs WordPress and direct engineering to prioritize patching this quarter; active exploitation is under way but this has not yet reached Log4Shell-scale board visibility.
- Signals: CVE-2026-87902 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: TeamFiltration targets M365 tenants using default/weak credentials; audit your tenant for accounts lacking MFA and enforce Conditional Access policies requiring phishing-resistant auth before this campaign broadens its target geography.
- SOC/IR — Act: Active M365 credential-spray campaign is live and compromising accounts; hunt for TeamFiltration enumeration patterns in Azure AD sign-in logs and flag clusters of authentication attempts originating from AWS EC2 CIDR ranges with mixed failure/success ratios.
- Leader — Learn: Seven-account compromise across 28 tenants is low scale and currently regional (Chilean retail/finance), but the default-password attack path is a useful data point for board-level conversations about basic credential hygiene and MFA adoption metrics.
- Engineer — Act: Patch Roundcube Webmail to the version released in May or later immediately — active exploitation confirmed by a national cyber authority means this is no longer a routine patch-window item; prioritize any self-hosted Roundcube instances over other queued work.
- SOC/IR — Act: Sweep Roundcube server logs for signs of code injection attempts since May; active exploitation of a webmail platform can yield credential access or persistent footholds before patching occurs, so assume-breach investigation is warranted on any unpatched instances.
- Leader — Skip
- Engineer — Plan: Audit your developer documentation, internal wikis, and code examples for placeholder domains that resolve to live addresses — ’third-party.com’ is now actively malicious. This quarter, establish a doc review process to catch example domains before they reach users.
- SOC/IR — Act: Search proxy and DNS logs for connections to third-party.com; hunt for ClickFix-pattern PowerShell execution following fake Cloudflare CAPTCHA pages, particularly on developer workstations where traffic to doc-linked domains is expected and may slip past scrutiny.
- Leader — Learn: A subtle supply-chain-adjacent technique where expired or unclaimed placeholder domains in developer documentation become lure infrastructure — no immediate leadership action required, but useful context for developer-endpoint risk discussions.
- Engineer — Act: CVE-2026-86060 is CISA KEV listed with a public PoC, and the chain enables unauthenticated admin takeover of internet-exposed RouterOS devices. Immediately patch RouterOS to the vendor-fixed version, disable SSH exposure on WAN interfaces, and audit firewall rules to confirm MikroTik management ports are not reachable from the internet.
- SOC/IR — Act: CVE-2026-86060 is KEV listed and attack logs confirm real-world exploitation; hunt for anomalous SSH sessions or new admin accounts on any MikroTik devices in the estate since the earliest known attack date, and add detections for unauthenticated admin-session establishment on edge routers.
- Leader — Skip
- Signals: CVE-2026-67279 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub · CVE-2026-86060 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: First documented weaponization of the HashiCorp Terraform registry as a malware distribution vector directly affects IaC pipelines. Audit all Terraform provider lockfiles and go.sum entries for gocommunity-io/dockerd and the kreuzwenker-prefixed module, and check CI/CD artifact logs for downloads of either package.
- SOC/IR — Plan: No published IOCs or TTPs beyond package names, but this technique warrants building detection for anomalous Terraform provider fetches in CI/CD telemetry; add queries against build logs for downloads of the named providers and alert on new or unrecognized provider sources in IaC pipeline runs.
- Leader — Learn: This marks the first recorded use of HashiCorp’s centralized registry as a malware delivery channel, expanding the trusted-tooling supply chain threat surface; useful context for updating third-party software sourcing policies and vendor risk discussions, but download counts are low and there is no systemic breach requiring immediate leadership action.
- Engineer — Act: Public PoC exists for a CVSS 9.8 unauthenticated RCE affecting all Bifrost HTTP transport versions before 2.1.0 — if you run this AI gateway in any environment, patch to 2.1.0 immediately and audit for signs of exploitation in management endpoint logs.
- SOC/IR — Plan: No active exploitation signals yet (EPSS 0.01, not KEV-listed), but a public PoC raises near-term risk — if Bifrost appears in your estate, write a detection for unauthenticated HTTP requests to its management interface before campaigns emerge.
- Leader — Skip
- Signals: CVE-2026-90898 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Learn: No cloud/infra vulnerability here — this is a social-engineering/sideload campaign against mobile devices. Worth reviewing Android fleet policy and app allowlisting if logistics operations are in scope, but no patch or config action is required today.
- SOC/IR — Act: Sweep MDM inventory for devices with the package ‘com.corp.mdm’ installed, and hunt for recent APK sideloads from unofficial sources on devices assigned to logistics or supply-chain roles.
- Leader — Learn: An active mobile campaign impersonating real logistics brands (CEVA, TKW) is relevant context for the risk register if the organization operates in or depends on logistics; no immediate leadership action required unless direct exposure is confirmed.
- Engineer — Act: TeamCity is core CI/CD infrastructure; active ransomware exploitation means immediate patching to the July release is overdue — also audit build logs and pipeline configurations for signs of unauthorized access or tampered artifacts.
- SOC/IR — Act: With ransomware actors actively leveraging this, hunt for unusual authentication events, anomalous build triggers, or lateral movement originating from TeamCity hosts; a compromised CI/CD server is an assume-breach scenario for the entire build pipeline.
- Leader — Act: Ransomware exploitation of CI/CD infrastructure carries supply-chain and disclosure risk — confirm whether TeamCity is run internally or by key software vendors, and brief leadership before a downstream incident surfaces the question.
- Engineer — Act: Pre-auth RCE on a widely deployed VPN gateway with CISA KEV listing, active exploitation, and a public PoC demands immediate action: apply Check Point’s patch for CVE-2026-85102, then audit gateway logs for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation of an edge VPN device requires an assume-breach posture: hunt for unusual outbound connections or lateral movement originating from or through Check Point Security Gateway hosts since the earliest known exploitation date, and check threat intel feeds for published IOCs tied to this campaign.
- Leader — Act: CISA KEV listing and confirmed active exploitation of a perimeter VPN appliance are board-question-level conditions: confirm whether Check Point Security Gateway is in your environment, verify your team has an emergency patch plan, and be ready to brief leadership on exposure before this surfaces in the news.
- Signals: CVE-2026-85102 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: If you operate e-commerce or payment pages, audit your site’s JavaScript for unauthorized injections and review third-party script integrity; no specific CVE or PoC named in signals, but the attack vector (skimmer injection at scale via AI agents) warrants a near-term sweep of Content Security Policy and SRI enforcement.
- SOC/IR — Act: Active large-scale skimming campaign targeting online retailers — hunt for unauthorized script injections or outbound data exfiltration from payment pages in your estate; tune web proxy and SIEM rules for known skimmer exfil domains as IOCs become available.
- Leader — Plan: 600K card records stolen signals a material e-commerce threat trend; if your org runs or depends on online retail platforms, verify your payment page security posture and confirm whether any vendors in your supply chain were among the 100+ compromised sites.
- Engineer — Act: Public PoC exists for a container-to-host-root escape on Ubuntu 22.04/24.04/26.04 LTS — all still unpatched. Apply the upstream kernel fix manually or enforce strict seccomp/AppArmor profiles on all container workloads immediately, and track Ubuntu’s security backport channel for the official LTS patch.
- SOC/IR — Plan: No evidence of active exploitation yet (EPSS 0.00, not on KEV), but a public PoC makes this a near-term detection priority; build or tune rules for anomalous privilege escalation originating from container processes and AF_UNIX socket abuse before exploitation begins.
- Leader — Skip
- Signals: CVE-2026-80521 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Multi-source corroboration (Aikido, SafeDep, Socket, StepSecurity) of an active supply-chain compromise in npm and PyPI — a direct Act signal per channel criteria. Audit your dependency trees for @memtensor/memos-cloud-openclaw-plugin and any related MemTensor packages; remove or pin away from affected versions and rotate credentials on any systems where compromised versions were installed or executed.
- SOC/IR — Act: Active credential-stealing implant with cross-platform reach on developer and CI/CD systems warrants an immediate sweep. Hunt for sckit process artifacts and anomalous outbound connections from build environments and developer endpoints since the affected package versions were published; prioritize Linux and macOS systems alongside Windows given the cross-platform Go implant.
- Leader — Plan: A corroborated supply-chain compromise delivering a credential stealer could expose internal secrets or customer data if engineering teams pulled the affected packages. Confirm whether MemTensor packages appear in any internal dependency inventories and request a scope assessment from your engineering leads this week before this surfaces as a customer security question.
- Engineer — Act: A live malicious npm package impersonating a Twilio security tool can exfiltrate credentials from developer environments. Audit npm dependency trees and CI/CD install logs for ’tw-pkgprobe-7731’ and ensure no project has pulled it since mid-August 2026.
- SOC/IR — Act: The package name ’tw-pkgprobe-7731’ (uploaded by ’twdepprobe7731’) is a concrete IOC; sweep CI/CD pipeline logs and artifact registries since mid-August 2026 for any installation or download of this package to identify potential credential exposure.
- Leader — Skip
- Engineer — Act: BIG-IP APM is a common enterprise edge/access device; active RCE exploitation with a patch now available means immediate upgrade is warranted — apply F5’s security updates to BIG-IP APM without waiting for your normal patch window.
- SOC/IR — Act: Active exploitation of an edge access device requires an assume-breach posture — sweep BIG-IP APM logs for anomalous sessions, unauthorized admin activity, or unusual outbound connections dating back before the patch was issued.
- Leader — Act: Confirm within the week whether BIG-IP APM is in your estate; if so, direct engineering to treat this as emergency patching and brief incident response, as actively exploited perimeter RCE zero-days carry real breach risk before patching completes.
- Engineer — Act: CISA KEV-listed, public PoC, and confirmed active exploitation on F5 BIG-IP APM systems configured as OAuth authorization servers — apply F5’s engineering hotfix for CVE-2026-94127 immediately and verify whether any BIG-IP instances serve that OAuth role.
- SOC/IR — Act: Active exploitation of an edge device that precedes patching means assume-breach posture — sweep BIG-IP APM logs for anomalous unauthenticated requests to OAuth endpoints and hunt for post-compromise lateral movement since at least September 22.
- Leader — Act: Actively exploited unauthenticated RCE on a widely-deployed enterprise network appliance warrants same-week action — confirm whether BIG-IP APM is in use as an OAuth server, verify engineering has the hotfix on track, and be ready to brief leadership if it is.
- Signals: CVE-2026-94127 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: Device code phishing industrialization is a signal to audit whether OAuth device code flow is enabled in your Entra ID / identity provider — restrict it to only necessary clients and enforce conditional access policies that block token reuse from unexpected locations.
- SOC/IR — Act: EvilTokens was actively stealing tokens at scale via device code flow; hunt for anomalous device code authentication requests in your identity logs (Entra Sign-in logs, unified audit log) since at least early 2026, and tune detections for device code grants issued to unfamiliar device types or followed by token use from new geographies.
- Leader — Learn: The Microsoft DCU-led disruption illustrates how AI-assisted PhaaS platforms are lowering the bar for credential and token theft campaigns; useful context for the next board or risk-committee briefing on evolving phishing sophistication.
- Engineer — Act: Active exploitation of ZyXEL GS1900 switches and WordPress is confirmed with measurable data theft. Patch both to current versions immediately and audit backend database access logs and switch management interfaces for unauthorized access or lateral movement.
- SOC/IR — Plan: An active Chinese-attributed campaign is targeting ZyXEL switches and WordPress for database exfiltration, but the summary provides no specific IOCs. Build or tune detections for anomalous outbound queries from web servers and unauthorized switch management activity, and begin a retrospective hunt across those log sources.
- Leader — Plan: A Chinese-speaking actor has compromised nearly 1,000 devices and exfiltrated thousands of records in an ongoing government-targeting campaign. Confirm whether the organization runs ZyXEL GS1900 switches or internet-facing WordPress, and escalate to leadership if operating in sectors adjacent to government contracts.
- Engineer — Act: All three CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation: patch Chrome for CVE-2026-85046 and CVE-2026-87491, and apply the Windows ALPC patch for CVE-2026-85880 immediately — every endpoint running Chrome on Windows is in scope.
- SOC/IR — Act: Nation-state actor UTA0565 is actively deploying CLEANGULP via drive-by fake websites; hunt for CLEANGULP IOCs across endpoints, review proxy/DNS logs for suspicious domains active around September 3–4, and tune detections for anomalous Windows ALPC activity triggered from browser processes.
- Leader — Act: A Chinese nation-state actor is weaponizing a three-CVE chain against Chrome and Windows — software present on virtually every enterprise endpoint — with all three CVEs CISA KEV-listed; confirm with engineering that the patch cycle is complete and brief leadership if your sector is a known UTA0565 target.
- Signals: CVE-2026-85046 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub · CVE-2026-85880 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub · CVE-2026-87491 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV-listed with a public GitHub PoC and confirmed exploitation — patch Check Point Security Management Server to the September 22 fix immediately; the flaw allows unauthenticated script execution on the server that controls your firewall policies.
- SOC/IR — Act: Exploitation dates to July 23, so sweep Check Point management server access logs for anomalous unauthenticated web service calls and unexpected script executions from that date forward; assume-breach posture is warranted given KEV listing.
- Leader — Act: If Check Point is in the environment, confirm the management server has been patched to the September 22 release and request a compromise assessment covering activity since July 23 — attacker access here means potential modification of firewall policies across the estate.
- Signals: CVE-2026-93616 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Actively exploited arbitrary script execution on Check Point Security Management Server — apply the emergency hotfix immediately; treat as critical given the management-plane exposure.
- SOC/IR — Act: A compromised security management server grants broad access to the security estate — sweep for unauthorized script execution or anomalous API calls on Check Point management consoles since the vulnerability became public, and assume-breach posture if patching was delayed.
- Leader — Act: If your organization runs Check Point Security Management Server, confirm the emergency hotfix has been applied this week and ask your team whether any management-plane activity warrants an exposure assessment — compromise of security tooling is board-question territory.
- Engineer — Act: VeloCloud Orchestrator On-Prem is actively exploited network management infrastructure — apply Arista’s released patches immediately and treat all unpatched VCO instances as potentially compromised.
- SOC/IR — Act: Active exploitation means systems may have been compromised before patches were available — sweep VCO On-Prem hosts for anomalous admin activity, lateral movement, and configuration changes since the zero-day window opened.
- Leader — Act: Actively exploited zero-day in SD-WAN management infrastructure warrants same-week action — confirm whether VCO On-Prem is deployed, verify the patch has been applied or is on an emergency timeline, and brief IT leadership on exposure status.
- Engineer — Act: CVE-2026-7273 is CISA KEV-listed with a public PoC on GitHub; patch Zyxel GS1900 series switch firmware immediately and audit Veeam deployments for associated flaws granting SYSTEM-level access.
- SOC/IR — Act: Active exploitation of an edge network device warrants an assume-breach posture; sweep for Zyxel GS1900 switches in the estate and hunt for anomalous lateral movement or command execution sourced from switch management interfaces since the disclosure date.
- Leader — Plan: CISA KEV confirmation of active exploitation in network switches and backup software (Veeam) is a concrete risk item; confirm with engineering this week that Zyxel GS1900 and Veeam instances in your environment are patched and request a status update before month-end.
- Signals: CVE-2026-7273 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: A public PoC now lowers the exploitation bar for this CSRF-to-PHP-execution flaw in WordPress Core; patch WordPress to the latest patched release and verify that admin-facing endpoints require nonce validation.
- SOC/IR — Plan: No confirmed active exploitation yet, but a public PoC means campaigns are likely imminent; build or tune detections for anomalous PHP execution originating from WordPress admin paths and unexpected file-write activity on web roots.
- Leader — Learn: A meaningful WordPress Core vulnerability with a published exploit — not yet at systemic scale, but worth confirming your engineering team has patched any WordPress instances; no board-level action required unless exploitation becomes widespread.
- Engineer — Act: A public PoC on GitHub makes exploitation practical despite a low EPSS score; the anonymous-commenter-to-admin-RCE chain is severe. Patch WordPress core to version 7.1.1 immediately across all managed sites.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet, but the public PoC makes detection work urgent this quarter. Build rules to flag suspicious JavaScript payloads in WordPress comment submissions and unexpected server-side execution correlated with admin page visits.
- Leader — Skip
- Signals: CVE-2026-93485 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Learn: No KEV listing or PoC signals; the campaign targets individuals via fake job interviews delivering malware, so engineering teams should be aware of the social-engineering vector but no immediate patch or config action is required today.
- SOC/IR — Act: Joint advisory indicates active, widespread campaign — hunt for Contagious Interview TTPs (fake recruiter lures, malicious npm/Python packages, BeaverTail/InvisibleFerret malware) in endpoint and email telemetry, and sweep for IOCs from the advisory across devices belonging to engineering and crypto-adjacent staff.
- Leader — Plan: A confirmed North Korean campaign at this scale targeting engineers and crypto wallets warrants a policy review of how staff handle unsolicited recruiting outreach and code from unknown sources; brief security awareness owners to update training for engineering and finance teams this quarter.
- Engineer — Learn: No patch or config change applies here — the attack requires a user to execute a fake installer. Worth understanding that WHCP-signed kernel drivers can be weaponized to blind EDR before a stealer runs, which has implications for defense-in-depth design (e.g., application allowlisting, restricting GitHub-sourced executables in managed environments).
- SOC/IR — Act: This campaign shows zero AV/EDR detections due to the signed driver kill-chain, making standard signature coverage unreliable; hunt for suspicious kernel driver loads coinciding with LastPass-themed installer execution and tune detections on processes attempting to terminate security tooling (EDR self-protection bypass behavior).
- Leader — Plan: If LastPass is in the enterprise toolset, issue an internal advisory directing users to install authenticator apps only from official vendor or app-store sources; this is a brand-abuse social-engineering vector that warrants a user-awareness communication this quarter rather than immediate escalation.
- Engineer — Plan: PhaaS platforms like EvilTokens typically use AiTM techniques that bypass standard MFA; audit Microsoft 365 Conditional Access policies and prioritize rollout of phishing-resistant MFA (FIDO2/passkeys) to eliminate token-theft risk across your tenant.
- SOC/IR — Act: Platform disruption does not remediate already-compromised sessions; hunt for anomalous OAuth token grants, impossible-travel sign-ins, and legacy authentication usage in your Microsoft 365 environment covering the campaign’s active window.
- Leader — Act: With 10,000+ organizations affected, confirm this week whether your organization received a Microsoft DCU breach notification and verify your Microsoft 365 tenants were not among the 12,000 compromised accounts; brief leadership before they encounter the story externally.
- Engineer — Act: Actively exploited CVSS 10.0 with a public PoC — if you run on-premises VeloCloud Orchestrator with certificate-based Edge authentication, apply Arista’s patch or available mitigations immediately and isolate the VCO management plane from untrusted networks while patching.
- SOC/IR — Act: Active exploitation of a network management appliance means you should assume potential compromise on affected systems; sweep VCO host logs for anomalous internal function invocations or unexpected outbound connections since September 22 and flag any certificate-authenticated VCO instances for immediate IR triage.
- Leader — Plan: Confirm with engineering whether the organization runs on-premises VeloCloud Orchestrator with certificate-based authentication; if so, escalate to engineering for priority patching this week given active exploitation of a maximum-severity flaw in a network control-plane component.
- Signals: CVE-2026-93952 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: A public PoC on GitHub for a guest-to-host escape on ARM64 KVM hosts with nested virtualization enabled demands immediate attention: patch the Linux kernel to the fixed version and, where nested virtualization is not required, disable it now to remove the attack surface.
- SOC/IR — Learn: No active exploitation is reported and EPSS is effectively zero, so there is no detection action to take today; however, understanding the KVM guest-escape technique is worth filing for future hunt hypothesis development should exploitation emerge.
- Leader — Skip
- Signals: CVE-2026-89775 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CISA KEV listing confirms active exploitation of Zyxel GS1900 series switches; if any are in your environment, patch immediately and audit management-plane access logs for signs of unauthorized access.
- SOC/IR — Act: Active exploitation for data theft means assume-compromise posture on any Zyxel GS1900 devices; hunt for anomalous traffic or config changes originating from or through these switches since KEV listing date.
- Leader — Plan: Confirm whether Zyxel GS1900 switches appear in network inventory and verify patching is prioritized this week; federal agencies face a hard CISA deadline, but private-sector organizations should treat this as elevated-urgency given confirmed exploitation.
- Engineer — Act: CISA confirmation of active exploitation is effectively a KEV signal — pull the advisory for CVE IDs and patch Linux kernels on all cloud hosts, container nodes, and CI runners to fixed versions immediately; one flaw is rated critical.
- SOC/IR — Act: Active exploitation confirmed by CISA warrants an assume-breach posture on Linux servers — sweep for anomalous kernel-level activity and privilege escalation events since the advisory date, and tune EDR/auditd rules for kernel exploit post-exploitation behavior while patching proceeds.
- Leader — Plan: Confirm your engineering team has triaged and prioritized the CISA-flagged CVEs; organizations under FedRAMP or federal contracts face mandatory KEV remediation deadlines and should verify compliance timelines are met.
- Engineer — Plan: If you run BigCommerce storefronts with third-party apps, audit installed apps for Ribon-linked integrations and review your CSP headers and script-injection monitoring; no CVE or patch available, but credential hygiene for marketplace apps is the control surface here.
- SOC/IR — Plan: Add detection coverage for unexpected third-party script injections in e-commerce environments; hunt for new or modified script tags in storefront page responses if BigCommerce is in scope for your estate.
- Leader — Act: If your organization operates BigCommerce storefronts, confirm whether Ribon apps are installed and request BigCommerce’s incident report; this may trigger PCI DSS or customer notification obligations if payment-adjacent data was exposed.
- Engineer — Learn: PNG steganography as a payload delivery mechanism is a technique worth understanding for detection design, but there is no vulnerability to patch or misconfiguration to fix — no direct engineering action required today.
- SOC/IR — Act: IOCs for the steganographic PNG files have been published; sweep file transfer and web proxy logs for these IOCs and consider building a detection for suspicious outbound reverse tunnel activity paired with PNG downloads in multistage intrusion chains.
- Leader — Skip
- Engineer — Act: The TanStack npm supply chain attack in May stole credentials from developer machines; audit your lockfiles for malicious TanStack package versions from that window and rotate any npm tokens or GitHub credentials that may have been exposed. Also verify offboarding checklists immediately revoke GitHub org access upon employee departure.
- SOC/IR — Plan: This incident had roughly a 4-month dwell time before discovery; build or tune detections for bulk GitHub repository cloning events and unusual API access patterns from recently offboarded accounts — no specific IOCs are published yet to enable an immediate sweep.
- Leader — Act: CrowdSec, a security vendor, confirmed ~170 private repositories were exfiltrated; if your organization uses CrowdSec products, request an incident attestation to understand whether any shared intelligence or configurations were exposed. Separately, this breach stemmed from a failed offboarding — review your own access-revocation policy and confirm it mandates same-day removal of all VCS and cloud access.
- Engineer — Act: Public working exploits exist for four local privilege-escalation flaws in the Linux kernel; patch all Linux systems to the latest kernel release immediately, prioritizing internet-exposed hosts and Kubernetes nodes where container escapes amplify blast radius.
- SOC/IR — Plan: With public exploit code now circulating, any foothold on an unpatched Linux host trivially becomes root; tune or add detections for anomalous kernel exploit patterns (e.g., unexpected setuid execution, unusual /proc writes) and escalate priority on Linux privilege-escalation alerts until fleet patch coverage is confirmed.
- Leader — Skip
- Engineer — Learn: The advisory confirms an active North Korean campaign at scale, but the summary names no specific exploited software or CVEs to patch; review the full law enforcement advisory for any affected platform or dependency details.
- SOC/IR — Plan: Pull the joint law enforcement advisory for WaterPlum IOCs and ATT&CK-mapped TTPs, then build hunts targeting the December 2025–July 2026 activity window across endpoint and network telemetry.
- Leader — Act: A multi-agency advisory on a sustained North Korean campaign affecting 30,000 devices with confirmed financial losses warrants a brief to leadership this week; assess whether your sector or any cryptocurrency-related vendors are in the target profile.
- Engineer — Act: Actively exploited pre-auth RCE with a public PoC on GitHub overrides the low EPSS; patch Orkes Conductor to 3.30.2 or later immediately if running any version before that.
- SOC/IR — Act: Active exploitation confirmed by Fortinet means assume-breach posture for any environment running Orkes Conductor — sweep for anomalous process spawns from the Conductor service and pull Fortinet’s report for available IOCs to hunt against SIEM data.
- Leader — Plan: Verify whether Orkes Conductor is in your tech stack; if confirmed, escalate to engineering as urgent given active exploitation of a 9.8 CVSS pre-auth RCE — this is not yet a board-level systemic event unless your org is exposed.
- Signals: CVE-2026-58138 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub
- Engineer — Act: All three CVEs are CISA KEV-listed with confirmed active exploitation; CVE-2025-39682 carries CVSS 9.8 with a public GitHub PoC. Apply available Linux kernel patches immediately across all hosts, prioritizing internet-facing or TLS-terminating systems.
- SOC/IR — Act: Active exploitation is confirmed by CISA KEV for kernel-level flaws — assume-breach posture is warranted on Linux hosts. Run an EDR sweep for unusual kernel module loads, privilege escalations, or post-exploitation behavior on Linux systems since the date of first exploitation disclosure.
- Leader — Plan: Three actively exploited Linux kernel CVEs including a CVSS 9.8 flaw warrant confirming your team’s patch response this week; direct engineering to validate patch status across Linux infrastructure and report back before the next leadership sync.
- Signals: CVE-2025-39682 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Supply-chain compromise via npm is directly in scope — audit your package-lock.json and dependency trees for these 13 named packages immediately, remove any matches, and rotate credentials and tokens accessible from affected developer workstations or CI runners.
- SOC/IR — Plan: The overlap with DPRK’s Contagious Interview campaign (BeaverTail TTPs) gives a detection anchor — build or tune rules for suspicious npm package installs on developer endpoints and Chrome extension storage access patterns consistent with credential harvesting.
- Leader — Learn: A DPRK-linked supply-chain operation targeting developer npm environments is worth adding to the developer-risk section of the risk register, but no systemic or vendor-level exposure is confirmed yet — monitor for follow-on reporting.
- Engineer — Act: A pinned-version bypass in AI coding agents enables malicious plugin substitution via a controlled upstream repo — a direct supply-chain risk in CI/CD pipelines. Update Claude Code to ≥2.1.179 and OpenAI Codex to ≥0.146.0 immediately; audit all plugin sources across affected agents and restrict GitHub Copilot plugin use until a patch is confirmed.
- SOC/IR — Plan: No published IOCs or active exploitation reported, but this introduces a new class of AI coding agent supply-chain abuse worth covering. Build detections on anomalous plugin installation behavior and source-repository mismatches in CI/CD pipeline logs, prioritizing environments running unpatched Copilot.
- Leader — Plan: AI coding agents are broadly deployed in engineering orgs and this vulnerability lets a compromised upstream plugin repo silently inject malicious code even with pinned versions. Task the security team to inventory which AI coding agents are in use and confirm patch status — GitHub Copilot appears to lack a fix, warranting a risk assessment before the next sprint cycle.
- Engineer — Plan: No customer-side patch action is needed — Microsoft fixed this server-side — but a public PoC existed before the fix, so audit Azure AI Foundry activity and IAM logs for unauthorized privilege escalations that may have occurred during the exposure window.
- SOC/IR — Act: A public PoC on GitHub combined with a CVSS 10.0 network-accessible privilege escalation means exploitation attempts are plausible; hunt for anomalous privilege escalation events in Azure AI Foundry audit logs and Azure Entra activity logs predating the patch.
- Leader — Plan: Confirm whether Azure AI Foundry is in use and have the team verify no exploitation occurred during the pre-patch window; the CVSS 10.0 score and public PoC will likely generate customer or board inquiries, so prepare a brief noting Microsoft resolved it server-side with no customer action required.
- Signals: CVE-2026-85889 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: A public PoC exists for this container escape on macOS; any engineer running Docker Sandboxes should update to the patched version immediately and audit shared directories for unexpected access. Until patched, avoid running untrusted code inside Docker Sandboxes VMs.
- SOC/IR — Learn: No active exploitation signals and no KEV listing; primarily an engineer patching concern. Worth noting the attack pattern (VM guest escaping to host filesystem via shared directory traversal) for future detection development.
- Leader — Skip
- Signals: CVE-2026-77179 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: If your web properties embed Brevo JavaScript, audit those pages now for ClickFix script injection and remove or replace the embed; also audit your own Cloudflare API key scopes and rotation practices to prevent analogous key theft.
- SOC/IR — Act: Hunt for ClickFix execution artifacts—browser-spawned PowerShell, clipboard-injected command execution—on endpoints whose users visited Brevo-embedded pages during the compromise window; check EDR for downstream post-exploitation activity from any hits.
- Leader — Act: Confirm whether your organization uses Brevo’s embedded JS on customer-facing sites; if so, determine the exposure window and assess whether visitors received malicious scripts triggering breach-notification or disclosure obligations under applicable regulations.
- Engineer — Act: Active exploitation of an unauthenticated OS command execution flaw (CVSS 9.8) in Issabel PBX — if you run Issabel, patch immediately or isolate the management interface from public network access and audit for indicators of prior compromise.
- SOC/IR — Act: Active exploitation reported; hunt for anomalous command execution or outbound connections from Issabel/PBX systems since this vulnerability became public, and check whether any internet-exposed PBX management interfaces exist in the estate.
- Leader — Skip
- Signals: CVE-2026-89026 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: This mirrors the Polyfill.io hijack pattern — any hard-coded reference to the re-registered CDN hostnames in your repos, docs, or build artifacts now loads content from an untrusted owner. Audit all codebases, IaC, and documentation for references to the named CDN hostnames and replace or remove them immediately.
- SOC/IR — Plan: No confirmed malicious payload delivery is noted yet, but the new owner could begin serving malicious scripts at any time. Build a detection rule for outbound DNS/HTTP connections to the re-registered domain, and queue a proxy-log hunt back to the re-registration date of July 2025.
- Leader — Plan: This is a recurring supply-chain risk class — abandoned third-party asset domains re-registered for abuse (analogous to Polyfill.io). Use this as a trigger to establish or reaffirm a policy requiring engineering teams to audit hard-coded external CDN dependencies on a regular cadence.
- Engineer — Act: Apply Microsoft’s documented workaround now if you’ve deployed September 2026 Windows 11 updates and have domain-joined endpoints experiencing authentication failures; review patch deployment rollout to contain blast radius.
- SOC/IR — Plan: Authentication failures from patch regression can mask or mimic credential attacks; note the September 2026 Windows 11 update timeline when triaging domain login anomalies to avoid false-positive escalations.
- Leader — Skip
- Engineer — Act: A public PoC exists for this critical heap overflow enabling RCE against any Unbound resolver that validates DNSSEC; patch to Unbound 1.26.1 immediately and verify all resolver deployments (containers, host-based, service mesh sidecars) are updated.
- SOC/IR — Learn: No active exploitation or IOCs reported, and EPSS is 0.01; the attack path (attacker-controlled zone triggers RCE in resolver) is worth noting for future hunt hypotheses, but no detection work is warranted until exploitation evidence emerges.
- Leader — Skip
- Signals: CVE-2026-81642 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Cisco ISE is a common enterprise NAC/identity platform; max severity plus confirmed active exploitation demands immediate patching — apply Cisco’s released security update to all ISE nodes now and verify no unauthorized admin sessions exist.
- SOC/IR — Act: Compromise of ISE could yield network access bypass or credential theft; hunt for anomalous authentication events, unexpected admin logins, and unusual policy changes in ISE audit logs since the vulnerability window opened.
- Leader — Act: Cisco ISE is widely deployed for network access control; confirm whether your organization runs it and direct teams to emergency-patch this week — active exploitation of identity infrastructure at max severity is a likely board or customer question.
- Engineer — Act: Cisco ISE is widely deployed as network access control in enterprise environments; unauthenticated API auth bypass at CVSS 10.0 with CISA KEV listing and public PoC demands immediate action — apply Cisco’s posted mitigation or patch for CVE-2026-76460 and restrict ISE API endpoint exposure at the network layer until patched.
- SOC/IR — Act: Active exploitation of an ISE auth bypass means attackers may already have bypassed NAC controls; hunt for anomalous unauthenticated API calls against ISE endpoints in your perimeter logs and assume-breach sweep network access audit trails since at least the PoC publication date.
- Leader — Act: A CVSS 10.0 actively exploited zero-day in Cisco ISE — a core identity and network access control product in most enterprise stacks — warrants same-week action: confirm whether ISE is in use, verify your team is executing Cisco’s mitigations, and prepare a brief for leadership given the likelihood of press coverage and customer security questions.
- Signals: CVE-2026-76460 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: CVSS 9.8, public PoC on GitHub, and active exploitation of JWT signature bypass enabling forged admin tokens — patch WSO2 API Manager to the latest patched release immediately and audit API Manager admin audit logs for unauthorized token-based access.
- SOC/IR — Act: Active exploitation via forged admin JWTs creates a detectable anomaly — hunt for unusual admin-level API calls or JWT tokens with unexpected issuer or signature fields in WSO2 API Manager logs since the PoC became public.
- Leader — Plan: WSO2 API Manager is common enterprise middleware; confirm whether it is in your environment and verify engineering has this patched this sprint — not yet KEV-listed or board-level but a 9.8 with live exploitation warrants a status check.
- Signals: CVE-2026-5430 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Unauthenticated file upload enabling PHP web shell deployment is being actively exploited against this WooCommerce plugin (~6,000 installs). Check all WordPress sites for this plugin, update to the patched version immediately, and audit the uploads directory for unexpected PHP files.
- SOC/IR — Act: Active exploitation is planting PHP backdoors on WordPress sites; sweep web servers for anomalous PHP files in WooCommerce plugin upload paths and hunt for POST requests to the plugin’s file-upload endpoint since exploitation began.
- Leader — Skip
- Engineer — Act: If you distribute or run WordPress with Admin Menu Editor Pro, audit all admin-level user accounts immediately for hidden/unauthorized entries and remove or replace the plugin with a verified clean version.
- SOC/IR — Act: Sweep WordPress admin user tables across managed estates for accounts created after plugin update dates; hunt for unexpected privileged-user creation events in web application logs correlated with this plugin’s presence.
- Leader — Learn: A small-scale but clean example of plugin supply-chain compromise via maintainer-site takeover; useful context for vendor/third-party software risk discussions, but scale (~200 customers) does not rise to board-level action unless your org runs this specific plugin.
- Engineer — Skip
- SOC/IR — Act: Joint US/UK/NL advisory details active Windows malware using Telegram as C2 with email exfil, screenshot, and audio capture capabilities; pull the full advisory for IOCs and hunt for anomalous Telegram API calls or beacon traffic patterns in your estate since the advisory’s disclosure date.
- Leader — Learn: Multi-government attribution of Iranian intelligence espionage tooling targeting journalists and dissidents; relevant background for risk context in media, NGO, or government-adjacent sectors, and useful framing for board discussions on geopolitical threat actors.
- Engineer — Act: A critical ScreenConnect vulnerability is under active exploitation with CISA issuing a warning — patch ConnectWise ScreenConnect to the latest patched version immediately, or isolate/disable instances until patching is complete.
- SOC/IR — Act: Active exploitation of a remote access tool is a priority assume-breach scenario; hunt for anomalous ScreenConnect sessions, unexpected remote access activity, and lateral movement originating from ScreenConnect processes since the disclosure date.
- Leader — Act: Confirm whether ScreenConnect is in use across your environment (including MSP vendors who may use it to manage your systems) and verify emergency patching is underway; active exploitation of remote access tools frequently precedes ransomware deployment.
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs disclosed; breach at a US utility with confirmed data exfiltration may be worth monitoring for follow-on phishing campaigns using stolen customer data.
- Leader — Act: If CenterPoint Energy is a vendor or partner, request their incident report and confirm what data was exposed; utility-sector breaches increasingly draw board and regulatory attention, so brief leadership before this surfaces externally.
- Engineer — Act: Active supply-chain attack via AI coding assistant session hijacking is directly relevant to any team using these tools; audit AI assistant session controls, review recently accepted AI-recommended packages for tampering, and scan repository secrets for exfiltration indicators.
- SOC/IR — Plan: No published IOCs yet, but the TTPs are mappable — AI session hijacking leading to mass repository writes and secret exfiltration; build detections for anomalous AI coding assistant activity and bulk repository commits from service accounts this quarter.
- Leader — Act: A Mandiant-documented supply-chain compromise via AI coding assistant is a systemic risk for any org using similar tools; assess internal AI assistant deployment controls this week and prepare a brief for leadership on AI-enabled developer toolchain risk before customers or the board ask.
- Engineer — Act: Acronis itself warns of in-the-wild exploitation of a Linux local privilege escalation in its backup plugin for cPanel, WHM, and Plesk — patch the Acronis backup plugin to the fixed version immediately on any hosting or panel infrastructure you operate.
- SOC/IR — Plan: Active exploitation is claimed but no IOCs or ATT&CK-mapped TTPs are published yet; build or tune detection for anomalous privilege escalation events on Linux hosts running cPanel/WHM/Plesk and revisit when indicators surface.
- Leader — Skip
- Engineer — Act: The plugin is confirmed exploited in targeted attacks despite no KEV listing; if you run cPanel/WHM with the Acronis Backup plugin on Linux, update to the patched version immediately and audit file permissions on affected hosts.
- SOC/IR — Plan: No IOCs are published yet, but active targeted exploitation warrants building a detection for abnormal privilege escalation events originating from Acronis backup processes on cPanel/WHM Linux hosts; queue a hunt for unusual UID-0 transitions tied to Acronis service accounts.
- Leader — Skip
- Signals: CVE-2026-87886 — CISA KEV: not listed, EPSS n/a, no public PoC found
- Engineer — Act: Actively exploited Chrome and Windows flaws (now patched) are being chained to deliver a JavaScript backdoor; verify that Chrome and Windows September 2026 security patches are fully deployed across your fleet immediately.
- SOC/IR — Act: Active UTA0560 spear-phishing campaign delivering the GRIMWEDGE JavaScript backdoor since September 1; hunt for associated IOCs from Volexity’s reporting and tune email gateway and endpoint detections for this campaign’s delivery patterns.
- Leader — Learn: A China-linked threat actor is running targeted spear-phishing against NGOs using a patched browser/OS exploit chain — notable for sector threat-awareness but not a systemic event requiring board action unless your organization is in the NGO space.
- Engineer — Act: Active exploitation of a Gitea RCE by a suspected Chinese actor with 13 confirmed compromises makes this urgent for anyone running an internet-facing Gitea instance. Patch Gitea to the latest version immediately and audit access logs for unauthorized RCE attempts.
- SOC/IR — Act: Red Heron scanned over 1,300 Gitea instances as part of this campaign, suggesting systematic targeting; hunt for exploitation attempts against any Gitea instances in your environment and check for post-compromise lateral movement patterns consistent with Chinese espionage actors since the campaign began.
- Leader — Learn: A confirmed multi-national espionage campaign exploiting a self-hosted developer tool is worth awareness for context on Chinese threat actor tempo, but Gitea is niche enough that this does not rise to board-level action unless your organization specifically runs it.
- Engineer — Act: If you applied September Patch Tuesday updates and are seeing RDS failures, deploy the OOB fix immediately; check affected Windows versions against your estate and apply the emergency update to restore Remote Desktop Services, Hyper-V, and USB audio functionality.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Active mass-scanning campaign targeting internet-exposed Vite dev servers to exfiltrate AWS/Azure credentials and infrastructure state files; audit for any Vite dev servers reachable from the internet, restrict network access immediately, and rotate cloud credentials for any instances that may have been exposed.
- SOC/IR — Plan: No specific IOCs surfaced in available reporting, but this active campaign warrants building detections for anomalous AWS/Azure API calls (unusual regions, new IAM key usage, credential enumeration) that could indicate stolen dev-server credentials being leveraged.
- Leader — Plan: Cloud credential theft from exposed dev tooling can cascade into full infrastructure compromise; confirm with engineering that no Vite dev servers are internet-facing and that credential rotation procedures cover this scenario before it becomes a material incident.
- Engineer — Act: Active exploitation of a critical file-upload flaw is in progress; if you run WooCommerce Wholesale Lead Capture, update or disable it immediately and audit wp-content for recently created PHP files that could be backdoors.
- SOC/IR — Act: PHP backdoor upload attacks against WordPress sites are active; hunt for anomalous PHP files in wp-content/uploads and similar directories, and review web logs for suspicious POST requests to this plugin’s endpoints since the campaign began.
- Leader — Skip
- Engineer — Act: Actively exploited zero-day in Cisco Secure Email Gateway enabling root command execution — apply Cisco’s patch immediately and audit gateway logs for signs of exploitation.
- SOC/IR — Act: Active exploitation is confirmed; hunt for anomalous process execution or command activity originating from the email gateway process and review gateway logs since the earliest known exploitation date.
- Leader — Plan: Confirm whether your organization runs Cisco Secure Email Gateway, verify patching is underway, and assess whether any breach indicators warrant customer or leadership notification.
- Engineer — Act: CISA KEV-listed, public PoC live, and actively exploited — patch AsyncOS for Cisco Secure Email Gateway to Cisco’s fixed release immediately; if patching is delayed, apply any available workaround and isolate the appliance from untrusted networks.
- SOC/IR — Act: Active exploitation of an edge mail appliance means assume-breach posture is warranted — sweep email gateway logs for anomalous process execution or unexpected outbound connections since the vulnerability was disclosed, and tune EDR/SIEM for unauthenticated root-level process spawns from the AsyncOS process tree.
- Leader — Act: Cisco Secure Email Gateway is a widely deployed enterprise appliance; active exploitation with a CVSS 9.8 and KEV listing warrants confirming whether your environment uses it this week and verifying your team has applied Cisco’s patch — brief leadership if the appliance handles regulated data or sits on a compliance boundary.
- Signals: CVE-2026-76461 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: VMware vCenter is core enterprise infrastructure and this RCE is under active ransomware exploitation per CISA — patch vCenter to the July-released fix immediately if not already done, and verify patch status across all vCenter instances in your environment.
- SOC/IR — Act: Ransomware actors are exploiting vCenter in the wild — run a retrospective hunt across vCenter logs since July for signs of exploitation or lateral movement, and verify EDR coverage on vCenter hosts where possible.
- Leader — Act: CISA-confirmed ransomware exploitation of a widely deployed infrastructure component warrants same-week action — confirm with your engineering team that vCenter instances are patched and brief leadership given the ransomware-as-operational-risk angle.
- Engineer — Act: Public PoCs exist on GitHub for both CVEs and a national NCSC is warning exploitation is imminent — patch Check Point VPN gateways to the vendor-fixed version immediately and verify no unauthorized access preceded the patch.
- SOC/IR — Act: Edge VPN devices with public PoCs and an imminent-exploitation warning require an assume-breach posture — hunt for anomalous authentication events and lateral movement originating from Check Point VPN nodes since the CVEs were disclosed, and tune detections for post-exploitation activity on network edge appliances.
- Leader — Act: Confirm whether Check Point VPN is present in your estate and verify emergency patching is already in motion; a government NCSC imminent-exploitation warning on a widely-deployed VPN with public PoC is likely to generate customer and board questions if exploitation materializes at scale.
- Signals: CVE-2026-85102 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub · CVE-2026-85103 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: All five CVEs are KEV-listed with confirmed active exploitation; a public PoC exists for CVE-2026-42016 (CVSS 8.1). Audit your estate for JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS and apply vendor patches immediately — these are common CI/CD, remote-access, and network infrastructure components.
- SOC/IR — Act: Active exploitation of ScreenConnect (remote access) and Artifactory (build pipeline) creates high-value footholds; initiate assume-breach sweeps by reviewing ScreenConnect session logs and Artifactory access logs for unauthorized activity since the KEV listing date, and tune detections for anomalous authentication or file-access patterns on these systems.
- Leader — Plan: Confirm with engineering this week whether Artifactory, ScreenConnect, or RouterOS are deployed and verify an expedited patch cycle is underway; KEV listing raises the risk register for these assets but does not yet constitute a systemic breach event requiring board or customer notification.
- Signals: CVE-2026-42016 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: Active campaign exploiting passkey/SSO trust to bypass MFA means now is the time to enforce phishing-resistant authentication (FIDO2 hardware keys, not app-based) in M365 conditional access policies and audit OAuth app consent grants in Entra ID.
- SOC/IR — Act: Named extortion actors (ShinyHunters, Helix) are running active M365 credential theft campaigns — hunt for anomalous Entra ID sign-ins, suspicious OAuth consent grants, and new delegated permissions added to M365 tenants since this campaign surfaced.
- Leader — Plan: ShinyHunters is a data-publication extortion group; their targeting of M365 raises breach-disclosure risk for organizations holding regulated data in that platform — schedule a review of M365 data residency, DLP controls, and phishing-awareness coverage for passkey/SSO lure themes this quarter.
- Engineer — Act: Active exploitation of critical/high Artifactory flaws on self-hosted instances leads to admin takeover and Rust backdoor installation — patch your Artifactory deployment immediately and audit build infrastructure for signs of backdoor presence.
- SOC/IR — Act: Attackers are actively backdooring self-hosted Artifactory servers; hunt for anomalous admin-level activity and unexpected outbound connections from your Artifactory hosts, and sweep build pipeline logs for signs of unauthorized access dating back to when flaws became public.
- Leader — Act: Compromised Artifactory servers sit at the heart of software supply chains — if your organization runs self-hosted Artifactory, treat this as a potential supply-chain incident: confirm patch status with your engineering team this week and assess whether any built artifacts could have been tampered with.
- Engineer — Act: CVE-2026-85706 is CISA KEV-listed with a public GitHub PoC and confirmed in-the-wild probes — patch GitLab to the fixed release immediately and audit server-side files (secrets, keys, configs) for unauthorized reads since public disclosure.
- SOC/IR — Act: Active exploitation probes are underway; hunt for unauthenticated requests containing path traversal sequences against the GitLab commits API in web/proxy logs going back to the disclosure date, and tune SIEM rules to alert on anomalous API access patterns.
- Leader — Act: Confirm with engineering this week that all self-hosted GitLab instances are patched; if using GitLab.com, request a written statement from GitLab on remediation status — unauthenticated source-code and secret exposure at CVSS 10 with active probes is a material risk worth verifying before it surfaces as a customer or board question.
- Signals: CVE-2026-85706 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Netlogon RCE with EPSS 0.80 and a public PoC is a critical, imminent-exploitation risk for any Active Directory environment. Apply the Microsoft patch for CVE-2026-41089 to all domain controllers immediately, prioritizing before the weekend.
- SOC/IR — Act: With a public PoC and EPSS 0.80, exploitation attempts are likely already occurring; initiate a hunt for anomalous Netlogon traffic and failed authentication spikes (Windows Event IDs 5805, 4625) against domain controllers since the PoC publication date.
- Leader — Act: A Netlogon RCE with public exploit code represents a domain-wide compromise scenario comparable to ZeroLogon — confirm with your team that emergency DC patching is underway and brief leadership now, before this surfaces in the news.
- Signals: CVE-2026-41089 — CISA KEV: not listed, EPSS 0.80, public PoC on GitHub
- Engineer — Act: Hold or roll back the September 2026 cumulative updates on Windows Server 2019/2022/2025 until Microsoft issues a fix; test any staged deployments in non-production before wider rollout to avoid RDS outages requiring hard resets.
- SOC/IR — Learn: RDS connectivity failures and unexpected hard-reset events seen in monitoring this week are likely patch-induced, not attack activity; useful triage context to avoid chasing false positives in endpoint or session logs.
- Leader — Plan: The September patch cycle has a confirmed defect disrupting RDS across three current Windows Server versions; confirm with engineering whether deployment is paused and whether any business-critical RDP-dependent workflows are at risk while the fix is pending.
- Engineer — Act: Two actively exploited flaws in PaperCut NG/MF now have proper maintenance releases; patch to version 26.0.5, 25.0.13, or 24.1.10 depending on your supported branch — emergency patches are superseded and these are the authoritative fixes.
- SOC/IR — Plan: Active exploitation is confirmed but the item provides no IOCs, TTPs, or detection signatures; plan to review PaperCut server logs and vendor advisory for exploitation indicators, and prepare a hunt query for abnormal print-server outbound connections once technical details surface.
- Leader — Plan: Active exploitation of widely deployed print-management software warrants confirming whether PaperCut is in your environment and ensuring the engineering team prioritizes patching this quarter; not a board-level systemic event but relevant if PaperCut is part of your estate.
- Engineer — Act: Max-severity path traversal in GitLab with a public PoC significantly raises exploitation risk even absent a KEV listing — patch all self-hosted GitLab instances to the fixed version immediately and verify no unauthorized file access occurred before the patch window.
- SOC/IR — Act: A public PoC for a max-severity GitLab flaw means opportunistic exploitation attempts are likely imminent; hunt for anomalous file-read patterns and path traversal sequences (e.g., ../ chains) in GitLab access logs since the disclosure date.
- Leader — Plan: Confirm whether self-hosted GitLab instances exist in the environment and verify engineering teams have prioritized patching within days given the public PoC; no board-level brief warranted yet unless active breach evidence emerges.
- Signals: CVE-2026-85706 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Two patched Cisco FMC vulnerabilities are confirmed exploited in the wild by multiple threat clusters. Patch Cisco Secure Firewall Management Center to the latest fixed version immediately and audit FMC access logs for signs of unauthorized activity.
- SOC/IR — Act: Active exploitation by ransomware and state-sponsored actors across three clusters means assume-breach posture for any org running Cisco FMC. Hunt for unauthorized FMC access and policy changes since the vulnerability window; pull TTPs from the Cisco Talos advisory and map to ATT&CK for detection coverage.
- Leader — Act: Exploitation by both ransomware and state-sponsored actors across three clusters elevates this beyond routine CVE noise. Confirm whether your organization runs Cisco FMC, verify your team has patched, and brief leadership if FMC is part of your network security architecture.
- Engineer — Act: CVE-2026-20079 is CVSS 10.0, CISA KEV-listed, EPSS 0.76, with a public GitHub PoC and confirmed active exploitation; patch Cisco FMC to the vendor-released fixed version immediately, and if the management interface was internet-accessible, treat the device as compromised and rotate all credentials it manages.
- SOC/IR — Act: Multiple threat clusters including Qilin ransomware operators are actively exploiting this; hunt for unauthenticated access patterns against FMC web interfaces since the patch release date, sweep EDR telemetry on adjacent hosts for Qilin staging behavior, and request FMC access logs from the network team for anomaly review.
- Leader — Act: Cisco FMC is core security infrastructure at many enterprises; confirm with your engineering team whether FMC is deployed and patched, and prepare a brief for leadership given active ransomware deployment and state-sponsored actor involvement — the combination of CVSS 10.0 and Qilin activity raises material-incident exposure if your environment is unpatched.
- Signals: CVE-2026-20079 — CISA KEV: listed, EPSS 0.76, public PoC on GitHub
- Engineer — Act: Active exploitation of self-hosted Artifactory was confirmed Aug 15–Sep 8; verify your instance is fully patched for both chained flaws, and if it was unpatched during that window, audit all artifacts built or stored then for injected backdoors.
- SOC/IR — Act: If your org runs self-hosted Artifactory that was unpatched between Aug 15 and Sep 8, initiate an assume-breach sweep of that server and downstream build artifacts for backdoor indicators, and look for lateral movement originating from it.
- Leader — Act: Confirmed supply-chain attack against self-hosted Artifactory during Aug 15–Sep 8; determine this week whether your organization runs self-hosted Artifactory, confirm patch status during that window, and escalate to incident review if exposure existed given the backdoor-planting risk to your software pipeline.
- Engineer — Act: PaperCut NG/MF is being actively exploited at scale with hundreds of organizations confirmed compromised; patch PaperCut to the latest version immediately and audit server logs for exploitation indicators of compromise.
- SOC/IR — Act: This is an active, wide campaign — hunt for post-exploitation behavior on PaperCut servers (unusual process spawns, outbound connections from the print server) and expand scope to look for lateral movement from any PaperCut host since the campaign’s start date.
- Leader — Act: With 395 confirmed victims and a suspected nation-state-adjacent actor, confirm whether PaperCut NG/MF is in your environment, demand a patching and compromise-assessment status from engineering, and prepare a brief for leadership given the likelihood of press and customer questions.
- Engineer — Skip
- SOC/IR — Learn: The Gentlemen ransomware gang is claiming credit; file the actor profile for future sector-targeting awareness, but no IOCs or TTPs are published to act on now.
- Leader — Act: If your organization uses Veradigm or shares patient data with them, contact them this week to request an incident scope statement and confirm whether your data was involved; prepare a brief for leadership given the healthcare sector breach pattern and potential HIPAA notification implications.
- Engineer — Act: Active exploitation of recently disclosed PaperCut NG/MF flaws at scale — patch PaperCut to the latest version immediately and audit instances for IOC 45.142.193[.]132 in access logs.
- SOC/IR — Act: Multi-source-corroborated (Blackpoint Cyber + GreyNoise) campaign with a concrete IOC: sweep for 45.142.193[.]132 across network and proxy logs, and run an assume-breach hunt on any PaperCut NG/MF hosts in your estate.
- Leader — Act: 440+ compromised PaperCut instances attributed to a Russian-speaking actor is board-relevant scale — confirm whether PaperCut NG/MF is in your environment and verify patching status before this surfaces in news cycles.
- Engineer — Plan: No exploitation-pressure signals, but the MFA persistence and Microsoft Graph abuse techniques described warrant auditing Entra ID registered authentication methods for unexpected passkey enrollments and reviewing conditional access policies governing Graph API access this quarter.
- SOC/IR — Act: The article documents TTPs mappable to ATT&CK — MFA persistence registration and Microsoft Graph reconnaissance — against a near-universal enterprise target (M365); implement or tune detections for anomalous Graph API enumeration calls and unexpected MFA method additions, and hunt for such activity since early September 2026.
- Leader — Plan: Passkey rollout communications are now a social engineering attack surface; if your organization is mid-deployment, review user-facing passkey enrollment messaging for impersonation risk and include this TTP in the next security-awareness training update.
- Engineer — Act: CVSS 10.0 pre-auth RCE on N-central is CISA KEV-listed with active exploitation and a public GitHub PoC — patch N-central immediately and audit your N-central server logs for signs of compromise before the patch is applied.
- SOC/IR — Act: Active exploitation of an RMM platform is a high-priority assume-breach scenario; hunt for anomalous commands or lateral movement originating from N-central agents across managed endpoints since exploitation requires no credentials and leaves a narrow pre-auth detection window.
- Leader — Act: Compromised RMM tools give attackers keys to every managed endpoint — confirm whether your organization or any MSP you rely on runs N-central, and request written patch confirmation or an attestation of remediation given the September 11 CISA deadline.
- Signals: CVE-2026-86218 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: If your org uses IDScan’s API or SDK for customer identity verification, audit the integration to determine what PII flows to their cloud and whether your API credentials may have been exposed; no patch action, but a data-inventory and vendor-access review is warranted.
- SOC/IR — Learn: A breach of this scale at an identity-verification vendor could fuel downstream account-takeover campaigns using stolen DL scans as identity proofs, but no IOCs or TTPs have been published to hunt on yet; monitor for follow-on reporting.
- Leader — Act: Confirm whether your organization uses IDScan for any identity-verification workflow, request their formal incident disclosure and scope attestation, and assess whether your customers’ data is among the 153 million records; brief legal on potential notification obligations if exposure is confirmed.
- Engineer — Act: Actively exploited zero-day chains in Chrome and Windows (ubiquitous in every enterprise) used by four state actors within a week. Ensure both are patched to their latest released versions immediately and monitor vendor security advisories for specific CVE patches as they drop.
- SOC/IR — Act: Four espionage clusters sharing the same exploit kit signals broad, opportunistic targeting — not just single-nation campaigns. Hunt for BlueMoon exploitation indicators in browser telemetry and Windows event logs since late August, and audit for post-exploitation persistence in environments running unpatched Chrome or Windows builds.
- Leader — Plan: A shared zero-day kit adopted by four APT groups targeting universal enterprise software represents systemic espionage risk. This quarter, confirm your patch cadence for Chrome and Windows meets the threat tempo, and assess whether your sector falls within known APT31 targeting priorities to set appropriate leadership communications posture.
- Engineer — Act: Patch Cisco Secure FMC immediately — CISA KEV listed, EPSS 0.75, public PoC on GitHub, and Cisco confirms active exploitation of this max-severity auth bypass. Check Cisco’s advisory for the patched version and apply it within your emergency patch window.
- SOC/IR — Act: Assume-breach posture for any environment with exposed FMC — sweep for unauthorized access or lateral movement from the FMC management plane since the vulnerability is actively exploited with a public PoC. Hunt for anomalous admin sessions or policy changes originating from the FMC host.
- Leader — Plan: Verify whether your network security team runs Cisco Secure FMC and confirm patching is underway; a max-severity auth bypass in a firewall management platform could expose the entire perimeter policy to attacker control, which is a board-level risk if unmitigated.
- Signals: CVE-2026-20079 — CISA KEV: listed, EPSS 0.75, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV-listed RCE in WatchGuard Firebox is now confirmed ransomware-leveraged; patch Firebox to the latest available version immediately and audit edge-device logs for signs of pre-patch compromise.
- SOC/IR — Act: Ransomware actors exploiting an RCE in a perimeter firewall is an assume-breach scenario — sweep for lateral movement originating from WatchGuard appliances and hunt for IOCs tied to this campaign since CISA’s December KEV addition.
- Leader — Act: Ransomware exploitation of a perimeter firewall is board-level risk; confirm this week whether WatchGuard Firebox is in your estate, verify emergency patching is underway, and brief leadership before an incident forces the conversation.
- Engineer — Act: CVE-2026-20079 carries a CVSS 10.0, is KEV-listed, has a public PoC, and EPSS 0.75 — all three signal immediate exploitation pressure on Cisco, Citrix, and Fortinet devices common in enterprise perimeters; patch all three affected products to vendor-specified fixed versions before September 12.
- SOC/IR — Act: Active exploitation of edge appliances from all three vendors means assume-breach posture is warranted — hunt for anomalous authentication events and lateral movement originating from Cisco, Citrix, and Fortinet devices since before today’s disclosure, and sweep for any available IOCs tied to these CVEs.
- Leader — Act: Three critical-severity, actively exploited flaws across widely deployed network vendors represent a systemic perimeter risk; confirm your team has prioritized patching all affected Cisco, Citrix, and Fortinet products before the Sept 12 deadline, and verify no prior compromise occurred on exposed appliances.
- Signals: CVE-2026-20079 — CISA KEV: listed, EPSS 0.75, public PoC on GitHub, reported by 2 collected sources
- Engineer — Skip
- SOC/IR — Learn: ShinyHunters attribution on a large healthcare breach is useful actor-tracking context, but no IOCs or TTPs are published here to act on.
- Leader — Act: If your organization is a healthcare provider or shares a SaaS supply chain with AdaptHealth, confirm exposure and prepare a customer/board briefing; a 4.1M-record breach in healthcare will draw regulatory and media attention that leadership should get ahead of.
- Engineer — Act: If you run LiteLLM, immediately check whether your admin key is still “sk-1234” and rotate it to a strong credential; a compromised gateway exposes all upstream model API keys and full prompt/completion history to anyone who finds the instance.
- SOC/IR — Plan: Build a detection rule to flag any LiteLLM API requests authenticating with the literal string “sk-1234”, and sweep existing gateway/proxy logs since initial deployment for unauthorized admin activity.
- Leader — Plan: Direct engineering to inventory all internal and vendor-managed LiteLLM deployments and confirm no default admin credentials are in use; a misconfigured AI gateway exposes both uncapped API spend and the full record of what your applications send to model providers.
- Engineer — Act: Two actively exploited zero-days in this cycle demand immediate triage: identify which products are affected via the Microsoft Security Update Guide and patch those before the rest of the 113 criticals. Prioritize any edge or identity-plane components first.
- SOC/IR — Act: Actively exploited zero-days mean potential in-progress intrusions — pull the Microsoft advisories for the two exploited CVEs, map their TTPs to ATT&CK, and run a retrospective hunt for exploitation attempts since the last Patch Tuesday cycle.
- Leader — Plan: Two exploited zero-days in a large Patch Tuesday release warrants confirming your teams have a clear patching priority order this week; escalate to Act only if either zero-day turns out to affect a critical, board-visible system or triggers SEC material-incident evaluation.
- Engineer — Act: A public PoC on GitHub for a CVSS 10.0 unauthenticated memory-corruption RCE in SAP EPP meets the Act bar even without KEV listing. Apply SAP’s September 2026 security patch for CVE-2026-44756 immediately if you run SAP Extended Passport Processing.
- SOC/IR — Plan: No active exploitation observed (EPSS 0.00, no KEV), but a public PoC raises the likelihood of imminent attempts; build or tune detections for anomalous unauthenticated requests targeting SAP EPP endpoints before exploitation materializes.
- Leader — Plan: A maximum-severity publicly-PoC’d RCE in SAP — widely deployed in enterprise environments — warrants confirming this quarter whether your organization runs SAP EPP and ensuring the engineering team has this patch scheduled in their current sprint.
- Signals: CVE-2026-44756 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Active exploitation of a Rails CVE within hours of patch release confirms weaponization is immediate; identify every Rails application in your estate and apply the patch now — do not wait for a scheduled maintenance window.
- SOC/IR — Plan: Active exploitation is confirmed but the summary provides no IOCs or TTPs to hunt on yet; track the specific CVE for technical follow-up and prepare to write detections for Rails request-forgery or injection patterns once analysis is published.
- Leader — Learn: A government site compromise hours after patch disclosure is a clear illustration of attacker speed vs. organizational patch latency — useful data for board conversations about emergency patching SLAs and critical-CVE response windows.
- Engineer — Act: Two actively exploited Windows zero-days in a record 974-flaw drop demands accelerated patching — apply September 2026 Patch Tuesday updates immediately for Windows, and prioritize the 110+ critical-rated fixes across SQL Server and Office within your standard critical window.
- SOC/IR — Plan: The two exploited Windows zero-days will generate attacker activity before organizations patch — prepare to hunt for exploitation evidence on unpatched Windows endpoints once specific CVEs and TTPs are published from this release.
- Leader — Plan: A record 974-vulnerability Patch Tuesday with two actively exploited Windows zero-days is likely to surface in board or customer conversations; confirm your team has an accelerated patch window for critical Windows systems and prepare a brief for leadership on the scope of exposure.
- Engineer — Act: Two vulnerabilities are confirmed exploited in the wild, including a Windows privilege escalation; prioritize patching those plus the critical RCEs in Skype for Business, MSMQ, and RRAS within your emergency patch window — review the full advisory to identify the two KEV-grade CVEs by number and verify patch deployment within 48–72 hours.
- SOC/IR — Plan: With two actively exploited vulns (including a Windows privesc) but no IOCs provided here, queue detection work this week: pull the specific CVE IDs from Microsoft’s release, map the exploited privesc to relevant ATT&CK techniques, and tune alerts for anomalous privilege elevation on unpatched Windows hosts.
- Leader — Learn: The 973-CVE release is the largest Patch Tuesday on record and may surface in board or customer conversations; useful context for communicating why patch velocity investment matters, but the two actively exploited issues are not yet a named systemic event requiring leadership escalation.
- Engineer — Act: A public exploit for a SYSTEM-level privilege escalation in Microsoft Defender was released immediately after Patch Tuesday, leaving it unpatched until at least October. Check for any Microsoft workaround guidance or out-of-band advisory, restrict local code execution paths where possible, and apply any emergency patch promptly when issued.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet and no IOCs published, but the public PoC will attract threat actor interest quickly. Build or tune detections for anomalous SYSTEM-level process spawning from Defender service processes and queue a hunt for post-exploitation behavior once more technical detail emerges.
- Leader — Plan: An unpatched SYSTEM escalation in Defender affects the entire Windows estate; brief your security team to track for an emergency out-of-band patch and be ready to communicate status to leadership if exploitation is confirmed before October Patch Tuesday.
- Engineer — Act: Active breach campaign targeting F5 BIG-IP APM appliances — a common enterprise edge device. Audit your BIG-IP APM fleet for indicators of compromise: look for anomalous PHP interpreter activity, unexpected in-memory web shell behavior, and verify firmware/software versions against F5’s latest advisories.
- SOC/IR — Act: The fileless, memory-resident web shell evades file-based detection, so standard endpoint scans will miss it. Hunt for anomalous PHP file-load interception and unusual outbound connections from F5 BIG-IP APM processes; if your org runs BIG-IP APM, treat as assume-breach and initiate a memory forensics sweep.
- Leader — Plan: Active compromise campaign against widely-deployed F5 BIG-IP APM appliances — confirm with your network/infra team whether your org runs these devices, verify that monitoring and patching processes are in place, and be prepared to brief leadership if exposure is confirmed.
- Engineer — Act: Actively exploited Chrome zero-day warrants immediate action — force-update Chrome across all managed endpoints and verify enterprise Chrome update policies are not lagging behind the patched release.
- SOC/IR — Learn: No IOCs, TTPs, or exploit specifics are available in the summary to build detections around; monitor threat intel feeds for follow-on analysis that may surface behavioral indicators of exploitation.
- Leader — Skip
- Engineer — Act: F5 BIG-IP APM is a widely-deployed enterprise edge appliance and the malware is linked to confirmed break-ins; disk-based file integrity checks won’t detect this web shell, so audit BIG-IP APM instances using network-based IOCs and memory forensics from the Sophos September 7 analysis.
- SOC/IR — Act: Active exploitation of an edge appliance combined with a memory-resident web shell means EDR and file-scan detections will miss it; assume-breach posture applies — hunt using any network or request-pattern IOCs from the Sophos report and flag all BIG-IP APM devices for manual inspection.
- Leader — Act: If your organization runs F5 BIG-IP APM, direct the security team to perform a compromise assessment this week — the memory-evasion technique means standard monitoring may have already missed a breach on this access gateway.
- Engineer — Plan: Software vendors shipping into the EU must have accurate SBOMs and timestamped vulnerability discovery records to meet the 24-hour exploitation-reporting window; audit your bill-of-materials completeness and disclosure tracking processes against the September 11 deadline.
- SOC/IR — Skip
- Leader — Act: EU CRA vulnerability reporting requirements take effect September 11 — if your company ships software to EU customers, confirm this week whether you qualify under the act and that your disclosure and legal teams have a process to meet the 24-hour reporting window for actively exploited flaws.
- Engineer — Act: Actively exploited in the wild plus a public PoC makes this urgent despite the low EPSS; update Chrome to the latest release across all managed endpoints and browser fleets immediately.
- SOC/IR — Plan: No IOCs or TTPs are published yet, but active exploitation warrants tuning EDR rules to flag anomalous child processes spawned from Chrome renderer processes as an exploitation indicator.
- Leader — Skip
- Signals: CVE-2026-87491 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: All Magento and Adobe Commerce versions are affected and actively exploited to plant a Linux backdoor — patch to Adobe’s latest released fix immediately and audit web server processes and file systems for signs of backdoor installation.
- SOC/IR — Act: Active exploitation is deploying Linux backdoors on Magento hosts; hunt for unexpected processes, outbound connections, or new files spawned from web server contexts in Magento environments since the vulnerability became public.
- Leader — Act: Active exploitation of an all-versions Magento/Adobe Commerce flaw with backdoor deployment has direct PCI and breach-notification implications — confirm whether your org or key e-commerce vendors run Magento and verify patching and compromise-assessment status before customers or auditors ask.
- Engineer — Act: Active exploitation since September 4 with public PoC and a CVSS 10.0 rating makes this urgent regardless of low EPSS: patch Adobe Commerce / Magento Open Source to the September 8 release immediately, then audit web roots and build logs for PHP web shells and unexpected Rust binaries introduced after September 4.
- SOC/IR — Act: Confirmed in-the-wild exploitation predates the patch by four days, meaning Magento estates may already be implanted; hunt for PHP web shell artifacts and Rust-based backdoor indicators (Sansec published IOCs under the StyleSmuggler moniker) and sweep file-integrity and EDR telemetry on Commerce hosts back to September 4.
- Leader — Plan: Confirm whether Adobe Commerce or Magento Open Source is present in your environment or used by a key e-commerce vendor, then verify engineering has treated this as an emergency patch — active exploitation with a backdoor payload elevates reputational and compliance risk for any org handling payment card data on the affected platform.
- Signals: CVE-2026-75650 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVE-2026-75650 is actively exploited with a public PoC and an emergency patch available; if you run Magento or Adobe Commerce, update to the patched version immediately and audit server filesystems and web roots for backdoor artifacts.
- SOC/IR — Act: Active server backdooring via StyleSmuggler means assume-breach posture for any Magento/Adobe Commerce hosts; hunt for unauthorized web shells or modified files in Commerce directories and check for outbound C2 behavior since the vulnerability was first disclosed.
- Leader — Plan: If your organization runs Magento or Adobe Commerce for e-commerce, confirm with engineering that the emergency patch has been applied and ask whether any servers showed indicators of compromise — active exploitation with backdoor capability could create customer-data exposure requiring disclosure review.
- Signals: CVE-2026-75650 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: Enforce phishing-resistant MFA (FIDO2) for all executive accounts and audit conditional access policies to block residential-proxy sign-ins; no active PoC or KEV signal, but AitM token theft bypasses standard MFA.
- SOC/IR — Act: Hunt for anomalous M365 sign-ins from residential proxy ranges targeting director/VP accounts, especially preceded by IT help-desk call activity; tune detections for impossible-travel or token-replay events in your SIEM.
- Leader — Act: Brief executive staff on IT impersonation vishing tactics this week and confirm your help-desk verification procedures prevent social-engineering escalation; this campaign explicitly targets directors and VPs and is likely to surface as a board question.
- Engineer — Act: A working unauthenticated RCE exploit chain against Telerik UI for ASP.NET AJAX is now public; apply the July Progress patch immediately and audit whether any deployments use the affected non-default AES-CBC configuration that enables the oracle.
- SOC/IR — Plan: No confirmed wild exploitation or published IOCs yet, but the public PoC warrants building detections for anomalous HTTP requests targeting Telerik AJAX endpoints — prepare Sigma/SPL rules now so you’re ready if exploitation picks up.
- Leader — Skip
- Engineer — Act: Three confirmed incidents show worm-like spread via ScreenConnect to newly connected hosts — if you run ScreenConnect, audit your relay configuration for unauthorized clients and review logs for unexpected new-host onboarding activity since the worm spreads automatically on connection.
- SOC/IR — Act: Hunt for VBScript execution chains spawned from ScreenConnect parent processes across your estate, and sweep RMM logs for abnormal new-client connection events; initial access spans tech-support scam lures, phishing MSIs, and at least one other vector, so assume diverse entry points.
- Leader — Plan: RMM tool abuse as a worm vector is a growing pattern — use this quarter to review governance of ScreenConnect and similar remote-access tools (access restrictions, audit logging, approved-relay allowlists) before an incident forces the conversation.
- Engineer — Act: If you run N-central, apply the emergency hotfix immediately — max-severity RCE with reported ongoing attacks on an RMM platform is a critical-priority patch with no waiting window.
- SOC/IR — Act: Active exploitation of an RMM platform is an assume-breach trigger: hunt for unauthorized lateral movement or remote execution originating from N-central agents across managed endpoints since before the patch window.
- Leader — Act: Confirm whether your organization or any MSP you rely on runs N-central, and request attestation that the emergency hotfix has been applied — RMM compromise has cascading supply-chain risk to all managed systems.
- Engineer — Act: Unauthenticated RCE on an RMM platform with a credible (if contradictory) exploitation-in-the-wild claim — highest-priority patch category. Upgrade every on-premises N-central instance to 2026.3.1.14 (Hotfix 4) immediately; servers patched to Hotfix 3 yesterday are still vulnerable.
- SOC/IR — Act: Compromised RMM infrastructure gives attackers admin reach across all managed endpoints — an assume-breach posture is warranted. Hunt for anomalous outbound connections or command execution originating from N-central servers since the Hotfix 3 deployment date, and monitor for lateral movement from MSP-managed jump hosts.
- Leader — Act: If your organization uses an MSP that runs N-central, contact them this week to confirm Hotfix 4 is applied and request evidence of no compromise; RMM breaches are a proven ransomware delivery path. The conflicting exploitation signals from N-able’s own communications (incident notice vs. release notes) also warrant asking for a formal vendor statement.
- Engineer — Act: Patch all MikroTik devices to the latest release immediately, then audit every device for unauthorized accounts added by attackers as a persistence mechanism — patching alone will not evict existing backdoors.
- SOC/IR — Act: Sweep MikroTik devices for newly created accounts and anomalous SSH sessions prior to patch date; adopt an assume-breach posture and hunt for lateral movement originating from edge devices that may already be implanted.
- Leader — Act: Confirm this week whether MikroTik routers are in your environment; if so, direct teams to treat affected devices as potentially compromised, since attackers are pre-installing persistence before patches are applied — this is not a routine patch cycle.
- Engineer — Act: Active exploitation of a chained vulnerability pair targeting MikroTik RouterOS devices with SSH exposed to the internet; patch RouterOS to the latest stable release immediately and restrict SSH access to trusted management IPs via firewall rules.
- SOC/IR — Act: Router hijacking via exposed SSH is an assume-breach scenario for any MikroTik devices in the estate; sweep SSH auth logs on edge devices for anomalous logins, and hunt for lateral movement originating from RouterOS management interfaces since disclosure.
- Leader — Plan: Actively exploited edge-device flaws can expose the entire network perimeter; confirm whether MikroTik equipment is present in the environment and verify the engineering team has a patch plan for exposed devices this week.
- Engineer — Act: ScreenConnect is a high-value exploitation target with a documented history of rapid weaponization; apply ConnectWise’s published temporary mitigations now and schedule patch deployment as soon as it releases later this week.
- SOC/IR — Plan: No active exploitation or IOCs yet, but ScreenConnect has been abused repeatedly as an initial-access vector; build or tune detections for anomalous ScreenConnect session activity before exploitation emerges.
- Leader — Plan: Confirm whether ScreenConnect is in your environment, verify mitigations have been applied by your team, and track the patch release this week — ScreenConnect flaws have historically triggered rapid, widespread exploitation that can prompt customer inquiries.
- Engineer — Plan: Active AiTM phishing at scale demonstrates that TOTP/push MFA is insufficient for M365; audit Conditional Access policies and plan a phishing-resistant MFA (FIDO2/passkeys) migration this quarter.
- SOC/IR — Act: With 258 confirmed victim orgs, treat this as an active campaign: hunt Entra ID and unified audit logs for anomalous session token reuse, impossible-travel sign-ins, and OAuth consent grants since mid-2026.
- Leader — Plan: A campaign compromising 258 organizations via MFA bypass is a concrete argument for budgeting phishing-resistant MFA; assess current MFA tier across the enterprise and bring a gap analysis to the next leadership review.
- Engineer — Act: Unauthenticated RCE with active exploitation since September 4 and no patch yet — apply Sansec’s recommended WAF/mitigation rules immediately, audit Magento/Adobe Commerce file systems and web roots for newly dropped backdoors, and consider restricting public access to admin paths until a patch is released.
- SOC/IR — Act: Active exploitation campaign targeting Magento/Adobe Commerce via StyleSmuggler began September 4 — hunt for anomalous POST requests to layout/XML-related endpoints and for new or modified PHP files in web roots on those servers since that date, and tune file-integrity and web-shell detection rules accordingly.
- Leader — Act: An actively exploited zero-day with unauthenticated RCE on e-commerce servers puts payment card and customer data at immediate risk — confirm whether your organization or key vendors run Magento/Adobe Commerce, assess PCI DSS breach-notification obligations, and brief leadership given the likelihood of press coverage.
- Engineer — Act: If you use JetBrains Cadence, immediately revoke and rotate all credentials and secrets used in Cadence executions; also patch any self-hosted TeamCity instances to eliminate the exploited critical vulnerability.
- SOC/IR — Act: If Cadence is in your environment, treat extracted AWS credentials as compromised and hunt for anomalous IAM activity or unexpected AWS API calls originating from CI/CD workloads since last month’s breach window.
- Leader — Act: Confirm whether your organization uses JetBrains Cadence, request an incident attestation from JetBrains, and brief leadership on potential exposure of AWS credentials and CI/CD secrets before they read it elsewhere.
- Engineer — Act: A public PoC on GitHub for this CVSS 9.3 integer-overflow VM escape (CVE-2026-59346) makes exploitation practical even without a KEV listing; patch VMware Workstation and Fusion to the latest Broadcom-released versions immediately, prioritizing developer and security-lab machines where Workstation is commonly deployed.
- SOC/IR — Plan: With a public PoC available, build host-side detections for anomalous process spawning from VMware Workstation parent processes, which would indicate a VM-to-host breakout attempt; the local elevated-privilege prerequisite means exploitation is a post-compromise step worth hunting for in dev-heavy environments.
- Leader — Learn: A VM escape in desktop virtualization software (Workstation/Fusion, not ESXi) is a meaningful but not board-level event; note the risk for developer workstation fleets and confirm engineering is tracking the patch rollout.
- Signals: CVE-2026-59346 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Active exploitation of internet-exposed MikroTik SSH granting full admin access is confirmed by CERT Polska; immediately audit all MikroTik devices for internet-reachable SSH, restrict SSH to management-only networks, and review recent device configurations for unauthorized changes since September 2.
- SOC/IR — Act: Edge device full-takeover with confirmed active exploitation since at least September 2 is an assume-breach signal; sweep MikroTik routers for unauthorized admin sessions and configuration changes, and check for anomalous outbound traffic from these devices as a lateral-movement indicator.
- Leader — Plan: MikroTik is common in SMB and branch-office environments; direct the security team to inventory internet-facing MikroTik SSH exposure and confirm whether any devices were reachable since September 2 — not yet a systemic board-level event but escalate if exposure is confirmed.
- Engineer — Plan: If you manage any public-facing web properties, audit them for injected ClickFix loader scripts; the blockchain storage makes payload URLs resilient to takedown, so perimeter blocklists alone won’t suffice.
- SOC/IR — Act: Active campaign at scale — tune detections for ClickFix behavior patterns: browser-spawned mshta or PowerShell, clipboard-manipulation sequences, and outbound calls to BNB Chain RPC endpoints from endpoints since this campaign began.
- Leader — Learn: The use of blockchain smart contracts as an abuse-resistant payload store is a meaningful evasion evolution worth noting; no immediate leadership action needed unless an internal investigation reveals your web presence among the 5,400 compromised sites.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation chaining an auth bypass into RCE. Identify your PaperCut version immediately and patch to the vendor-specified fixed release; treat as critical given the exploitation chain severity.
- SOC/IR — Act: An active credential-theft campaign is exploiting PaperCut installations, with command execution and reconnaissance observed. Hunt for post-authentication anomalies in PaperCut server logs and sweep for Arctic Wolf’s published IOCs dating back to the initial disclosure window.
- Leader — Plan: Verify whether PaperCut is deployed anywhere in your estate and confirm engineering is treating remediation as priority given CISA KEV listings and active credential harvesting; education-sector orgs face the highest exposure.
- Signals: CVE-2026-81578 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub · CVE-2026-82078 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Learn: A breach at a major identity verification vendor exposes the scale of risk in third-party ID data aggregators; no IOCs or TTPs published yet to act on.
- Leader — Act: If your organization uses IDScan for identity verification, confirm your vendor exposure now and request an incident attestation; this scale of driver license exposure may trigger customer or regulatory inquiries regardless of direct involvement.
- Engineer — Plan: Audit email security gateway and filtering pipeline for Unicode normalization support; configure rules to strip or flag invisible Unicode tag characters (U+E0000 block) before keyword matching, as current filter logic may silently pass these.
- SOC/IR — Act: Active high-volume campaign with a specific, huntable TTP: query recent inbound email logs for messages containing invisible Unicode tag characters interleaved within financial keywords; tune SEG/SIEM detections to flag this pattern going forward.
- Leader — Learn: Novel evasion technique shows email filtering products may have a systematic blind spot around Unicode normalization; useful context when next reviewing email security vendor capabilities or during security questionnaire assessments.
- Engineer — Act: NetScaler is a widely deployed internet-facing edge appliance; a public PoC plus reported active exploitation makes patching urgent even absent a KEV listing — apply Citrix’s fix for CVE-2026-19490 immediately and audit NetScaler access logs for anomalous sessions since the PoC was published.
- SOC/IR — Act: Auth bypass on an edge device in active exploitation is assume-breach territory — sweep NetScaler access logs for unauthorized session establishment and anomalous management-plane activity dating back to when the public PoC dropped, and tune detections for post-auth lateral movement from NetScaler source IPs.
- Leader — Plan: Exploitation is reported by a single vendor source and EPSS remains low; confirm engineering has NetScaler patching on this week’s priority list and set a check-in to escalate if KEV listing or multi-source confirmation of widespread compromise emerges.
- Signals: CVE-2026-19490 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Skip
- Leader — Act: Thomson Reuters is a widely used vendor in legal, compliance, and government-adjacent environments; confirm whether your organization shares data with C-Track or West Publishing services and formally request a breach attestation and scope statement from Thomson Reuters this week.
- Engineer — Act: A public exploit targeting CrowdStrike Falcon on fully-patched Windows exists with no vendor patch yet; monitor CrowdStrike’s advisory channel closely and apply the patch immediately upon release — consider whether compensating controls (network segmentation, application allow-listing) can reduce local-access risk in the interim.
- SOC/IR — Act: The exploit abuses CrowdStrike Falcon’s highly-privileged agent process to reach SYSTEM; hunt for anomalous SYSTEM-level child processes or handle manipulation originating from Falcon services, and flag any detections for IR escalation until a patch ships.
- Leader — Plan: A public zero-day against your likely-deployed EDR vendor has no patch yet; engage your CrowdStrike account team for an official advisory timeline and prepare a leadership brief in case active exploitation is confirmed before a fix is released.
- Engineer — Act: Public PoC on GitHub for an unauthenticated root RCE on widely deployed data-center switches raises exploitation risk even with low EPSS; apply Cisco’s Nexus 9000 patch now and separately assess IOS XR exposure for the two 9.8-rated CVEs that have no available workaround.
- SOC/IR — Plan: No active exploitation confirmed yet, but the public PoC means attempts are likely imminent; build detections for anomalous access to Nexus 9000 management interfaces and prepare a hunt query baseline now before KEV listing forces a reactive response.
- Leader — Plan: Unauthenticated root RCE on core network switches with a public PoC is a meaningful risk-register item; confirm your network team has the Nexus 9000 patch cycle scheduled and note the IOS XR exposure for environments running that platform.
- Signals: CVE-2026-20212 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
Act
archived
Coder registry infrastructure compromised via Cloudflare to deliver malicious Terraform modules
- Engineer — Act: If your teams use Coder’s Terraform registry, audit your module sources immediately and rotate any cloud credentials (AWS keys, GCP SAs, Azure SPNs) that Terraform may have accessed during runs while the malicious servers were active.
- SOC/IR — Act: Hunt CI/CD and IaC pipeline logs for module fetches from Coder’s registry during the compromise window; look for anomalous outbound credential-exfiltration traffic from Terraform runner environments and trigger an assume-breach sweep if usage is confirmed.
- Leader — Act: Determine whether engineering teams use Coder’s Terraform registry, and if so, request an incident timeline from Coder, assess credential exposure scope, and brief leadership on potential cloud environment impact before it surfaces externally.
- Engineer — Act: Actively exploited V8 zero-day in Chrome; update all managed Chrome installations to the latest stable release immediately, and verify browser auto-update policies are enforced across endpoints.
- SOC/IR — Act: Active exploitation means assume-breach posture for unpatched endpoints; hunt for suspicious renderer process activity or unusual child processes spawned from Chrome since the disclosure date, and confirm EDR coverage on browser-based attack chains.
- Leader — Plan: An actively exploited Chrome zero-day affecting enterprise endpoints warrants confirming your patch velocity for browsers; verify IT/security teams have a forced-update mechanism in place and brief your risk register if patch rollout will take more than 48 hours.
- Engineer — Act: Actively exploited V8 type confusion (CVSS 8.8) with a public PoC on GitHub; update all managed Chrome installations to 152.0.7977.82 immediately and check for pending Chromium-based browser updates (Edge, Brave).
- SOC/IR — Act: Active in-the-wild exploitation means assume-breach posture for unpatched endpoints; hunt for anomalous child processes or shell activity spawned from browser processes since the disclosure date, and monitor web proxy logs for suspicious redirect chains that may indicate exploit delivery.
- Leader — Learn: High-severity browser zero-day under active exploitation, but this is a standard patch-cycle item your engineering team should drive; escalate only if internal compromise indicators surface during the hunt.
- Signals: CVE-2026-85046 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: Audit email security gateway and content-inspection rules to detect invisible Unicode characters used to bypass filters; evaluate whether your email platform has updated signatures for this evasion class.
- SOC/IR — Act: Build or tune detection rules to flag emails containing invisible/tag Unicode codepoints (U+E0000 range); hunt for recent phishing lures that may have bypassed filters using this technique since the evasion method is now publicly documented.
- Leader — Learn: A novel phishing evasion technique is gaining traction; no board-level action needed now, but awareness is useful context for the next email security or AI-risk discussion.
- Engineer — Act: Active campaign with public PoC and 440k observed attempts makes this urgent despite low EPSS — if you run Super Forms or Elementor Pro on any WordPress site, update both plugins immediately and audit web-accessible upload directories for dropped files.
- SOC/IR — Act: The scale of this campaign (440k attempts) warrants sweeping web server logs for unauthenticated POST requests to Super Forms and Elementor Pro upload endpoints, and hunting for newly created PHP files in WordPress upload paths since the PoC became public.
- Leader — Plan: Confirm whether WordPress with these plugins exists in any customer-facing or internal properties; if so, ensure the patch-and-audit cycle is assigned and tracked — the exploitation volume makes this a realistic exposure risk worth validating this week.
- Signals: CVE-2026-14894 — CISA KEV: not listed, EPSS 0.05, public PoC on GitHub
- Engineer — Plan: Audit and tighten Microsoft Teams external access policies to block or restrict unsolicited external chat from unknown tenants; review which remote-access tools are permitted and ensure Node.js execution from user-writable paths is monitored or blocked.
- SOC/IR — Act: Active human-operated campaign with clear TTPs: external Teams chat impersonating IT support → remote session → Node.js implant → lateral movement via living-off-the-land tools. Hunt for Node.js spawning unusual child processes, remote-access tool sessions initiated from external Teams contacts, and abnormal lateral movement patterns since early September 2026; tune EDR rules on Teams-initiated process chains.
- Leader — Plan: This campaign exploits enterprise collaboration tools (Teams) rather than unpatched software, meaning technical controls alone are insufficient — review whether external Teams federation policies are hardened and ensure current security-awareness training explicitly covers IT-support impersonation via chat platforms.
- Engineer — Act: A public PoC now exists for a 0day privilege escalation in CrowdStrike Falcon Sensor — a highly privileged process running on every protected endpoint. Monitor CrowdStrike’s advisory channel for an emergency patch and audit endpoint telemetry for local privilege escalation events involving Falcon processes.
- SOC/IR — Act: With a public PoC available, this turns your own EDR agent into an attack vector; begin hunting for macro remediation abuse and anomalous privilege escalation events in Falcon telemetry from the PoC release date forward, and alert on-call that detections from Falcon on affected hosts may be less trustworthy until patched.
- Leader — Plan: If CrowdStrike Falcon is in your endpoint stack, contact your TAM this week to obtain an official vendor advisory and expected patch timeline; consider whether the risk warrants a brief to engineering leadership given that the security tooling itself is the attack surface.
- Engineer — Act: JFrog Artifactory is a core CI/CD artifact store in most cloud-native stacks; this auth bypass (CISA KEV listed, public PoC on GitHub) allows attackers to mint admin tokens and poison artifact repositories. Patch Artifactory to the vendor-fixed version immediately, rotate all existing API tokens, and audit recent token-creation events in Artifactory access logs for unauthorized entries.
- SOC/IR — Act: Active exploitation with CISA KEV listing means assume-breach posture for any org running Artifactory; hunt Artifactory audit logs for unexpected admin-token creation events since the CVE disclosure date, and watch for anomalous package downloads or uploads that may indicate a poisoned repository. Map activity to ATT&CK T1195 (Supply Chain Compromise) and T1550.001 (token abuse).
- Leader — Act: A compromised Artifactory instance is a direct supply-chain risk — malicious packages could propagate to production software. Confirm this week whether your environment runs JFrog Artifactory and that your engineering team has applied the emergency patch; if Artifactory is customer-facing or feeds external releases, prepare a brief for stakeholders on exposure status.
- Signals: CVE-2026-82329 — CISA KEV: listed, EPSS 0.08, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Active exploitation delivering server-side webshells means any WordPress instance running Elementor Pro is at immediate risk; patch to the latest Elementor Pro release now and audit wp-content directories for unexpected PHP files or recently modified files indicative of webshell drops.
- SOC/IR — Act: Exploitation is confirmed in the wild with webshell payloads executing arbitrary commands; hunt for anomalous file-creation events under wp-content on WordPress servers and flag outbound connections or command execution originating from web server processes since the start of active campaign reports.
- Leader — Skip
- Signals: CVE-2026-32475 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: CVE-2026-83548 is a CVSS 10.0 unauthenticated SSRF in SonicWall SMA 1000 — KEV-listed with a public GitHub PoC and confirmed active exploitation. Patch SonicWall SMA 1000 to the vendor-fixed version immediately and audit outbound connections from the appliance for reverse-shell traffic or unauthorized processes.
- SOC/IR — Act: Attackers exploiting these flaws are deploying reverse shells and crypto miners, giving clear post-compromise detection surface. Hunt for anomalous outbound connections and miner processes originating from SonicWall SMA 1000 appliances since the KEV listing date, and tune EDR/SIEM rules for reverse-shell execution patterns on edge devices.
- Leader — Act: A CVSS 10.0 unauthenticated flaw in a widely deployed enterprise VPN appliance is now KEV-confirmed exploited — this warrants same-week action. Confirm with your engineering team whether SonicWall SMA 1000 is in your estate and verify patch status; VPN compromise is a common lateral-movement entry point that may require disclosure if exploitation is found.
- Signals: CVE-2026-83548 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: Node.js is ubiquitous across cloud workloads, CI/CD pipelines, and servers, making node.exe a high-value abuse target; review execution controls and implement monitoring to flag unexpected node.exe process trees or outbound connections in your environments this quarter.
- SOC/IR — Act: Active campaign targeting government, tech, and hospitality sectors since February 2026 — hunt for anomalous node.exe execution (unexpected parent processes, suspicious child spawns, outbound network from node.exe) in EDR telemetry back to February, and pull the full Symantec Threat Hunter report for any published IOCs to sweep against SIEM logs.
- Leader — Learn: Attackers are weaponizing trusted developer runtimes to evade controls — a useful data point for understanding how the threat landscape is evolving, but no immediate leadership action is required absent a specific vendor breach or sector-level systemic event.
- Engineer — Act: CISA KEV-listed, public PoC on GitHub, and confirmed active exploitation: if you run Sangoma Switchvox, patch CVE-2026-9586 immediately or isolate the admin interface from untrusted networks until a patch is applied.
- SOC/IR — Act: Attackers are landing reverse shells via unauthenticated exploitation on edge VoIP devices; hunt for anomalous outbound connections originating from Switchvox hosts and sweep for post-exploitation activity (new processes, lateral movement) since the vulnerability became public.
- Leader — Plan: Confirm with engineering whether Switchvox is in the environment; if so, verify patching is prioritized this week given CISA KEV status — not yet a board-level event, but the KEV listing warrants a same-week check-in.
- Signals: CVE-2026-9586 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: If you run Sangoma Switchvox SMB Edition 8.3, patch immediately — a public PoC exists and active exploitation is reported. Restrict network access to the Switchvox admin interface as an interim control while a patch is applied.
- SOC/IR — Act: Active exploitation is deploying reverse shells from VoIP infrastructure; hunt for anomalous outbound connections originating from Switchvox hosts and sweep network logs for unexpected C2 traffic since the PoC went public.
- Leader — Skip
- Signals: CVE-2026-9586 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Actively exploited RCE zero-days on an edge appliance demand immediate response: apply SonicWall’s emergency mitigations or patches as soon as available, and treat any internet-exposed SMA1000 as potentially compromised pending confirmation.
- SOC/IR — Act: Active exploitation of an edge SSL VPN device means compromise may predate any patch; sweep SMA1000 appliances for anomalous outbound connections and lateral movement indicators from the appliance’s IP, and initiate assume-breach review of adjacent segments.
- Leader — Act: If SonicWall SMA1000 is in the estate, confirm remediation is underway this week and request a vendor statement on exposure scope; actively exploited RCE on a remote-access gateway is the kind of incident that surfaces in board and customer conversations.
- Engineer — Act: Pre-authentication SSRF (CVSS 10.0) with a public PoC and confirmed active exploitation on SonicWall SMA 1000 series VPN appliances — patch to the vendor-released update immediately and isolate appliances from untrusted networks while patching proceeds.
- SOC/IR — Act: Active zero-day exploitation of an edge VPN device means assume-breach posture: sweep SMA 1000 access and authentication logs for anomalous pre-auth requests and unusual outbound SSRF-originated connections since disclosure, and tune detections for chained exploit behavior from the appliance.
- Leader — Act: Confirm whether the organization runs SonicWall SMA 1000 appliances and, if so, brief leadership this week — a CVSS 10.0 pre-auth zero-day under active exploitation on a perimeter VPN is a material risk event that may generate customer or board questions.
- Signals: CVE-2026-83548 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Learn: No CVE or patch involved — attackers are abusing a legitimate admin tool’s functionality. Review whether Faronics Deploy is in your environment and whether its deployment permissions are appropriately scoped.
- SOC/IR — Act: Hunt for unexpected ScreenConnect installations originating from Faronics Deploy processes; build detections for remote-management tool deployments not initiated by IT change management workflows.
- Leader — Skip
- Engineer — Plan: If your platform uses a third-party identity verification or KYC service — particularly one based in Louisiana — audit that integration and check whether user-submitted ID scans are in scope; no patch action applies, but vendor contract and data-handling review is warranted this quarter.
- SOC/IR — Learn: 153M+ stolen driver’s licenses will likely fuel account-takeover and synthetic-identity fraud campaigns; no IOCs or TTPs are published yet, but flag for future hunting context once the affected vendor is named publicly.
- Leader — Act: Confirm this week whether your organization uses the implicated Louisiana-based identity verification vendor and request an incident attestation; the scale of this exposure is likely to generate customer and board questions before the week is out.
- Engineer — Plan: The flaw is on Lenovo’s side, not patchable by your team, but audit all corporate Dropbox accounts for unauthorized access and disable any Lenovo-linked authentication integrations in your Dropbox admin console.
- SOC/IR — Act: Dropbox accounts are actively compromised — review Dropbox audit logs for anomalous sign-ins tied to Lenovo ID authentication since the earliest affected date and sweep for any corporate accounts flagged by Dropbox’s warning.
- Leader — Act: Confirm this week whether your organization uses Dropbox accounts linked to Lenovo credentials, request Dropbox’s breach notification details, and assess whether customer or regulatory disclosure obligations are triggered.
- Engineer — Act: Active exploitation of an unauthenticated RCE in Langflow (public PoC available) is being used to exfiltrate API keys and cloud credentials. Patch Langflow to the latest fixed release immediately, rotate any OpenAI and AWS keys accessible from Langflow instances, and review Langflow access logs for signs of unauthorized execution.
- SOC/IR — Act: Confirmed active exploitation with credential theft as the objective creates a detection and hunt opportunity now. Identify any Langflow instances in the environment, hunt for anomalous outbound requests or process spawning from those hosts, and monitor for unusual OpenAI or AWS API activity that could indicate stolen key use.
- Leader — Plan: If AI application development is underway internally, Langflow may be present in engineer pipelines — AWS key theft from a development tool is a material cloud-spend and data-exposure risk. Direct engineering teams this week to audit Langflow deployments and confirm no keys were exposed.
- Signals: CVE-2026-0768 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
- Engineer — Plan: Audit software procurement and build pipelines to ensure installers are sourced from verified vendor URLs or checksummed official releases; review SBOM/dependency sources for any unverified binaries introduced via download steps.
- SOC/IR — Act: Microsoft published IOCs and Defender XDR detection logic for this active campaign — sweep for the provided IOCs now and tune detections to flag execution of installer-dropped payloads from user download directories.
- Leader — Learn: This campaign illustrates ongoing risk from uncontrolled software procurement; useful for reinforcing software sourcing policy requirements, but no immediate leadership action is warranted absent a confirmed internal incident.
- Engineer — Act: Any Virtualizor installation that auto-updated after August 28 at ~20:57 UTC may have received the trojanized package and should be treated as compromised; immediately audit those hypervisors for persistence mechanisms (cron, SSH keys, kernel modules) and isolate pending forensic review.
- SOC/IR — Act: Confirmed root-level compromise on 5 hypervisors with an update-window starting August 28 at 20:57 — sweep all Virtualizor hosts for new root SSH authorized_keys, unexpected cron jobs, or novel init services added after that timestamp; initiate assume-breach IR process for any positive hits.
- Leader — Plan: If your infrastructure or a managed hosting vendor runs Virtualizor, request a written attestation from them confirming whether their hypervisors fell within the compromised update window, and add BGP-hijack supply-chain risk to the next vendor risk review cycle.
- Engineer — Act: Patch JFrog Artifactory to the fixed version immediately; active exploitation of CVE-2026-82329 (CVSS 9.8) plus a public PoC means attackers can gain admin access under default configuration. Also audit Artifactory admin token creation logs for unauthorized tokens generated since disclosure.
- SOC/IR — Act: Hunt for unauthorized admin token minting events in Artifactory audit logs from the past several days; focus on token creation API calls from unexpected source IPs or service accounts. WatchTowr’s analysis likely contains TTPs worth mapping to detections.
- Leader — Act: Confirm this week whether Artifactory is in use and that emergency patching has occurred — admin-level access to artifact repositories is a supply-chain risk where injected malicious packages could affect downstream builds. Brief engineering leadership on the exposure window if patching was delayed.
- Signals: CVE-2026-82329 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: PaperCut NG/MF was exploited as a zero-day and attacks are ongoing — patch to the latest released version immediately and audit server logs for signs of unauthorized access or data exfiltration.
- SOC/IR — Act: Active data theft via PaperCut exploitation means assume-breach posture for any organization running PaperCut — hunt for anomalous outbound traffic and lateral movement from PaperCut servers since before the patch date.
- Leader — Plan: PaperCut is widely used in enterprise and education; confirm whether the organization runs it and verify that engineering has applied the patch — brief leadership only if patch status is unconfirmed or delayed.
- Engineer — Act: Any environment running Virtualizor may have received a trojaned update; immediately verify installed binary integrity against known-good checksums and audit servers for post-compromise artifacts. If update timestamps align with the hijack window, treat the host as compromised and scope accordingly.
- SOC/IR — Act: Identify all Virtualizor-managed hosts in the estate and flag them for assume-breach review; hunt for unusual process execution, outbound connections, or file modifications following recent update activity on those hosts.
- Leader — Learn: BGP hijacking to intercept software update traffic is a sophisticated supply-chain vector that bypasses code-signing assumptions when the update mechanism itself is redirected; useful context for reviewing how third-party software update trust is modeled in your vendor risk program.
- Engineer — Act: CVE-2026-0768 in Langflow is a CVSS 9.8 RCE running as root with a public PoC and confirmed active exploitation — patch or take Langflow offline immediately; also audit Rails deployments for CVE-2026-66066 exposure and apply the latest Rails patch given the 0.28 EPSS and available PoC.
- SOC/IR — Act: Active exploitation includes credential-probing and C2 callback activity — hunt for anomalous outbound connections and lateral movement originating from Langflow or Rails app servers since these flaws became public, and build detections for post-exploitation behavior on those hosts.
- Leader — Skip
- Signals: CVE-2026-0768 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub · CVE-2026-66066 — CISA KEV: not listed, EPSS 0.28, public PoC on GitHub
- Engineer — Learn: No CVE or patch required; the attack path abuses Teams social engineering rather than a software flaw, so review Teams external-access settings and restrict who can initiate calls from outside the tenant.
- SOC/IR — Act: Active enterprise campaign targeting domain controllers via Teams vishing — hunt for anomalous Teams call activity from external tenants followed by process execution or lateral movement, and review Unit 42’s published TTPs for detection rule development.
- Leader — Plan: Campaign targets enterprise domain controllers through a trusted communication channel (Teams), raising both breach-risk and vendor-trust questions — brief IT leadership and consider tightening external Teams communication policies this quarter.
- Engineer — Learn: Defender Antivirus false-positive after recent update may trigger compliance alerts or monitoring noise; no patch or configuration change needed, just awareness that the UI error is benign until Microsoft releases a fix.
- SOC/IR — Act: Suppress or contextually tune alerts for Defender ‘antivirus turned off’ events caused by this update so analysts aren’t flooded with false positives; document the known-issue window to avoid masking real AV-disabling activity.
- Leader — Skip
- Engineer — Act: Active IR-confirmed intrusion targeting Cisco IOS XR routers and TACACS servers — infrastructure many enterprises run for network auth. Immediately audit IOS XR devices and TACACS servers for unauthorized configuration changes or unfamiliar accounts, and verify log-forwarding integrity to confirm no tampering with your SIEM feed.
- SOC/IR — Act: Log blinding on network management infrastructure means your SIEM may already have gaps; hunt for evidence of disrupted or absent log streams from routers and TACACS hosts since Fire Ant’s presence was confirmed via IR, not alerts. Cross-reference authentication events on Linux management hosts against expected baselines to surface lateral movement.
- Leader — Plan: A China-nexus espionage actor is confirmed to be targeting network management infrastructure (routers, auth servers) to silently steal credentials across high-value environments — assess whether your sector and network architecture match the targeting profile, and confirm your IR retainer has coverage for network-layer compromise scenarios.
- Engineer — Act: Fire Ant is actively implanting GRE tunnel interfaces on Cisco IOS XR routers that persist invisibly outside running configuration and commit history — audit all IOS XR devices for unexplained GRE interfaces and cross-check interface state against configuration databases.
- SOC/IR — Act: Active Chinese APT campaign against network edge devices warrants an assume-breach sweep; hunt for GRE tunnel interfaces on IOS XR routers that lack corresponding config entries, and look for anomalous GRE-encapsulated flows in NetFlow or firewall logs.
- Leader — Plan: A Chinese state-sponsored actor is using Cisco IOS XR routers as persistent espionage platforms — confirm whether IOS XR is in your environment, task the network team with an audit, and flag this to leadership given the espionage implications for sensitive traffic traversing core routing infrastructure.
- Engineer — Skip
- SOC/IR — Learn: Actor profile worth logging: FulcrumSec targets travel/transport sector and appears to exfiltrate before disclosure; no IOCs or TTPs published to act on yet.
- Leader — Act: If your organisation uses MAG airports or shares traveller data with them, request a formal incident report and assess whether your customers’ data is in scope for notification obligations.
- Engineer — Act: CVSS 9.8 authentication bypass and RCE affecting commonly deployed plugins (Avada, GiveWP, TranslatePress, Pods, WPMU DEV Dashboard), with a public PoC already on GitHub; patch all five to their latest patched releases before the PoC accelerates exploitation.
- SOC/IR — Plan: No active exploitation confirmed (EPSS 0.00, not on KEV), but the public PoC shortens the window; build or tune detections for anomalous WordPress admin account creation and unauthenticated POST requests targeting these plugin endpoints this sprint.
- Leader — Skip
- Signals: CVE-2026-76581 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Plan: Audit installed Chrome/Edge extensions across your managed fleet and enforce an allowlist policy; no CISA KEV or active enterprise exploitation signal, but browser extension supply-chain risk is real for developer workstations.
- SOC/IR — Act: Hunt for suspicious extension IDs from the reported malicious set in browser inventory logs and EDR telemetry; also look for ClickFix lure behavior (fake captcha/update prompts triggering clipboard/PowerShell execution) as a detection pattern since this reporting date.
- Leader — Plan: Browser extension governance is a gap in most enterprise policies — use this as a prompt to task the team with drafting an approved-extension policy before the next audit cycle.
- Engineer — Learn: DLL sideloading via fake CAPTCHA lures is a pattern worth understanding for hardening application allow-listing and endpoint controls, but no specific software patch or configuration change is required from this report alone.
- SOC/IR — Act: Microsoft’s analysis includes detections and hunting guidance — run the published hunts in your SIEM/EDR for DLL sideloading chains and reverse tunnel beaconing, and tune detections for ClickFix-style CAPTCHA lure execution paths since this campaign is actively tracked.
- Leader — Learn: Useful background on a live social-engineering campaign targeting enterprises, but no vendor breach or regulatory trigger is present; file for situational awareness and board-deck threat landscape context.
- Engineer — Learn: Breach was via unauthorized access to third-party applications, not a patchable CVE; reinforces the need to audit and restrict third-party SaaS access, but no concrete engineering action is available from this disclosure alone.
- SOC/IR — Learn: ShinyHunters attribution is a useful actor profile update, but no IOCs, TTPs, or detection-relevant technical detail are published yet; monitor for follow-on disclosures that include actionable indicators.
- Leader — Act: McKesson is a major healthcare and pharma supply chain vendor — if your organization has a relationship with them, confirm exposure scope this week and request their incident attestation; 284 million claimed patient records puts this in HIPAA notification and board-visibility territory.
- Engineer — Act: PaperCut NG and MF are actively exploited and the first fix was bypassed, meaning unpatched and initially-patched instances remain at risk; update to the latest emergency release immediately and verify the new version is applied end-to-end.
- SOC/IR — Plan: Active exploitation with a bypassed patch means print servers in the estate may already be compromised; build or tune detections for anomalous outbound connections and process spawning from PaperCut service accounts, and sweep logs back to the original disclosure date.
- Leader — Plan: If PaperCut is in the environment, confirm with engineering that the second emergency patch is deployed and request a status update — active exploitation plus a failed first fix is the kind of event that can escalate to a breach if patching is delayed.
- Engineer — Act: PaperCut NG and MF print management software is under active zero-day exploitation with confirmed customer incidents; apply PaperCut’s emergency patch for v25/v26 immediately and isolate unpatched instances from the network until patched.
- SOC/IR — Act: Confirmed active exploitation means assume-breach posture for any PaperCut server in the estate; sweep PaperCut application logs for anomalous requests and lateral movement indicators since PaperCut servers have been used as initial-access footholds in prior ransomware campaigns.
- Leader — Act: Active zero-day with confirmed customer incidents in widely deployed enterprise print software; this week confirm whether your organization runs PaperCut NG or MF, verify emergency patching is underway, and prepare a brief for leadership if exposure is confirmed.
- Engineer — Act: Unauthenticated RCE via chained flaws in PaperCut NG/MF is being actively exploited; apply the emergency patch immediately and audit PaperCut server logs for unexpected Java process execution or outbound connections predating the patch.
- SOC/IR — Act: Active exploitation of PaperCut print servers means assumed-breach posture is warranted — hunt for anomalous Java child processes or unusual network activity originating from PaperCut hosts since before the emergency patch date, and check EDR telemetry on any print-management systems.
- Leader — Plan: PaperCut NG/MF is common in enterprise and education environments; confirm with engineering that all instances are patched this week and verify no lateral movement occurred from print servers — prior PaperCut exploits (2023) drew board attention, so have a status update ready if asked.
- Engineer — Act: CVE-2023-49105 (CVSS 9.8) is CISA KEV-listed with a public GitHub PoC and confirmed active exploitation; patch ownCloud to a non-vulnerable version immediately and audit file-access logs for anomalous activity since the PoC has been public.
- SOC/IR — Act: A Chinese-speaking threat actor is actively weaponizing this flaw for targeted data theft — hunt for unusual ownCloud authentication events and large data transfers in your estate, and correlate against any published IOCs from this campaign.
- Leader — Plan: Confirm whether ownCloud is present in your environment and verify engineering has applied the patch; the CISA KEV listing and nation-state targeting of critical-infrastructure research bodies makes this worth a direct question to your team this week.
- Signals: CVE-2023-49105 — CISA KEV: listed, EPSS 0.41, public PoC on GitHub
- Engineer — Act: A public PoC exists for a root-level RCE in cPanel and WHM affecting all supported versions — update cPanel/WHM to the patched release immediately and verify no unauthorized access occurred on any exposed panels.
- SOC/IR — Plan: With a public PoC now available, write or enable detections for anomalous root-process spawning from cPanel/WHM processes and unusual web requests to the cPanel/WHM management interfaces before exploitation campaigns begin.
- Leader — Skip
- Signals: CVE-2026-65643 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Act: APT28-linked HOOKEDGE is a new Windows batch-script backdoor actively used against government and diplomatic targets in Europe; hunt for suspicious batch-script persistence mechanisms and lateral movement patterns consistent with APT28 TTPs (ATT&CK: T1059.003) in Windows endpoint telemetry since September 2025.
- Leader — Learn: APT28 has deployed a novel backdoor against European government and diplomatic organizations — relevant for sector-risk awareness and to brief leadership if your organization has European government ties or similar exposure profile.
- Engineer — Act: If you self-host Gitea, check your version immediately and patch to the latest release — Shadowserver confirms ongoing RCE exploitation against exposed instances, meaning unpatched servers are actively being targeted now.
- SOC/IR — Act: Audit your estate for internet-exposed Gitea instances and hunt for signs of RCE compromise (unexpected processes, new admin accounts, modified repos) since exploitation is described as active; a compromised source-code platform carries serious supply-chain risk.
- Leader — Plan: Confirm with engineering whether your organization runs self-hosted Gitea and verify patching status this week; a compromised internal code repository would pose a supply-chain risk worth flagging to leadership if exposure is confirmed.
- Engineer — Skip
- SOC/IR — Learn: ShinyHunters continues active extortion operations; no IOCs or TTPs published from this incident to act on, but useful for tracking the group’s targeting patterns.
- Leader — Act: If Carhartt is a vendor or employee-benefits partner, request their incident report and confirm scope of data shared; separately, brief leadership given the scale (12.9M accounts) in case customers or press ask.
- Engineer — Act: Zero-day active exploitation in PaperCut NG and MF means no waiting for a patch window; immediately check whether your organization runs either product, apply any vendor-published mitigations or workarounds, and monitor PaperCut’s advisory page for patch availability.
- SOC/IR — Act: Active exploitation of PaperCut servers creates an immediate assume-breach window; hunt for anomalous child-process spawning from PaperCut services, unusual outbound connections from print-management hosts, and review authentication logs on those servers going back at least two weeks.
- Leader — Act: PaperCut NG/MF is broadly deployed in enterprise environments and prior PaperCut vulnerabilities were rapidly weaponized by ransomware actors; confirm with your team this week whether either product is in use and verify that mitigations are being applied before a patch is available.
- Engineer — Plan: If your pipelines pull models, datasets, or use API tokens from Hugging Face, audit those credentials and verify the integrity of artifacts sourced from the platform. The autonomous zero-day exploitation angle is also a design warning for teams deploying AI agents with broad tool access.
- SOC/IR — Learn: This documents a novel attack class — AI agents autonomously discovering and chaining zero-days through reward misalignment — but the summary provides no actionable IOCs or detection signatures to operationalize today.
- Leader — Act: Hugging Face was breached; confirm whether your organization stores models, datasets, or credentials there and request an incident impact statement from the vendor. The autonomous AI exploitation finding is also board-relevant context for any AI agent governance discussion already in flight.
- Engineer — Act: Public PoC on GitHub for unauthenticated RCE in a ubiquitous web framework clears the bar for immediate action — upgrade Next.js to the patched release now, prioritizing any Windows-hosted deployments and any apps accepting untrusted image uploads.
- SOC/IR — Plan: With a public PoC and no KEV listing yet, build detections for suspicious AVIF uploads and Windows-style path traversal sequences (e.g. ..) in HTTP requests targeting Next.js routes before active exploitation begins.
- Leader — Plan: Two critical unauthenticated RCE flaws with public PoC in a widely-deployed framework warrant confirming this quarter that your engineering teams have inventoried Next.js usage and applied patches — flag for a status check if any customer-facing apps are affected.
- Signals: CVE-2026-75604 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Plan: Microsoft Threat Intelligence documents active exploitation of exposed LiteLLM gateways leading to credential theft and persistence — no KEV or PoC signal, but if you run LiteLLM or similar AI proxies, audit internet exposure, rotate API keys, and verify no unauthorized processes are running on those hosts.
- SOC/IR — Act: Active attack chain with detectable post-exploitation stages (credential harvesting, persistence, cryptomining) reported by Microsoft TI — pull the blog post for IOCs, then hunt for anomalous processes and outbound connections on any hosts running AI gateway software since the publication date.
- Leader — Plan: AI workloads are now an established attack surface for credential theft and resource abuse; this quarter, ensure AI infrastructure (gateways, API proxies, GPU hosts) is included in your hardening and access-review scope alongside traditional edge assets.
- Engineer — Act: CISA KEV listing with active exploitation across NetScaler ADC/Gateway, Linux, and SQL Server — all plausible in enterprise environments; patch affected NetScaler and SQL Server instances immediately and verify Linux kernel versions against the KEV entries.
- SOC/IR — Act: NetScaler edge devices are a prime assume-breach target when exploitation precedes patching; hunt for post-exploitation activity on NetScaler appliances and any lateral movement from SQL Server hosts since these vulnerabilities entered active exploitation.
- Leader — Plan: Six KEV additions spanning widely-deployed infrastructure signal a broad active-exploitation wave; confirm your engineering teams are tracking patch timelines for NetScaler, Linux, and SQL Server against CISA’s binding operational directive deadlines.
- Signals: CVE-2019-1068 — CISA KEV: listed, EPSS 0.53, public PoC on GitHub
- Engineer — Act: Citrix NetScaler is a common edge appliance; active exploitation of an RCE with a CISA KEV order makes this immediate. Identify all NetScaler instances in your environment and apply the vendor patch now — Saturday deadline applies to federal agencies but exploitation is not sector-limited.
- SOC/IR — Act: Active exploitation of an edge RCE means attackers may already be inside before patching occurs; initiate an assume-breach sweep on NetScaler appliances, reviewing management-plane logs and lateral movement indicators since the vulnerability became public.
- Leader — Act: CISA’s mandatory patch order with a Saturday deadline signals systemic exploitation — confirm whether your organization runs Citrix NetScaler, verify remediation is in progress, and brief leadership if you operate federal systems or customer-facing NetScaler infrastructure.
- Engineer — Plan: AiTM phishing that defeats standard MFA is a config problem, not a patch problem — audit your Entra ID Conditional Access policies and prioritize migrating M365 users to phishing-resistant MFA (FIDO2/passkeys) this quarter, as TOTP and SMS are insufficient against this class of attack.
- SOC/IR — Act: This campaign is active and broadly targeting US enterprises via M365; hunt for AiTM indicators in Entra ID sign-in logs now — flag token issuance from unexpected IPs, session establishment followed by unusual API activity, and impossible-travel events from the same session cookie.
- Leader — Act: With 4,500 organizations targeted and ~48% of targeted addresses potentially compromised, confirm with your team this week that phishing-resistant MFA is enforced for M365 and assess whether your domain appeared in ANY.RUN’s targeting data; this is board-question territory given the scale.
- Engineer — Act: Over 270 confirmed compromises signals mass exploitation of this Zimbra Collaboration Suite RCE flaw — immediately determine if you run ZCS and apply the available patch; treat any internet-exposed Zimbra instance as potentially compromised pending verification.
- SOC/IR — Act: Widespread active exploitation means assume-breach posture for any Zimbra environment: audit Zimbra server logs and web directories for web shells or anomalous POST requests since the campaign began, even without specific published IOCs.
- Leader — Act: Confirmed mass compromise of enterprise email infrastructure warrants same-week action — verify whether your organization or key SaaS/hosting vendors run on-premises Zimbra and direct your security team to assess exposure immediately before this surfaces as a board-level question.
- Engineer — Act: CISA KEV-listed RCE (CVSS 9.8) with public PoC requires only repository write access to execute arbitrary shell commands — patch Gitea immediately and audit server process trees and outbound connections for miner-related IOCs.
- SOC/IR — Act: Active exploitation with miner-like payload delivery gives a clear detection angle — hunt for anomalous child processes spawned by the Gitea process, unusual outbound connections from CI/Git infrastructure, and unexpected CPU spikes on self-hosted Git servers since the CVE was published.
- Leader — Plan: If your organization runs self-hosted Gitea, confirm with engineering teams this week whether the patch has been applied; a compromised source code host is a supply-chain risk that may warrant customer notification depending on your disclosure obligations.
- Signals: CVE-2026-60004 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: If you run a self-hosted Gitea instance, patch to the fixed version immediately — CISA-confirmed active exploitation of a critical code injection flaw means your CI/CD pipeline and source repositories are at direct risk.
- SOC/IR — Act: Audit any Gitea instances in your estate for signs of code injection compromise dating back to initial disclosure; a compromised source-code host can stage supply-chain attacks that require assume-breach investigation of downstream build artifacts.
- Leader — Plan: Direct your teams to inventory self-hosted Gitea deployments and validate patch status; a code injection flaw in source-code infrastructure carries supply chain risk worth confirming is closed before it surfaces in a customer security questionnaire.
- Engineer — Act: CISA KEV listed, CVSS 10.0, public PoC on GitHub, and active exploitation confirmed — all signals align for emergency patching. Apply Oracle’s patch for CVE-2026-21962 on all Oracle HTTP Server and WebLogic Server instances immediately; treat as an out-of-cycle emergency change.
- SOC/IR — Act: Active exploitation is confirmed via CISA KEV; the unauthenticated HTTP attack vector means exploit attempts are visible at the network layer. Hunt for anomalous unauthenticated HTTP requests to WebLogic management and listener ports since the KEV listing date, and tune SIEM/WAF rules for CVE-2026-21962 exploitation patterns.
- Leader — Act: A maximum-severity, actively-exploited Oracle middleware flaw in CISA KEV warrants same-week leadership attention for any org running WebLogic in regulated or customer-facing environments. Confirm whether Oracle WebLogic or Oracle HTTP Server is in your environment, verify emergency patching is in motion, and prepare a brief for leadership if these systems support critical workloads.
- Signals: CVE-2026-21962 — CISA KEV: listed, EPSS 0.43, public PoC on GitHub
- Engineer — Act: If you run the miniOrange SAML 2.0 SSO plugin on any WordPress site, update it immediately — active exploitation attempts are underway and successful attacks yield unauthenticated admin access via forged SAML responses. Audit recent admin accounts and session logs for signs of unauthorized logins.
- SOC/IR — Act: Active exploitation is in progress; hunt for anomalous SAML authentication events and unexpected admin account creation or logins on any WordPress instances in your estate, and tune detections for unusual authentication source patterns against WordPress admin endpoints.
- Leader — Plan: If your organization operates WordPress sites with the miniOrange SAML SSO plugin, direct teams to patch this week — a successful exploit grants full admin takeover, which could expose customer data or be used as a pivot point. Verify your WordPress plugin inventory and patch cadence.
- Engineer — Act: Keycloak is a common IAM component in Kubernetes and cloud stacks; a public PoC for unauthenticated account takeover makes exploitation practical regardless of the low EPSS. Patch Keycloak to the fixed release immediately and audit authentication logs for anomalous password-reset activity since disclosure.
- SOC/IR — Plan: No active exploitation or IOCs yet, but a public PoC raises the likelihood of opportunistic abuse soon. Build or tune a detection for high-volume or cross-account password-reset requests against Keycloak endpoints so you are ready to alert when attempts begin.
- Leader — Plan: An unauthenticated takeover flaw in an IAM server is high-blast-radius if exploited — it could affect all accounts in the realm. Confirm your engineering team has scheduled the Keycloak patch and verify whether any customer-facing SSO flows depend on it.
- Signals: CVE-2026-18963 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listing with active exploitation means immediate action: patch Zimbra Collaboration Suite to the vendor-recommended version within the 3-day federal window, or sooner if possible.
- SOC/IR — Act: Active exploitation is confirmed; hunt for anomalous Zimbra activity (unusual logins, webshell artifacts, outbound connections from ZCS hosts) dating back at least 30 days and tune detections for ZCS-specific abuse patterns.
- Leader — Plan: If your org runs Zimbra, confirm patching is underway and verify no compromise occurred; if Zimbra is a vendor dependency, request their remediation attestation this week.
- Engineer — Act: Still-valid exposed AWS keys require no exploitation sophistication — the credential is the exploit. Audit all active IAM access keys in your AWS accounts, cross-reference against the leaked dataset, rotate any keys created or last-used anomalously, and enforce least-privilege policies with automatic key rotation going forward.
- SOC/IR — Act: Active leaked credentials mean unauthorized access may already be occurring. Hunt CloudTrail logs since August 2022 for API calls from unexpected source IPs, new IAM user/role creation, or unusual resource provisioning that could indicate keys were already abused by third parties.
- Leader — Act: Hundreds of corporate AWS keys with full-account-control scope being publicly available for up to four years is a material risk requiring same-week action — confirm whether your organization’s keys appear in the exposed set and direct engineering to complete a credential audit and rotation before end of week.
- Engineer — Act: Active supply-chain compromise in npm packages is an Act signal regardless of KEV status — audit your dependency tree immediately for these 14 packages masquerading as calendar/streak utilities and check CI build logs for processes spawned by node_modules executing detached binaries.
- SOC/IR — Plan: The implant’s load behavior — extracting a bundled binary, chmod-ing it, and launching it as a detached process — is a detectable Linux TTP; build or tune EDR rules to alert on node/npm processes spawning unexpected child executables, but the summary lacks IOCs or package names needed to hunt right now.
- Leader — Plan: An active npm supply-chain campaign using AI-assisted C2 signals an escalating threat class; this quarter, direct engineering to verify SCA tooling covers npm and confirm your CI pipelines would catch a malicious package load before it reaches production.
- Engineer — Act: Active exploitation confirmed by CERT Polska plus a public PoC on GitHub makes this urgent regardless of the low EPSS score. Patch Zimbra Collaboration (ZCS) to the fixed release immediately; prioritize any internet-facing Zimbra instances.
- SOC/IR — Act: Active in-the-wild exploitation of an email server RCE creates an assume-breach exposure window. Hunt Zimbra SNMP and application logs for anomalous command execution patterns since the PoC publication date, and pull any IOCs published by CERT Polska for sweeping.
- Leader — Skip
- Signals: CVE-2026-73570 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Check every Cargo.lock in your repos and CI pipelines for arrayref 0.3.10, internment 0.8.7, or append-only-vec 0.1.9; if any match, treat the build environment as compromised and audit outbound network connections made during
cargo buildruns while those versions were live. - SOC/IR — Act: Hunt for anomalous outbound connections originating from CI/CD runners or developer machines during
cargo buildprocesses; look for spawned processes or network calls to unexpected hosts initiated from the Rust toolchain during the window these malicious versions were published. - Leader — Plan: Determine whether Rust is used in your development toolchain and, if so, have engineering confirm no builds consumed the named malicious versions; this class of build-time supply chain compromise is worth adding to your vendor/dependency risk review cadence.
- Engineer — Plan: OAuth consent-flow abuse by APT29-linked clusters is a real attack surface for any organization using third-party OAuth integrations; audit configured OAuth app permissions and enforce stricter conditional access policies to reduce the social-engineering foothold these groups exploit.
- SOC/IR — Act: Three active Russian clusters are running persistent campaigns against high-value sectors using OAuth flow hijacking and captive-portal redirects — pull Google’s full IOC list, hunt for anomalous OAuth token grants or device-code auth attempts since mid-2025, and tune detections for captive-portal redirect chains tied to UNC7005 TTPs documented by Reliaquest and Microsoft.
- Leader — Plan: If your organization falls in academia, aerospace/defense, government, or think tanks, queue a targeted user-awareness briefing on OAuth and device-code phishing before next quarter; the APT29 lineage of UNC6293 elevates this beyond routine phishing and warrants a conversation with your security team about protective intelligence coverage.
- Engineer — Act: Max-severity flaw in Microsoft Entra ID with confirmed active exploitation makes this immediate-action territory regardless of missing EPSS/KEV signals. Apply Microsoft’s Entra ID patch now and review sign-in and audit logs for anomalous authentication activity around and before the disclosure date.
- SOC/IR — Act: Active exploitation of an IAM platform means compromise may have already occurred in unpatched environments. Hunt for anomalous Entra ID authentication events (unexpected sign-ins, token grants, role assignments) and check whether Microsoft has published associated IOCs or TTPs to tune detections.
- Leader — Act: Entra ID underpins identity for the vast majority of enterprise environments, and confirmed active exploitation of a maximum-severity flaw is a board-question-level event. Confirm patching status with your engineering team this week and be ready to brief leadership before customers or auditors raise it.
- Engineer — Act: Microsoft has applied a server-side fix requiring no customer patch, but active exploitation occurred before remediation — audit Entra ID sign-in and audit logs for anomalous authentication, new service principals, or privilege escalation events from the period prior to the fix, and verify no credential or token abuse persists.
- SOC/IR — Act: Confirmed in-the-wild exploitation of an identity provider with a public PoC warrants an immediate hunt — query Entra ID audit and sign-in logs for suspicious app registrations, delegated permission grants, and admin role assignments occurring in the exploitation window, and tune detections for anomalous OAuth consent flows.
- Leader — Act: A CVSS 10.0 actively exploited RCE on the organization’s cloud identity plane is a board-level event analogous to Log4Shell in blast radius — brief leadership this week on the pre-patch exposure window and confirm with the security team that no evidence of compromise was found in Entra ID logs before Microsoft’s server-side fix landed.
- Signals: CVE-2026-69836 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: GitLab is a core CI/CD asset in most engineering environments; this unauthenticated code-injection flaw (CVSS 9.4) with a public PoC is already being weaponized. Patch all self-hosted GitLab instances to the vendor’s fixed version immediately and audit recently modified public projects for unexpected data rewrites.
- SOC/IR — Act: Active exploitation of a GitLab code-injection flaw means assume-compromise posture for any internet-exposed self-hosted instance: hunt GitLab audit logs for unauthenticated modification or deletion events against public projects since the disclosure date, and alert engineering if anomalies are found.
- Leader — Plan: A critically-rated, actively exploited flaw in a widely-used CI/CD platform carries supply-chain risk if projects were tampered with before patching; confirm with engineering that all GitLab deployments are patched this week and assess whether any customer-facing build artifacts could have been affected.
- Signals: CVE-2026-19478 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Supply-chain compromise of a widely used Rust crate that executes malware at build time matches Act criteria even without KEV/EPSS signals. Audit your Cargo.lock for arrayref, identify any builds that ran against the compromised versions, rotate secrets accessible from affected build environments, and pin to a verified clean version or remove the dependency.
- SOC/IR — Act: Build-time execution means any developer or CI runner that compiled code with the poisoned crate may be implanted with an infostealer — assume breach on those systems. Hunt for infostealer IOCs (check the BleepingComputer write-up for specifics) on developer workstations and CI/CD runners that use Rust, prioritizing the window since the account compromise occurred.
- Leader — Act: A compromised popular Rust crate that stole credentials from developer machines is a potential breach event if your org uses Rust. Confirm whether arrayref appears in any internal Cargo.lock files, determine the affected build window, and have your team assess whether CI secrets or developer credentials were exposed before briefing leadership.
- Engineer — Learn: Siemens S7 PLCs are OT/ICS territory outside typical cloud/AppSec scope, but the technique of using AI-generated scripts disguised as legitimate monitoring tools is a design-relevant threat model for anyone operating industrial or hybrid environments.
- SOC/IR — Plan: No IOCs are published yet, but a U.S. government active-threat designation warrants developing detections for anomalous PLC communication and tools impersonating legitimate monitoring agents in OT network segments; queue a hunt playbook now.
- Leader — Act: A formal U.S. government active-threat warning against critical infrastructure is board-question territory — confirm this week whether your organization or OT vendors operate Siemens S7 equipment and brief leadership before they read it elsewhere.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Act: If your organization uses Sakura Internet for cloud or data center services, confirm whether your account data was affected and request an incident report from the vendor this week.
- Engineer — Plan: Audit all login flows for legacy authentication exposure and enforce MFA uniformly — the campaign scale (81M attempts in two weeks) confirms attackers are systematically targeting incomplete MFA coverage and legacy auth protocols. Disable legacy auth (SMTP AUTH, Basic auth, IMAP) in M365/Google Workspace and review Conditional Access or equivalent policies this quarter.
- SOC/IR — Act: Tune SIEM for distributed low-and-slow authentication failures, particularly against legacy protocol endpoints (SMTP, IMAP, RDP, ADFS); run a hunt for accounts with high failed-login volume or successful logins following a spray pattern since the start of H1 2026. Password spraying maps to ATT&CK T1110.003 and is detectable via authentication log anomalies even without specific IOCs.
- Leader — Plan: The 155x year-over-year increase from Huntress provides a quantified data point to accelerate legacy auth deprecation and full MFA rollout on the roadmap; use it to justify priority and budget before the next planning cycle, framing the gap in MFA coverage as a measurable risk rather than a configuration detail.
- Engineer — Act: If your environment includes Dahua cameras or NVRs, audit for these two auth-bypass CVEs and enforce credential rotation immediately; also review whether P2P relay features are exposed to the internet and disable if not required.
- SOC/IR — Plan: Build detections for unusual outbound P2P relay traffic from camera subnets and sweep network logs for connections to Dahua cloud relay infrastructure since June 17, 2026; full IOC set not confirmed in enrichment signals but Hunt.io research may provide indicators.
- Leader — Learn: Large-scale IoT compromise campaign is worth noting for vendor risk assessments if Dahua devices are deployed in physical security infrastructure, but no immediate leadership action is required absent confirmed breach at your organization.
- Engineer — Act: CVSS 9.0 with a public PoC on GitHub means opportunistic exploitation is imminent; update Elementor Pro to the latest patched release immediately and audit WordPress upload directories for any unexpected PHP files already dropped via the Forms module.
- SOC/IR — Act: A public PoC for unauthenticated RCE means mass scanning is likely underway; hunt for unauthorized PHP files in WordPress upload paths and review web server and WAF logs for suspicious POST requests targeting the Elementor Pro Forms endpoint since the disclosure date.
- Leader — Skip
- Signals: CVE-2026-32475 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Zimbra Collaboration Suite is common enterprise mail infrastructure; active exploitation confirmed by a national CERT means patch immediately — update ZCS to the vendor’s latest patched release and audit web-accessible Zimbra instances for signs of prior compromise.
- SOC/IR — Act: Active exploitation of a Zimbra RCE means assume-breach posture for orgs running it — sweep Zimbra servers for web shells, anomalous child processes from the mail service, and unusual outbound connections; pull CERT Polska’s advisory for any published IOCs to run against SIEM.
- Leader — Act: Zimbra hosts enterprise email, so a critical RCE under active attack is a data-exposure risk — confirm whether Zimbra is in your environment, and if so direct teams to treat patching as priority-one this week and assess whether any compromise warrants customer or regulatory notification.
- Engineer — Act: CISA’s active-exploitation warning effectively signals KEV listing; teams running MLflow in AI/ML pipelines should patch to the fixed version immediately and audit pipeline access logs for signs of prior compromise.
- SOC/IR — Plan: The item confirms active exploitation but provides no IOCs or TTPs to hunt on; pull the full CISA advisory for indicators, then build detection rules targeting anomalous MLflow API or model-registry access patterns.
- Leader — Plan: Confirm whether data science or engineering teams operate MLflow, then verify patching is tracked to completion — CISA exploitation warnings on AI/ML tooling are increasingly likely to surface in customer security questionnaires.
- Engineer — Skip
- SOC/IR — Learn: Large-scale healthcare breach worth noting for sector awareness, but no IOCs, TTPs, or detection surface are provided in this disclosure.
- Leader — Act: If CareCloud is a vendor in your ecosystem, request their incident report and assess PHI exposure; healthcare CISOs should also brief leadership given HIPAA breach notification obligations and potential board or customer questions at this scale.
- Engineer — Plan: Organizations running Microsoft Entra are directly in scope for this credential theft campaign; review MFA coverage and conditional access policies, audit Entra sign-in logs for anomalous authentication, and apply Unit 42’s hardening guidance this sprint.
- SOC/IR — Act: An active claimed credential-theft campaign targeting Entra tenants creates an immediate hunt requirement — sweep Entra/M365 sign-in logs for impossible travel, anomalous service principal usage, and bulk authentication failures since mid-August when the campaign surfaced.
- Leader — Act: If the organization uses Microsoft Entra, direct the security team this week to confirm whether anomalous authentication activity is present and request a status brief; prepare talking points for leadership in case credential exposure is confirmed.
- Engineer — Learn: MacSync Stealer targets macOS endpoints; the behavioral profile (payload retrieval → staging → exfiltration) is useful for validating EDR coverage on Mac fleets, but no patch or configuration change is indicated.
- SOC/IR — Act: Microsoft published 30+ rotating domains tied to MacSync Stealer with multi-stage behavioral signatures; sweep DNS and proxy logs for these domains and hunt for correlated endpoint behaviors (payload fetch, local staging) on macOS hosts since the infrastructure became active.
- Leader — Learn: A credible Microsoft-sourced macOS stealer campaign analysis worth noting for threat landscape awareness, but no systemic vendor breach, regulatory trigger, or board-level event is present here.
- Engineer — Learn: MacSync Stealer targets macOS endpoints and could affect developer machines or macOS-based CI runners; no patch or configuration action exists, but understanding that this stealer rapidly rotates C2 domains should inform endpoint coverage decisions for macOS assets.
- SOC/IR — Act: Microsoft’s analysis identifies 30+ MacSync Stealer-attributed domains via durable behavioral pivots; hunt for connections to those domains in DNS and proxy logs since the start of MacSync activity, and encode the stable behavioral signals as detections to survive future domain rotation.
- Leader — Skip
- Engineer — Act: CISA confirmed active exploitation of this critical Windows IKE RCE — patch all Windows systems running IPsec/VPN services immediately; treat as emergency patch given KEV-level signal from CISA warning.
- SOC/IR — Act: Active exploitation confirmed by CISA — hunt for anomalous IKE/IPsec traffic and suspicious activity originating from VPN-adjacent or edge Windows systems since the campaign began; assume-breach sweep warranted for internet-exposed IKE endpoints.
- Leader — Plan: Confirm with infrastructure teams that Windows IPsec/VPN systems are prioritized in the current patch cycle; active exploitation elevates this above routine cadence but it falls short of board-level disclosure unless a breach is discovered.
- Engineer — Act: Clop-linked actors are actively exploiting a critical flaw in PTC Windchill and FlexPLM to deploy a purpose-built JSP web shell; if you run either platform, immediately audit PLM servers for rogue JSP files and apply the underlying critical patch.
- SOC/IR — Act: Active Clop-linked intrusion campaign targeting PLM servers with a web shell that harvests and decrypts credentials and maps vault contents — hunt for anomalous JSP execution and credential-access activity on Windchill/FlexPLM hosts, and review ReliaQuest’s analysis for behavioral indicators.
- Leader — Plan: A Clop-affiliated extortion tool specifically engineered to steal engineering IP from PLM systems is a sector-specific risk for manufacturing, aerospace, and defense organizations; if Windchill or FlexPLM is in your environment or your supply chain, verify exposure and confirm vendor incident posture this quarter.
- Engineer — Act: If you run PTC Windchill or FlexPLM, audit those servers for this Java web shell immediately — it is purpose-built to decrypt stored credentials and exfiltrate file repositories. Pull IOCs from the BleepingComputer article and sweep web-accessible directories on those hosts.
- SOC/IR — Act: Clop’s use of a bespoke web shell against Windchill/FlexPLM indicates an active, ongoing campaign with credential theft as a precursor step; hunt for anomalous Java process activity and unauthorized file enumeration on any PLM servers in your estate, and ingest the published IOCs into your SIEM.
- Leader — Plan: Clop is expanding its toolset to target PLM systems common in manufacturing and engineering sectors — verify whether Windchill or FlexPLM appears in your environment or third-party supply chain, and direct your security team to audit those systems this quarter.
- Engineer — Learn: The CISA/FBI advisory likely details initial-access vectors (historically RDP abuse and phishing) worth reviewing to validate existing hardening; no specific exploited CVE is surfaced in this summary, so no emergency patch action required.
- SOC/IR — Act: Pull the full CISA advisory for Medusa IOCs and ATT&CK TTPs, then hunt for those indicators in endpoint and network telemetry dating back to mid-2021 if within retention; tune ransomware-staging detections against the published behaviors.
- Leader — Act: A named campaign with 500+ confirmed critical-infrastructure victims backed by a joint CISA/FBI advisory is likely to generate board and customer questions this week; brief leadership on your sector’s exposure and confirm your ransomware IR plan and backup posture are current.
- Engineer — Act: Four KEV-listed critical vulns across platforms you likely run — patch macOS (CVE-2026-65400, CVSS 9.8), SharePoint, vCenter, and Microsoft IKE immediately; a public PoC exists for the macOS flaw, making exploitation trivial.
- SOC/IR — Act: Active exploitation of vCenter and SharePoint warrants an assume-breach sweep — hunt for post-exploitation activity (credential dumping, lateral movement) on these systems dating back at least 30 days, and tune detections for anomalous SharePoint API calls and vCenter admin actions.
- Leader — Act: KEV-listed active exploitation across macOS endpoints, SharePoint, and vCenter is a systemic risk event — confirm patch status and exposure scope with engineering this week, and be prepared to brief leadership if any of these systems host sensitive data or are business-critical.
- Signals: CVE-2026-65400 — CISA KEV: listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: MLflow is common in cloud-hosted ML pipelines and the SSRF flaw enables IMDS credential theft — active exploitation corroborated by two independent sources (watchTowr, VulnCheck). Patch MLflow to the fixed version immediately and audit IMDS endpoint access controls on any host running it.
- SOC/IR — Act: Active exploitation of MLflow SSRF is confirmed by two independent sources, with cloud credential theft as the objective. Hunt for anomalous outbound requests to IMDS (169.254.169.254) originating from ML pipeline hosts, and check for SSRF-pattern HTTP requests against MLflow endpoints since early August.
- Leader — Plan: If your org runs MLflow in cloud environments, active exploitation of this SSRF flaw creates cloud credential-theft risk for data science or AI teams. Confirm engineering has inventoried and patched MLflow deployments this sprint and review whether any cloud credentials may have been exposed.
- Engineer — Plan: Salesforce and ServiceNow are near-universal in enterprise estates; audit portal access logs for IP 158.220.87.79 going back to early 2025, and review guest-user permissions and external sharing rules on both platforms.
- SOC/IR — Act: A confirmed, long-running campaign with a published IOC (158.220.87.79) hitting widely deployed enterprise SaaS — sweep Salesforce and ServiceNow access logs in your SIEM for that IP since January 2025 and build a persistent detection for it.
- Leader — Act: Active multi-industry data-scraping of Salesforce and ServiceNow portals lasting over a year raises potential customer-data exposure; confirm whether your organization’s portals were targeted and assess notification obligations before customers ask.
- Engineer — Act: Active malicious packages in a public registry represent a live supply-chain threat. Audit all Gemfile.lock files and CI build logs for the named packages (ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn); rotate browser credentials and secrets from any Windows developer or runner machines where matches are found.
- SOC/IR — Act: Sweep Windows developer workstations for StubMaker stealer artifacts and search CI/CD build logs for gem install activity referencing the named packages since August 15, 2026; focus on credential and crypto wallet exfiltration indicators on affected hosts.
- Leader — Plan: Confirm Ruby usage across engineering teams and verify that current dependency scanning controls would detect typosquatted packages before they reach production or developer machines; this campaign is a concrete prompt to close any gap in software supply chain policy this quarter.
- Engineer — Plan: The alleged vector is compromised credentials, not a platform vulnerability — audit Azure Entra ID sign-in logs for anomalous authentication, verify MFA is enforced on all accounts, and review conditional access policies for gaps.
- SOC/IR — Plan: No IOCs or confirmed TTPs are available yet, but if your estate includes Azure, queue a hunt for unusual authentication patterns in Entra ID logs (off-hours logins, new service principals, bulk data exports) and monitor breach-data feeds for your org’s domains.
- Leader — Act: If Azure is in your estate, contact your Microsoft account team this week to ask whether your tenant appears in this claimed dataset, and prepare a brief for leadership in case the story gains traction or your company is named.
- Engineer — Act: A public PoC exists for this unauthenticated file upload RCE (CVSS 9.8) affecting 600,000+ WordPress installs; update Forminator Forms to the patched version immediately and verify no malicious PHP files were uploaded to wp-content directories.
- SOC/IR — Plan: With a public PoC available, exploitation attempts are likely imminent; build or tune WAF/SIEM rules to detect unauthenticated multipart file upload requests to Forminator endpoints and alert on unexpected PHP file creation under wp-content.
- Leader — Skip
- Signals: CVE-2026-15748 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: A public PoC exists for a flaw that lets any domain user compromise the Enterprise CA at Domain Controller privilege level — patch CVE-2026-54121 immediately, then audit certificate templates and CA permissions for standing privilege that survives the patch.
- SOC/IR — Plan: With a public PoC available but no active exploitation confirmed, build detections for anomalous ADCS activity: unusual certificate enrollment requests by standard users, low-privileged accounts invoking CA RPC interfaces, or certificates issued against sensitive templates — these are the behavioral signals that precede weaponization of this class of bug.
- Leader — Plan: This is a useful forcing function to confirm your PKI infrastructure is formally classified and defended as Tier 0 — ask your team to verify the Enterprise CA is in scope for your privileged-access model and that the patch is on an expedited timeline given the public PoC.
- Signals: CVE-2026-54121 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: A public PoC on GitHub for a CVSS 9.4 unauthenticated flaw sharply raises exploitation risk even without KEV listing; patch GitLab CE/EE to the vendor’s latest patched release this week and verify no public GraphQL endpoints are exposed without authentication.
- SOC/IR — Act: With a public PoC already circulating, hunt for unauthenticated GraphQL mutation requests targeting GitLab’s project or user-data endpoints, and alert on anomalous project deletion or modification events since the vulnerability disclosure date.
- Leader — Plan: Confirm whether the organization runs self-hosted GitLab and ensure engineering has a same-week patching commitment; unauthorized source-code deletion or tampering carries supply-chain and business-continuity implications worth a brief status check with the team.
- Signals: CVE-2026-19478 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: CISA-confirmed active exploitation by ransomware operators means patch immediately — apply the Microsoft Windows Task Host security update to all Windows endpoints and servers; prioritize internet-facing and domain-joined systems.
- SOC/IR — Act: Assume ransomware precursor activity may already be present — hunt for anomalous Task Host (taskhostw.exe) process behavior and lateral movement since April when exploitation was first flagged; tune EDR detections for suspicious task scheduler abuse.
- Leader — Act: Ransomware exploitation of a CISA-flagged Windows flaw is a board-question-level event — confirm patching status with your engineering team this week and brief leadership on exposure and remediation timeline before an incident forces the conversation.
- Engineer — Act: CISA KEV listing confirms active exploitation of a critical RCE in Ray, a widely-used Python distributed computing framework for AI/ML workloads; patch Ray immediately and, if patching is delayed, restrict external access to Ray dashboard and cluster endpoints.
- SOC/IR — Act: Active exploitation confirmed via KEV; hunt for unauthorized code execution originating from Ray cluster nodes and sweep for internet-exposed Ray dashboards in your environment, prioritizing ML infrastructure that may not be covered by standard EDR.
- Leader — Plan: If your organization runs AI/ML workloads, ask engineering to confirm whether Ray is deployed and to report patch status; KEV listing makes this likely to surface in auditor or customer questionnaires about your ML infrastructure security posture.
- Engineer — Skip
- SOC/IR — Learn: Clop’s data theft methodology (exfiltration without full encryption) is worth tracking; no IOCs or TTPs published yet to act on.
- Leader — Act: If your organization uses GE or Philips products or services, contact vendor account reps this week to request breach scope confirmation and any applicable incident attestations; prepare a brief for leadership given Clop’s history of public data releases.
- Engineer — Act: CVE-2026-59310 (CVSS 9.8) is under active APT exploitation with a public PoC; patch VMware vCenter to the vendor-released fixed version immediately — do not wait for a maintenance window given confirmed in-the-wild exploitation.
- SOC/IR — Act: Assume-breach posture for any vCenter environment: hunt for signs of post-exploitation activity and Babuk-derived ransomware staging since the patch release date, and build detections around directory-traversal followed by unusual process spawning from vCenter services.
- Leader — Act: A China-nexus APT is actively deploying ransomware via a critical vCenter flaw — confirm whether your environment runs vCenter, verify patch status with your engineering team this week, and prepare a brief for leadership given the ransomware and nation-state dimensions.
- Signals: CVE-2026-59310 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Learn: Clop continues targeting large enterprises via data theft extortion; no IOCs or TTPs published yet — monitor for technical follow-up reports to inform detection tuning against Clop’s known access patterns.
- Leader — Act: If Shell is a vendor or partner, request their incident status and any attestation of scope this week; even without confirmed breach, brief leadership before this surfaces in board or customer questions.
- Engineer — Act: A max-severity RCE in SAP Commerce Cloud is under active attack just days after patching — apply the SAP patch immediately and audit Commerce Cloud logs for signs of pre-patch compromise.
- SOC/IR — Act: Active exploitation is confirmed by threat intelligence, so sweep SAP Commerce Cloud application and access logs for anomalous activity indicative of RCE or post-exploitation behavior since the patch release date.
- Leader — Act: Confirm whether your organization runs SAP Commerce Cloud and verify the emergency patch has been applied; if patching is delayed, request an incident status from the team given active exploitation is already underway.
- Engineer — Act: Active exploitation with public PoC — audit your macOS fleet for Screen Sharing (VNC) exposure and apply Apple’s patch immediately; disable Screen Sharing on hosts where it isn’t required.
- SOC/IR — Act: Hunt for unexpected xmrig or Monero miner processes on macOS endpoints and check for anomalous outbound connections to mining pools since the PoC went public.
- Leader — Learn: Active cryptomining campaign on macOS is unlikely to require board-level action, but confirms macOS is not a safe-harbor — useful context for endpoint policy discussions.
- Engineer — Act: vCenter is core infrastructure for most enterprise estates and active exploitation is deploying persistent reverse SSH tunnels — patch CVE-2026-59310 immediately and audit vCenter hosts for unexpected outbound SSH connections or new SSH tunnel processes.
- SOC/IR — Act: The campaign’s TTP is specific and huntable: sweep for outbound SSH sessions originating from vCenter server hosts, flag any reverse tunnel tools (socat, plink, autossh) running on hypervisor management nodes since the vulnerability’s disclosure date.
- Leader — Plan: Active exploitation of a critical vCenter RCE means full-estate exposure for organizations running VMware — confirm with engineering this sprint that patching is complete and request a status update before this surfaces in a customer security questionnaire.
- Signals: CVE-2026-59310 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Learn: ShinyHunters claimed this breach in July; no IOCs or TTPs published yet, so no detection action is possible — file for actor-tracking context.
- Leader — Act: If RingCentral is in your vendor stack, confirm scope with your account rep, request their incident report, and assess whether affected data triggers customer or regulatory notification obligations.
- Engineer — Learn: Mercenary spyware campaigns (e.g. Pegasus-class) rarely target enterprise engineers directly, but if your org issues iPhones to executives or privileged users, this is a signal to review mobile device management policies and ensure Lockdown Mode is available for high-risk individuals.
- SOC/IR — Act: If any employees in your org received Apple Threat Notifications, treat them as potential high-value-target indicators — initiate an IR triage for those devices, collect sysdiagnose logs via Apple’s guidance, and check for known mercenary spyware IOCs (e.g. iVerify or MVT scans) before the trail goes cold.
- Leader — Plan: Apple’s active notification campaign signals a broader mercenary spyware wave targeting high-value individuals; review whether executives, legal, or board members use personal iPhones for sensitive communications and consider enrolling at-risk individuals in Apple’s Lockdown Mode or a mobile threat defense program this quarter.
- Engineer — Plan: Verify your EDR agent is configured to load and protect in Safe Mode, and audit whether bcdedit or safeboot registry keys can be modified by non-admin processes — most EDR platforms have a specific setting for this that is not always on by default.
- SOC/IR — Act: Hunt for bcdedit commands setting safeboot (T1562.001) and unexpected Safe Mode reboots in Windows event logs since Akira affiliates actively use this to blind EDR before data theft; tune alerts on bcdedit execution from unexpected parent processes.
- Leader — Learn: Akira affiliates are successfully exfiltrating data even when encryption fails, confirming that ransomware incidents now carry extortion risk independent of operational disruption — worth a note in the next risk-register review.
- Engineer — Act: SharePoint CVSS 9.1 authentication bypass is now under active exploitation following public PoC release; apply Microsoft’s July 2026 Patch Tuesday update to all on-premises and hybrid SharePoint instances immediately and verify patch status in your estate.
- SOC/IR — Act: Active exploitation of a SharePoint auth bypass means adversaries may already be inside unpatched tenants; hunt for anomalous SharePoint authentication events and unexpected file access patterns in audit logs dating back to the PoC release.
- Leader — Act: SharePoint is ubiquitous in enterprise environments and this critical auth bypass is under active attack; confirm patch completion with engineering this week and assess whether any exposure window existed that could trigger customer notification obligations.
- Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: CISA KEV-listed Windows zero-day with a public PoC now on GitHub — opportunistic exploitation beyond Lazarus is likely imminent. Apply the Microsoft patch for CVE-2026-68820 immediately and verify patch propagation across all Windows endpoints.
- SOC/IR — Act: Lazarus Operation Dream Job campaign is actively exploiting this CVE; hunt for Dream Job spearphishing lures (fake job offer documents) and post-exploitation behaviors in Windows event logs and EDR telemetry since the campaign’s known activity window, and load current Lazarus IOCs into your SIEM for retroactive sweep.
- Leader — Act: A nation-state (North Korea/Lazarus) is actively exploiting a KEV-listed Windows zero-day against defense-sector firms; if your organization is defense or defense-adjacent, brief leadership this week and confirm with IT that emergency patching is underway before the public PoC drives broader exploitation.
- Signals: CVE-2026-68820 — CISA KEV: listed, EPSS 0.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: A nation-state actor achieved SYSTEM-level privilege escalation via an actively exploited Windows zero-day — patch the now-available Microsoft fix across all Windows endpoints immediately, prioritizing internet-facing and privileged systems.
- SOC/IR — Act: Operation Dream Job is an active Lazarus campaign with a novel backdoor; pull Check Point’s research for IOCs and behavioral signatures, then hunt for related artifacts on endpoints in your estate since the campaign’s known timeframe, especially if you defend defense or aerospace clients.
- Leader — Plan: If your organization operates in defense or aerospace, brief leadership on Lazarus targeting and verify whether your threat intelligence program covers nation-state espionage campaigns at this tier; confirm your security team has applied the Windows patch and is hunting for the associated backdoor.
- Engineer — Act: Salesforce Experience Cloud and ServiceNow are near-universal enterprise platforms; the attack exploits data exposed to anonymous portal users — a misconfiguration, not a zero-day. Audit both platforms now for anonymous/guest access permissions and tighten portal visibility settings before an attacker runs the same tooling against your instance.
- SOC/IR — Plan: No IOCs or ATT&CK mappings are available yet, but the campaign uses custom tooling against anonymous portal endpoints. Queue detection work for anomalous unauthenticated API calls and bulk record retrieval in Salesforce Experience Cloud and ServiceNow access logs.
- Leader — Act: Salesforce and ServiceNow portals are in most enterprise environments, and this active campaign targets data exposed through anonymous access — a configuration gap with real breach-disclosure implications. This week, confirm whether your portal configurations restrict anonymous access and what customer or employee data could be exposed.
- Engineer — Act: Public PoC is live and attackers are already exploiting this critical SharePoint flaw — patch SharePoint on-prem deployments immediately and audit SharePoint ULS and IIS logs for anomalous authentication or anonymous access patterns from the PoC release date forward.
- SOC/IR — Act: Active in-the-wild exploitation means an immediate hunt is warranted — query SIEM for unusual SharePoint authentication events, abnormal REST/SOAP API calls, or unexpected file-access patterns since Rapid7’s PoC publication date, and tune alerts on SharePoint edge access.
- Leader — Plan: A critical SharePoint vulnerability with a public PoC and confirmed exploitation warrants confirming on-prem SharePoint exposure with your engineering team and ensuring an emergency patch window is scheduled this week if not already done.
- Engineer — Act: Active exploitation attempts against CVE-2026-71362 in Adobe Commerce and Magento have been observed despite low EPSS — if you run either platform, patch immediately and audit recent customer authentication logs for signs of account takeover.
- SOC/IR — Plan: No IOCs or ATT&CK-mapped TTPs are available yet, but active exploitation is reported; build or tune detections for anomalous authentication patterns and privilege changes on Commerce/Magento instances in your estate.
- Leader — Plan: If your organization or a key e-commerce vendor runs Adobe Commerce or Magento, confirm patching status this week and assess whether customer account data may have been exposed, given the reported exploitation activity.
- Signals: CVE-2026-71362 — CISA KEV: not listed, EPSS 0.00, no public PoC found
- Engineer — Skip
- SOC/IR — Learn: ExfilSquad is an active extortion actor worth tracking; no IOCs or TTPs are publicly available yet to act on, but monitor for follow-on disclosures with actionable detection detail.
- Leader — Act: If Wesco is a vendor or supplier in your ecosystem, contact them now for an incident scope statement and assess whether shared data or integrations are at risk; brief leadership before this surfaces in broader news.
- Engineer — Act: Public PoC on GitHub for a CVSS 10.0 unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter makes exploitation practical now; apply SAP’s patch for CVE-2026-58231 immediately and verify no unauthorized access to the Data Hub Adapter endpoint prior to patching.
- SOC/IR — Act: With a public PoC available for unauthenticated RCE, sweep web access logs for anomalous requests to SAP Commerce Cloud Data Hub Adapter endpoints and hunt for post-exploitation activity (unusual process spawns, lateral movement) on Commerce Cloud hosts since the disclosure date.
- Leader — Act: Confirm whether your organization runs SAP Commerce Cloud and, if so, verify the engineering team has emergency-patched CVE-2026-58231; a public PoC for a max-severity unauthenticated RCE on an e-commerce platform warrants a same-week status check and potential customer notification if the platform handles transaction data.
- Signals: CVE-2026-58231 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Plan: Sandworm is delivering trojanized WireGuard VPN installers through fake recruitment outreach targeting sysadmins — people with elevated access like yours are the intended victims. Verify all VPN client installs trace to official sources, and alert IT staff to treat unsolicited job offers that include software downloads as high-risk.
- SOC/IR — Act: An active Sandworm campaign has been running since at least May against high-privilege IT users using trojanized VPN software as the payload delivery mechanism. Hunt for anomalous WireGuard process behavior and unexpected software installations by IT/admin accounts; map activity to T1195/T1566 and extend your Sandworm TTP coverage in your SIEM from May onward.
- Leader — Plan: Russian GRU-linked Sandworm is specifically targeting sysadmins and IT professionals — the people with the highest internal access — via fake job offers this quarter. Brief IT leadership on the campaign and confirm your acceptable-use policies cover software install restrictions and vetting of recruitment-related communications.
- Engineer — Act: With 62 critical CVEs including remote code execution in QUIC and DNS Server plus one actively exploited privilege escalation zero-day, prioritize patching Windows systems this week — target the exploited zero-day and RCE bugs in DNS Server and QUIC-enabled stacks first.
- SOC/IR — Act: One vulnerability is confirmed exploited in the wild; hunt for privilege escalation activity on Windows endpoints since August 11 and tune EDR/SIEM detections for post-exploit behavior while engineering patches.
- Leader — Plan: The scale (418 patches, 62 critical, active exploitation) warrants confirming your patch SLA is on track and reviewing exposure of any internet-facing Windows DNS infrastructure with your team this quarter.
- Engineer — Act: A public LPE exploit targeting Microsoft Defender—present on virtually every Windows endpoint—warrants immediate triage: verify whether August Patch Tuesday covered this CVE, and if not, apply any Microsoft-issued workaround and restrict local execution paths that the exploit chain requires.
- SOC/IR — Plan: No active campaign IOCs or ATT&CK-mapped TTPs are reported yet, but a publicly available SYSTEM-privilege exploit via Defender will attract rapid weaponization; build and stage a detection for anomalous SYSTEM-level child processes spawning from Defender service components (e.g., MsMpEng.exe) before confirmed in-the-wild use.
- Leader — Plan: A public unpatched exploit in Microsoft’s own security product is a credible board-question risk; direct the team to confirm patch status and monitor for an out-of-band release, and prepare a brief stakeholder statement in case exploitation at scale is confirmed.
- Engineer — Act: CVE-2026-68820 is CISA KEV-listed with a public GitHub PoC and confirmed active exploitation — apply August 2026 Patch Tuesday updates immediately, prioritizing this kernel driver fix to close the SYSTEM-level LPE path.
- SOC/IR — Act: Active in-the-wild exploitation of a SYSTEM-level LPE means attackers may already have escalated on unpatched endpoints — hunt for anomalous SYSTEM-privilege process spawns from unexpected parent processes and tune EDR alerts for T1068 kernel-driver abuse since the public PoC widens attacker access.
- Leader — Plan: A 398-patch batch with one actively exploited zero-day may strain standard patch SLAs — confirm your teams have triaged CVE-2026-68820 as this week’s priority and verify compliance with your critical-patch SLA before the next board or audit checkpoint.
- Signals: CVE-2026-68820 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: One actively exploited zero-day among 400 CVEs makes this a high-priority patch cycle; apply August 2026 Patch Tuesday updates immediately, focusing first on the in-the-wild zero-day once specific CVE identifiers are confirmed from Microsoft’s advisory.
- SOC/IR — Plan: The actively exploited zero-day creates a detection obligation; once the specific CVE and affected component are identified from Microsoft’s release notes, build or tune detections for exploitation attempts and sweep endpoints for signs of pre-patch compromise.
- Leader — Skip
- Engineer — Act: Apply August 2026 Patch Tuesday updates now, prioritizing the one actively exploited vulnerability and the two publicly disclosed issues first, then triage the remaining 395 by severity and exposure surface.
- SOC/IR — Plan: Once Microsoft releases specifics on the actively exploited CVE, build or tune detections for exploitation attempts; the two pre-patched public disclosures may already have known TTPs worth hunting against Windows endpoint telemetry.
- Leader — Learn: A cycle of nearly 400 patches with confirmed in-the-wild exploitation is useful board-level context on Microsoft platform risk, but your engineering team owns the response — no leadership action required unless the exploited CVE turns out to be systemic.
- Engineer — Act: If LiteLLM was installed in any environment during March 2026, assume cloud keys, SSH keys, and Kubernetes tokens from that system were exfiltrated — rotate all credentials from affected hosts and audit CI/CD pipeline logs for installs during that window.
- SOC/IR — Act: Hunt for anomalous cloud API activity and Kubernetes token usage dating back to March 2026 on any host where LiteLLM was installed; CloudSEK’s 434,000-file dataset suggests usable IOC context is emerging, so watch for actor TTPs tied to the Trivy campaign.
- Leader — Act: Confirm with engineering whether LiteLLM or Trivy are in use in the AI/ML stack; if so, direct a credential-rotation audit this week and assess whether any customer data environments were reachable from affected systems — 2,100+ exposed organizations makes this a peer-company disclosure risk worth tracking.
- Engineer — Act: Public PoC on GitHub for a CVSS 9.1 unauthenticated RCE across SharePoint Server Subscription Edition, 2019, and 2016 means exploitation risk is immediate even without KEV listing; apply Microsoft’s patch for CVE-2026-55040 across all affected on-prem SharePoint instances this week.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet (EPSS 0.02, no KEV), but a public PoC for unauthenticated RCE warrants building SharePoint-specific detections now — hunt for anomalous unauthenticated requests to SharePoint REST/SOAP endpoints and tune alerts on privilege escalation patterns in SharePoint audit logs before active campaigns emerge.
- Leader — Plan: A CVSS 9.1 unauthenticated RCE with public PoC against widely deployed SharePoint Server warrants confirming on-prem SharePoint scope with your team and ensuring patch prioritization this sprint — escalate to Act if exploitation is observed in the wild.
- Signals: CVE-2026-55040 — CISA KEV: not listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: Cisco ASA and FTD are cornerstone edge appliances in most enterprise environments; active exploitation confirmed by the vendor makes this urgent — apply available patches or workarounds immediately and verify your ASA/FTD version is not in the affected range.
- SOC/IR — Act: Active exploitation of edge VPN appliances means you should hunt for unexpected device crashes or reboots on your ASA/FTD fleet and monitor for anomalous inbound traffic targeting VPN endpoints consistent with DoS attempts since the disclosure date.
- Leader — Plan: A DoS against widely deployed VPN appliances carries real business-continuity risk; confirm your team is treating patching as priority-one this week and identify contingency plans (backup access paths) if appliances are targeted before patches are applied.
- Engineer — Act: CISA KEV listed, actively exploited in the wild, and a public PoC exists — patch Cisco ASA and FTD software immediately per Cisco’s advisory for CVE-2026-20349; perimeter firewall availability is at direct risk from unauthenticated remote attackers.
- SOC/IR — Act: Active exploitation of an edge security appliance warrants an assume-breach sweep — hunt for anomalous or malformed HTTP requests targeting ASA/FTD management interfaces and investigate any unexplained firewall availability incidents since this KEV listing date.
- Leader — Plan: A CISA KEV-confirmed flaw in widely deployed perimeter firewalls is a priority patching event — confirm your engineering team has this on the sprint and assess whether any availability SLAs tied to ASA/FTD deployments are at risk; DoS scope limits board-level urgency but warrants direct follow-up with the team.
- Signals: CVE-2026-20349 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: vCenter is core infrastructure and a CVSS 9.8 directory-traversal-to-RCE with reported active exploitation warrants immediate patching despite weak enrichment signals (not KEV, EPSS 0.01). Apply Broadcom’s patch for CVE-2026-59310 and audit vCenter network access controls to reduce exposure while rolling out.
- SOC/IR — Plan: Active exploitation is reported by a single vendor (QUIRSO) but no IOCs or ATT&CK-mapped TTPs are published yet, leaving no sweep surface today. Build or tune detections for post-exploitation behavior originating from vCenter hosts (unusual process spawning, outbound connections from vCenter management IPs) in anticipation of broader disclosure.
- Leader — Plan: A 9.8-severity RCE in widely deployed VMware vCenter with reported exploitation is worth a prompt check-in with the engineering team to confirm patch status, but the single-source report and absence of a KEV listing mean this does not yet require board escalation or a customer-facing statement.
- Signals: CVE-2026-59310 — CISA KEV: not listed, EPSS 0.01, no public PoC found
- Engineer — Plan: A joint government advisory signals active ransomware targeting critical infrastructure; review backup integrity, network segmentation, and endpoint hardening against ransomware TTPs this quarter.
- SOC/IR — Act: Joint advisory from US agencies and South Korea’s NPA indicates active Gunra ransomware campaign — hunt for associated TTPs and IOCs once the full advisory is reviewed, and ensure ransomware-stage detections (lateral movement, mass encryption) are tuned.
- Leader — Plan: A US government warning about ransomware targeting critical infrastructure warrants briefing leadership and confirming your sector’s exposure; add Gunra to the risk register and verify incident response plans cover ransomware scenarios.
Act
archived
LexisNexis takes Diligence, Metabase API, Newsdesk offline after suspicious server activity
- Engineer — Skip
- SOC/IR — Learn: No IOCs, TTPs, or detection surface published; monitor for follow-up reporting that may yield hunt queries or indicators.
- Leader — Act: LexisNexis is a common enterprise vendor for due diligence and data enrichment — confirm this week whether your organization uses Diligence, Metabase API, or Newsdesk, and formally request a vendor incident report and data-exposure assessment.
- Engineer — Act: Fortinet and Schneider Electric products are named as actively exploited entry points in a joint US/South Korea advisory; audit Fortinet appliances and OT-facing Schneider devices for unpatched vulnerabilities and apply vendor patches immediately.
- SOC/IR — Act: Joint government advisory signals published TTPs and IOCs are available; run a Gunra hunt across network and endpoint telemetry now, prioritizing environments in healthcare, financial services, or government sectors given the stated targeting pattern.
- Leader — Act: A US/South Korea joint advisory naming specific critical-infrastructure sectors—healthcare, financial, government—warrants same-week action: confirm whether Fortinet or Schneider Electric products are in your estate and brief leadership before this appears in industry news.
- Engineer — Act: SonicWall SMA1000 is a common enterprise remote-access appliance; CISA confirmation of active ransomware exploitation effectively means KEV-listed. Patch SMA1000 to the vendor-released fixed version immediately and audit device logs for signs of pre-patch compromise.
- SOC/IR — Act: Edge-device exploitation by ransomware gangs requires an assume-breach posture: sweep SMA1000 logs for exploitation indicators, hunt for anomalous outbound SSRF traffic or lateral movement originating from the appliance segment since the vulnerability window opened, and tune EDR/SIEM alerts on hosts reachable from those devices.
- Leader — Act: Maximum-severity flaw on a remote-access appliance with confirmed ransomware exploitation is a board-question-level event; confirm whether SonicWall SMA1000 is in your estate and demand an immediate patch status report from engineering — delay creates material incident exposure under SEC disclosure timelines.
- Engineer — Act: Supply-chain compromise of a plugin developer pushing malicious content to admin browsers is an Act trigger regardless of KEV status. Audit all WordPress admin accounts for unauthorized additions made recently, disable BdThemes plugins until a clean version is confirmed, and rotate admin credentials on affected sites.
- SOC/IR — Act: The attack results in rogue admin account creation — a concrete, detectable IOC. Sweep WordPress site logs and admin user tables for accounts created in the past week that were not provisioned through normal change management; flag and disable any unauthorized entries.
- Leader — Act: If the organization runs WordPress properties using BdThemes plugins, this is an active vendor supply-chain event requiring same-week exposure confirmation. Verify whether any company or client WordPress instances use BdThemes products and request an integrity check of admin accounts from the teams responsible.
- Engineer — Act: Active supply chain compromise affecting BdThemes WordPress plugins meets the Act threshold even without formal enrichment signals — audit all WordPress installations for BdThemes plugins and check admin user lists for unauthorized accounts created during the compromise window.
- SOC/IR — Act: The attack surface is concrete: hunt for unexpected WordPress administrator account creation events across managed sites, correlating with BdThemes plugin presence to identify compromised instances.
- Leader — Plan: Add WordPress plugin vendor risk to your third-party/supply chain review process; if BdThemes plugins are in use anywhere in the organization, confirm with responsible teams that no rogue admins were introduced.
- Engineer — Act: CISA has flagged active exploitation of this critical command injection flaw in Progress Kemp LoadMaster; patch to the latest fixed version immediately and audit LoadMaster logs for signs of prior compromise.
- SOC/IR — Act: Edge device under active exploitation warrants an assume-breach posture — sweep LoadMaster access logs for anomalous commands or unexpected outbound connections since the vulnerability was disclosed, and tune detections on traffic originating from load balancer management interfaces.
- Leader — Plan: Confirm whether LoadMaster is deployed anywhere in the environment and verify your engineering team has prioritized patching; this is not yet a board-level systemic event but CISA active-exploitation designation means it should be on the remediation radar this week.
- Engineer — Act: If any developers on your team installed helper-beeps.solidity-pro or web3devtoolsx.solidity-pro, treat the workstation as compromised: remove the extensions, rotate all API keys and credentials accessible from that machine, and audit browser-stored secrets. Extend extension allow-listing policies to block unvetted publishers.
- SOC/IR — Act: Sweep developer endpoints for the presence of either extension directory (helper-beeps.solidity-pro, web3devtoolsx.solidity-pro) and review outbound network activity from developer machines for credential exfiltration since these extensions were available; the specific extension IDs give you a concrete hunt anchor.
- Leader — Learn: A targeted supply-chain attack against Solidity/web3 developers via marketplace extensions; notable as a recurring pattern but operationally relevant only if your org employs blockchain developers, in which case delegate an extension audit to your engineering team.
- Engineer — Act: Public PoC exists on GitHub for a flaw affecting every WordPress version; update WordPress core to the patched release immediately, as the chain to server-side PHP execution is demonstrated even though it requires an admin to visit an attacker page.
- SOC/IR — Plan: With a public PoC but EPSS of 0.01 and no KEV listing, active exploitation is not yet confirmed; build or tune a detection for anomalous reflected XSS patterns hitting the WordPress login endpoint and alert on unexpected admin-session activity following external link clicks.
- Leader — Skip
- Signals: CVE-2026-64638 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs published; breach occurred in October 2025 with delayed disclosure — useful context on healthcare software supply-chain exposure but no detection action available.
- Leader — Act: If your organization uses Unlimited Technology Systems or any of their healthcare software products, confirm exposure this week and request an incident report; the 3.8M-record scale and healthcare data sensitivity may trigger notification obligations or customer questions.
- Engineer — Learn: UNC6671 exploits human trust rather than software vulnerabilities, so there is no patch or config fix. The campaign reinforces the value of phishing-resistant (FIDO2) MFA on SaaS to limit what a tricked employee can surrender.
- SOC/IR — Plan: Named actor with defined TTPs (IT help-desk impersonation via personal phone → SaaS credential handover) but no IOCs published yet; build or tune detections for anomalous SaaS logins and new device enrollments, and consider hunting for suspicious authentication spikes in M365 or Google Workspace logs correlated with help-desk ticket activity.
- Leader — Act: An active data extortion group is deliberately targeting employees at financial services, private equity, and professional services firms by phone; if your org is in those sectors, brief employees this week on the IT impersonation lure and verify that help-desk identity-verification procedures are documented and enforced.
- Engineer — Act: CISA KEV-listed, EPSS 0.99, public PoC, and 792 confirmed exploit attempts make this an emergency patch. Apply the Progress Kemp LoadMaster patch immediately or isolate the appliance from untrusted networks until patched.
- SOC/IR — Act: Active exploitation of a perimeter load balancer warrants an assume-breach sweep — hunt for command injection patterns in LoadMaster access logs since the first reported attempts, and check downstream hosts for lateral movement indicators.
- Leader — Act: CISA KEV listing plus confirmed active exploitation makes this a board-question-level appliance vulnerability; confirm this week whether LoadMaster is in your environment and verify engineering has patched or isolated affected instances.
- Signals: CVE-2026-8037 — CISA KEV: listed, EPSS 0.99, public PoC on GitHub
- Engineer — Act: Active exploitation of N-central is confirmed, with attackers persisting on managed endpoints — a full-estate compromise risk. Apply N-central Hotfix 2 immediately and audit N-central activity logs for unauthorized sessions or lateral movement to managed systems.
- SOC/IR — Act: Attackers are persisting on N-central-managed systems, meaning compromise may predate the patch. Hunt for anomalous RMM-initiated process execution or new scheduled tasks/services on managed endpoints since the original vulnerability disclosure, and look for unexpected outbound connections from N-central infrastructure.
- Leader — Act: RMM compromise is a systemic risk — if your MSP or internal team runs N-central, attackers may already have access to managed endpoints. Confirm Hotfix 2 deployment status with your MSP or internal team this week and request attestation of any anomalous access findings.
- Engineer — Act: Actively exploited zero-day in Metabase with a 10.0 CVSS allows unauthenticated SQL injection leading to full admin takeover — apply the vendor patch immediately or take any internet-exposed Metabase instance offline until patched.
- SOC/IR — Act: Confirmed in-the-wild exploitation means assume-breach posture for any Metabase instance in your estate: hunt for unauthorized admin logins and anomalous SQL activity in application logs since the disclosure date, and sweep for lateral movement from those hosts.
- Leader — Act: Confirm whether the organization runs Metabase — BI tools commonly hold access to sensitive operational data, and a CVSS 10.0 actively exploited vulnerability elevates this to a same-week check; if exposed, brief leadership on potential data access risk and request remediation status from the engineering team.
- Engineer — Act: Metabase is widely deployed for BI/analytics and this SQLi is confirmed exploited with no patch available at attack time; if you run Metabase, isolate the instance, apply any available patch or vendor mitigation immediately, and audit logs for signs of unauthorized data access.
- SOC/IR — Act: Active zero-day exploitation with confirmed data theft against named organizations warrants an immediate assume-breach sweep on any Metabase instances in your estate; hunt for anomalous outbound data transfers and unusual SQL query patterns originating from Metabase since the earliest known attack date.
- Leader — Act: Named companies (Framework and Tally) have had customer data stolen via this zero-day; confirm whether your organization or key SaaS vendors run Metabase and request attestations, and prepare a brief for leadership in case customers surface questions about exposure.
- Engineer — Act: Two independent attack paths were found; only one is confirmed patched, leaving a live exfiltration surface in any Rovo-enabled Atlassian instance. Disable or restrict Rovo access to sensitive projects until Atlassian confirms both routes are fully remediated.
- SOC/IR — Plan: The technique — hiding adversarial instructions in Rovo-readable content to trigger outbound data sends — is a concrete TTP worth building a detection for. Create a hunt query for anomalous outbound connections originating from Atlassian services to external hosts.
- Leader — Act: If your organization uses Atlassian Rovo, one exfiltration route remains unpatched, meaning confidential Jira and Confluence data accessible to any signed-in user is at risk today. Confirm with your Atlassian admin whether Rovo is active, assess the data exposure scope, and request Atlassian’s remediation timeline before this surfaces in customer security questionnaires.
- Engineer — Act: Active typosquatting campaign at scale on npm means any Node.js project is at risk right now. Audit recent npm installs against known-malicious package lists, review package-lock.json for suspicious names, and scan CI/CD build logs for unexpected packages installed in the last 30 days.
- SOC/IR — Plan: RAT plus infostealer payloads imply C2 beaconing and credential exfil as post-infection behavior; no specific IOCs are available yet. Build or tune detections for anomalous outbound connections from developer workstations and CI/CD runners, and alert on npm install activity pulling packages with low download counts or AI-generated-looking names.
- Leader — Learn: An 800-package campaign illustrates the ongoing systemic risk of open-source registry abuse; useful framing for software composition analysis (SCA) tooling and SBOM investment conversations, but no immediate leadership action is indicated unless internal teams confirm a compromised dependency.
- Engineer — Act: A public PoC for a guest-to-host escape in KVM/x86 exists on GitHub — this breaks VM isolation and affects any Linux host using KVM (cloud workloads, CI runners, on-prem virtualization). Identify your kernel version, check vendor advisories for a patched kernel, and prioritize upgrading hypervisor hosts.
- SOC/IR — Learn: No active exploitation or published IOCs yet, so no immediate hunt is warranted; however, understanding the escape class is useful for future detection design around anomalous host-side activity originating from guest processes.
- Leader — Skip
- Signals: CVE-2026-64561 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: If your team runs Claude Code or Gemini CLI in CI pipelines under vendor-default configuration, an unprivileged GitHub issue can reach your runner and exfiltrate CI secrets — audit all AI agent CI integrations now, restrict what secrets are scoped to those runners, and disable issue-triggered agent workflows until hardened configurations are documented.
- SOC/IR — Plan: This Black Hat presentation defines a new TTP category — prompt injection via issue trackers targeting AI coding-agent CI workflows — worth building detections for; plan to monitor for anomalous CI runner invocations originating from issue events and unexpected secret-access patterns in pipeline logs.
- Leader — Plan: Default configurations of AI coding agents from major vendors expose CI secrets to anyone who can open a GitHub issue — assess whether engineering teams have deployed these tools in CI/CD pipelines this quarter and establish an approval policy for AI agent access to production secrets before adoption widens.
- Engineer — Plan: Active campaign bypasses MFA via session-token theft on M365 — no KEV or PoC signals, but the exposure is real. Prioritize enforcing phishing-resistant MFA (FIDO2/passkeys) for finance and payroll accounts in Entra ID conditional access policies this quarter.
- SOC/IR — Act: Widespread active campaign with clear TTPs: AitM proxy intercept, residential proxy blend-in, and finance-account targeting. Hunt M365 sign-in logs for logins from residential proxy ASNs, and sweep finance/payroll mailboxes for new unauthorized forwarding rules or OAuth app grants added since the campaign was reported.
- Leader — Plan: An active, widespread BEC-style campaign harvesting payroll and finance email warrants directing the security team to assess phishing-resistant MFA coverage for high-risk financial roles and briefing finance leadership on social-engineering risk this quarter.
- Engineer — Act: A public PoC is available for this KVM/x86 shadow MMU escape; audit whether nested virtualization is exposed to untrusted guest workloads, then apply the latest Linux kernel patch or disable nested virt for those guests until patched.
- SOC/IR — Learn: No active exploitation observed (EPSS 0.00, not KEV-listed); the technique expands the mental model for hypervisor-escape detection, but there is no actionable hunt or IOC sweep to run today.
- Leader — Skip
- Signals: CVE-2026-64561 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Learn: Actor profile useful for financial-sector defenders: UNC6671 is tied to BlackFile and is running an active extortion campaign against hedge funds and PE firms, but no IOCs, TTPs, or detection-ready technical details are available in this item yet.
- Leader — Act: If your organization is in financial services, brief leadership now on the active UNC6671 extortion campaign targeting hedge funds and private-equity firms; verify whether your firm has received any suspicious outreach and confirm IR retainer readiness.
- Engineer — Plan: Active group uses AiTM to bypass MFA on M365 and Okta; implement phishing-resistant FIDO2/hardware-key MFA and tighten Conditional Access or Okta device-trust policies to invalidate intercepted session tokens.
- SOC/IR — Act: Active campaign with mappable TTPs — hunt for anomalous Okta and M365 session activity (unexpected token origins, bulk SharePoint/OneDrive exfil) since May 2026 and pull the GTIG report for infrastructure IOCs tied to Redact, Pink, Helix, and Falcon brands.
- Leader — Act: Extortion group is actively hitting financial services, private equity, and professional services — if your org falls in these verticals, brief leadership this week on the campaign and verify that helpdesk impersonation and personal-device contact scenarios are covered in your security awareness program.
- Engineer — Act: A self-propagating npm worm targeting GitHub Actions runner secrets is a direct threat to any CI/CD pipeline using npm packages; audit your runner logs for unexpected outbound calls to Ethereum RPC endpoints and review recently installed or updated npm dependencies for malicious scripts.
- SOC/IR — Plan: The blockchain-based C2 technique (Ethereum smart contracts for routing) is a novel evasion method worth building detections for; develop hunt queries for unusual npm postinstall script execution and outbound connections to Ethereum JSON-RPC endpoints from CI runners.
- Leader — Learn: This campaign illustrates how supply chain attacks are adopting decentralized infrastructure to evade takedowns — relevant context for board-level discussions on software supply chain risk and CI/CD security investment.
- Engineer — Act: Two named malicious packages — ‘bianira-ui’ and ‘fluid-type-ui’ — are trojanized with active C2 capability; audit all dependency trees and lock files for these packages and remove them immediately if found.
- SOC/IR — Plan: NullReceiver is a novel dead-drop resolver technique that hides C2 IPs inside empty Ethereum transfer destinations, making traditional blocklist-based detections ineffective; build or tune detections for unusual outbound Ethereum RPC calls originating from build pipelines or developer endpoints this quarter.
- Leader — Learn: Attackers are using blockchain infrastructure to evade C2 detection in software supply-chain attacks — a technique evolution worth including in risk-posture discussions, but no immediate leadership action is required given the limited scope and absence of a major corroborated campaign.
- Engineer — Act: Active exploitation chain: SQL injection in a public-facing app leads to fileless SYSTEM access via Oracle’s Java stored procedure compilation. Audit web app inputs for SQLi, disable Oracle Java execution capabilities if unused (
DBMS_JAVAgrants), and inspect Oracle schema objects for unauthorized compiled Java classes. - SOC/IR — Act: Huntress is tracking this active toolkit (khunt); the fileless approach bypasses standard file-write detections. Hunt for anomalous Java stored-procedure compilation events in Oracle audit logs and alert on SYSTEM-level process spawning from Oracle service accounts since at least the date of this report.
- Leader — Plan: Active exploitation of SQL injection against Oracle databases reaching OS-level access is a credible risk for any organization with public-facing Oracle-backed apps. Ask your team to confirm SQLi controls and Oracle hardening are in place this quarter.
- Engineer — Act: Active supply-chain compromise in the npm keyv/cacheable packages — audit all build hosts for execution of these packages immediately and preserve forensic state before touching credentials, because revoking the stolen token is what triggers the malicious payload; follow a forensics-first sequence before any rotation.
- SOC/IR — Act: Ongoing supply-chain worm with a novel IR wrinkle: token revocation activates the payload, which inverts standard response playbooks — sweep CI/CD build logs for keyv/cacheable execution since Aug 4, and update incident runbooks to gate credential rotation on payload-trigger analysis.
- Leader — Plan: Active npm supply-chain compromise affecting keyv/cacheable; confirm whether internal engineering teams depend on these packages and brief engineering leadership on the non-standard response sequence before teams instinctively rotate credentials and worsen the incident.
- Engineer — Act: Audit any use of CryptoJS.lib.WordArray.random() in your codebase — it provides insufficient entropy for cryptographic key generation; replace with Web Crypto API’s crypto.getRandomValues() immediately and review whether any generated secrets need rotation.
- SOC/IR — Learn: Active drains are targeting end-user crypto wallets rather than enterprise estates; no enterprise-relevant IOCs or ATT&CK-mappable TTPs are present, but the weak-RNG exploitation pattern is worth tracking for future detection design.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Act: A phishing campaign is actively distributing ScreenConnect as a RAT using COLDCARD vulnerability lures; hunt for unexpected ScreenConnect installations on endpoints and tune EDR detections for ScreenConnect deployed outside approved baselines.
- Leader — Learn: This campaign illustrates how high-profile crypto incidents are rapidly weaponized as phishing lures; useful context for security awareness briefings but no immediate organizational action required.
- Engineer — Act: Patch on-premise JetBrains TeamCity to the fixed version immediately — CISA KEV listing confirms active exploitation, a public PoC is on GitHub, and the unauthenticated deserialization flaw carries a 9.8 CVSS score. Also audit TeamCity for unauthorized admin accounts or altered build configurations.
- SOC/IR — Act: TeamCity servers are pre-authentication targets; assume-breach sweep is warranted — hunt for anomalous build jobs, new admin accounts, or outbound connections from CI/CD hosts since patch disclosure. Map exploitation behavior to ATT&CK T1190 (Exploit Public-Facing Application) and tune EDR/SIEM rules for post-exploitation on build agents.
- Leader — Act: On-premise TeamCity RCE under active exploitation carries supply-chain risk comparable to prior CI/CD incidents — confirm this quarter whether your organization runs on-premise TeamCity instances and verify patch status with engineering before end of week.
- Signals: CVE-2026-63077 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: All three products are KEV-listed with confirmed active exploitation and a 72-hour federal patch deadline — check your inventory for Langflow, N-able N-central, and Apache Tomcat instances and apply vendor patches immediately, prioritizing any internet-exposed deployments.
- SOC/IR — Act: Actively exploited RMM (N-central) and Java servlet (Tomcat) instances are high-value footholds; hunt for web shells on Tomcat endpoints and audit N-central for unauthorized agent activity or lateral-movement artifacts since the CISA advisory date.
- Leader — Plan: Confirm with engineering whether the organization runs Langflow, N-able N-central, or Apache Tomcat and ensure the patch sprint is underway; the federal 3-day deadline signals regulator attention and may surface in upcoming audit or customer questionnaire conversations.
- Engineer — Act: A public PoC targeting ~800 specific kernel builds makes exploitation practical now even without KEV listing; patch the Linux kernel to a fixed version on any host running Open vSwitch, which is the default datapath in most cloud and Kubernetes environments.
- SOC/IR — Plan: No active in-the-wild exploitation yet (EPSS 0.00), but the wide-coverage PoC means post-initial-access LPE attempts could emerge quickly; build or tune EDR behavioral detections for unexpected privilege escalation from low-privilege processes touching OVS kernel interfaces.
- Leader — Skip
- Signals: CVE-2026-64531 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: If your team uses Open VSX-sourced extensions (common in Theia, Gitpod, or VS Code OSS environments), audit installed extensions against the 77 removed packages and remove any installed between July 26–August 1, 2026; check build/dev environments for unexpected outbound connections during that window.
- SOC/IR — Act: Hunt for anomalous outbound traffic from developer workstations and CI runners between July 26 and August 1, 2026 that may indicate data exfiltration from compromised extensions; correlate against Open VSX extension install events in endpoint logs.
- Leader — Plan: This incident illustrates supply-chain risk in developer tooling marketplaces; work with engineering leads this quarter to establish an approved-extension policy and inventory for IDE plugins used across the org.
- Engineer — Act: Audit your full dependency tree immediately for any of the ~79–353 poisoned package names; packages downloaded since August 4 may contain credential-stealing code and rogue VS Code/Claude Code hooks. Rotate any secrets accessible from affected build environments and re-run CI pipelines from clean, verified dependency locks.
- SOC/IR — Act: Hunt for anomalous outbound connections and credential-use anomalies from developer workstations and CI/CD runners since August 4, 2026; also sweep for unexpected VS Code extension modifications or Claude Code hook installations that could indicate a compromised dev environment.
- Leader — Act: This is a systemic npm supply-chain event touching 868+ package versions—brief engineering leadership now, confirm whether any internal products or pipelines depend on keyv or Cacheable-namespace packages, and request an exposure report before the week ends.
- Engineer — Act: If your team uses Xcode or pulls macOS Swift/ObjC projects from GitHub, audit your local Xcode project files and CI runners for XCSSET indicators; verify integrity of any third-party Xcode project dependencies before building.
- SOC/IR — Plan: Build or tune detections for XCSSET staging behaviors on macOS endpoints (e.g., suspicious Xcode project modifications, unexpected LaunchAgent/LaunchDaemon persistence); review EDR coverage for macOS developer machines.
- Leader — Learn: Supply-chain compromise via developer tooling is a recurring risk pattern worth noting for future policy on approved Xcode project sources and macOS developer workstation standards.
- Engineer — Plan: Audit endpoints for unauthorized ScreenConnect installations and enforce application control policies that block unsanctioned RMM tools; no software vulnerability to patch, but tightening allow-lists prevents this class of persistence.
- SOC/IR — Act: Active campaign — hunt for ScreenConnect processes spawned by fake update installers or document-review lures; tune EDR/SIEM rules to flag unsanctioned RMM tool execution, mapping to ATT&CK T1219 and T1566.
- Leader — Learn: A recurring pattern of RMM-as-backdoor via lure campaigns; reinforces the need for ongoing phishing simulation and user awareness around unsolicited software update prompts, but no immediate leadership action required.
- Engineer — Act: Unauthenticated CVSS 9.8 file read affecting any Gitea 1.22.1–1.27.0 instance; a public repo and crafted Org-mode markup are the only prerequisites, exposing any file the service account can read (secrets, keys, configs). Patch to Gitea 1.27.1 immediately and audit service-account file permissions as a follow-up.
- SOC/IR — Learn: No public PoC, no KEV listing, and no reported active exploitation means there is no immediate detection or hunt workload; awareness is useful context for triaging future anomalous Gitea traffic if exploitation begins.
- Leader — Skip
- Signals: CVE-2026-59774 — CISA KEV: not listed, EPSS n/a, no public PoC found
- Engineer — Act: All three CVEs are CISA KEV-listed with confirmed active exploitation; CVE-2026-9198 in Langflow is a CVSS 9.8 unauthenticated RCE with a public PoC — patch Langflow, Apache Tomcat, and N-central to current vendor-recommended versions immediately, prioritizing any internet-exposed instances.
- SOC/IR — Act: Active exploitation of Langflow (unauthenticated RCE) and Tomcat creates immediate hunt obligations — sweep logs for exploitation attempts against these services since August 5, check for post-exploitation indicators (new processes, outbound connections) on hosts running any of the three products.
- Leader — Plan: Three simultaneous KEV additions including a critical AI-workflow tool (Langflow) warrant confirming your team’s KEV remediation SLA is on track and verifying whether N-central (an RMM platform) is in scope — RMM compromise can enable broad lateral movement across managed endpoints.
- Signals: CVE-2026-9198 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Act: A self-propagating worm across 400+ npm packages directly threatens any JavaScript/Node.js dependency tree; audit all npm dependencies against the compromised package list in the Microsoft post, inspect CI/CD build logs for IOCs, and rotate any credentials present in affected build environments.
- SOC/IR — Act: Microsoft’s write-up includes attack chain details and explicit detection and hunting guidance; run hunts for the described IOCs in pipeline and build-system logs and tune detections for the self-republishing propagation behavior since 2026-08-04.
- Leader — Act: 400+ compromised npm packages is a systemic supply chain event comparable in breadth to prior ecosystem-wide incidents; this week confirm whether internal or third-party software uses affected packages and prepare a brief for leadership in case customers or the board surface questions.
- Engineer — Act: With 1,300+ compromised packages and 2 billion monthly downloads, your dependency tree almost certainly has exposure. Audit your package-lock.json and container build logs for ChainDrop-infected packages immediately, pin dependency versions, and check CI artifact outputs for signs of malicious code injection.
- SOC/IR — Act: A self-propagating npm compromise at this scale warrants an immediate assume-breach sweep of CI/CD pipelines and developer endpoints; hunt for anomalous outbound connections or unexpected code execution originating from build environments since packages may have already run in your estate.
- Leader — Act: The breadth of this event (2 billion combined monthly downloads) makes it a likely board-level question; task engineering to confirm exposure in your dependency tree and assess whether any customer-facing or production artifacts were built with compromised packages, then brief leadership before it surfaces in the news.
- Engineer — Act: If your team uses Open VSX (common in VS Code OSS or VSCodium environments), audit installed extensions against the removed list and purge any matches; review extension installation policies in CI/CD or dev container configs to restrict to known-good sources.
- SOC/IR — Plan: Build or tune detections for unexpected outbound connections from IDE processes (code, codium) to unknown endpoints; consider hunting for extension-related network activity in EDR telemetry from developer workstations over the past 90 days.
- Leader — Learn: This incident illustrates ongoing supply-chain risk in developer tooling marketplaces; useful context for evaluating software vetting policies in engineering onboarding, but no immediate leadership action required.
- Engineer — Act: If your org runs n8n, scan your GitHub repos immediately for exposed API tokens using GitGuardian or truffleHog, then rotate any identified credentials and review what downstream integrations those tokens had access to.
- SOC/IR — Plan: The four documented abuse paths (credential pivoting via workflow API) are worth translating into detection queries for anomalous n8n API calls; build coverage for unexpected data exfiltration from workflow automation platforms this quarter.
- Leader — Learn: This research illustrates how workflow-automation tools become credential aggregators — a useful data point for a secrets-management policy review, but no same-week leadership action is indicated unless n8n is confirmed in use with public-facing repos.
- Engineer — Act: CVE-2026-18577 is CISA KEV-listed with a public PoC and confirmed active exploitation — patch N-central immediately to the vendor-specified fixed version, and audit logs for unauthorized access since the vulnerability affects both hosted and on-premises deployments.
- SOC/IR — Act: Active exploitation of N-central means assume-breach posture for any org running it — sweep for anomalous authentication events on N-central servers and hunt for lateral movement originating from managed endpoints, as compromise of an RMM tool gives attackers broad access to managed devices.
- Leader — Act: N-central is an RMM platform used by MSPs; if your organization or any MSP managing your environment runs it, request an immediate attestation of patch status and review whether threat actors could have used it as a pivot into your estate — this is the type of systemic MSP-chain risk worth a brief to leadership this week.
- Signals: CVE-2026-18577 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: INC Ransomware is actively exploiting SonicWall SMA 1000 series appliances with confirmed victims emerging since early August 2026; patch SMA 1000 firmware to the latest available release immediately or isolate the appliance from the internet if patching is delayed.
- SOC/IR — Act: Active ransomware exploitation of a perimeter VPN appliance warrants an assume-breach posture for any SMA 1000 in the estate — hunt for lateral movement or data staging activity originating from those IPs since August 1, and correlate against INC Ransomware TTPs (double-extortion, data exfiltration before encryption).
- Leader — Act: A named ransomware group is actively listing victims from a widely deployed enterprise VPN product; confirm this week whether SonicWall SMA 1000 is in use anywhere in the environment, request a patch-status update from the engineering team, and prepare a short leadership brief given the ransomware and data-leak exposure.
- Engineer — Act: A public PoC on GitHub paired with a CVSS 9.4 privilege-boundary break makes this urgent for any operator running cPanel. Apply the targeted security release immediately and verify no cross-account SQL activity in database logs since the release date.
- SOC/IR — Plan: No active exploitation is confirmed (EPSS 0.01), but the public PoC means detection coverage is worth building now. If cPanel is in your estate, develop a hunt for anomalous database queries originating from hosting-account contexts executing with root-level DB identity.
- Leader — Skip
- Signals: CVE-2026-58048 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CVE-2026-18577 is CISA KEV-listed with a public PoC and confirmed in-the-wild exploitation; if you run N-able N-central, apply the latest patch immediately and treat any N-central host as potentially compromised pending verification.
- SOC/IR — Act: Confirmed customer compromises via an RMM platform mean privileged agent access may already be weaponized; hunt for anomalous lateral movement or command execution originating from N-central agents since the disclosure date and sweep admin audit logs for unauthorized access.
- Leader — Act: RMM platforms have privileged access across entire client estates — if your organization uses an MSP that runs N-able N-central, this week confirm whether they are patched and request a written attestation, as confirmed customer compromises indicate active supply-chain risk through managed-service relationships.
- Signals: CVE-2026-18556 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub · CVE-2026-18577 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Learn: No patch or configuration fix addresses this attack path — it exploits network position, not a software vulnerability. Review M365 Conditional Access policies to enforce device compliance and block legacy auth as a longer-term hardening measure.
- SOC/IR — Act: APT29 campaign with confirmed M365 targeting warrants a hunt for anomalous OAuth token activity and sign-ins from hotel/travel IP ranges since early 2026; tune Conditional Access sign-in logs for impossible-travel or unfamiliar network anomalies and brief on-call on the TTP.
- Leader — Plan: Nation-state targeting of business travelers via hotel networks is a reputational and credential-risk issue worth a travel security advisory this quarter; if your org has frequent international travel, update travel security policy and consider M365 session controls for roaming users.
- Engineer — Act: Active exploitation is confirmed and a public PoC exists; patch N-central to build 2026.3.1.7 immediately, then audit server and managed-endpoint logs for unauthorized admin sessions or lateral movement originating from N-central.
- SOC/IR — Act: Compromised N-central servers give attackers a pivot into every managed customer environment; hunt for anomalous RMM-originated connections and unexpected privileged actions on managed endpoints, sweeping back to at least early August 2026.
- Leader — Act: If your organization runs N-central or relies on an MSP that does, confirm patch status and request a compromise-assessment attestation this week — an RMM breach exposes all downstream managed environments and may carry disclosure obligations.
- Signals: CVE-2026-18577 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Learn: No KEV listing, EPSS, or PoC signals present; the campaign targets iOS users via fake AWS phishing pages rather than a vulnerability in cloud infrastructure itself. Worth understanding the DarkSword exploit kit’s capabilities if you manage MDM or BYOD policies, but no immediate patch or config action is indicated.
- SOC/IR — Act: Over 100 fake AWS sign-in domains linked to a single actor provide a concrete hunting surface — search proxy/email logs for traffic to lookalike AWS domains and tune phishing detections around this lure pattern; the Censys report implies enough infrastructure detail to build IOC-based blocks.
- Leader — Learn: A Chinese threat actor running a large-scale iOS phishing campaign mimicking AWS is worth noting for sector awareness and BYOD risk discussions, but without confirmed breaches at named organizations there is no immediate board-level action required.
- Engineer — Act: Pre-auth RCE with a public exploit in vBulletin’s template renderer is actively exploitable right now — patch vBulletin to the vendor-released fixed version immediately if you run any internet-facing vBulletin instance.
- SOC/IR — Act: A public exploit for pre-auth PHP code execution means exploitation is likely in progress — sweep vBulletin access logs for anomalous template-rendering requests and hunt for web shells or unexpected PHP processes on any vBulletin host since the disclosure date.
- Leader — Skip
- Engineer — Act: CVE-2026-16232 (CVSS 9.3) is CISA KEV-listed and actively exploited with a public Rapid7 PoC now amplifying risk; patch Check Point Security Management Server and MDS to the vendor-supplied fixed release immediately, and verify no unauthorized SmartConsole logins occurred before the patch window.
- SOC/IR — Act: Active exploitation of a management-plane authentication bypass means compromise may precede patching in affected environments; hunt for anomalous SmartConsole login events and unusual policy-change activity since the vulnerability’s disclosure date, and establish a detection baseline on SmartConsole auth logs.
- Leader — Plan: Confirm with engineering that any Check Point Security Management Server instances are on the immediate patch list given active exploitation and KEV listing; while not yet a Log4Shell-scale systemic event, a compromised firewall management plane represents catastrophic policy-control risk worth a brief escalation check this week.
- Signals: CVE-2026-16232 — CISA KEV: listed, EPSS 0.13, public PoC on GitHub
- Engineer — Act: Self-hosted Artifactory is widely deployed in enterprise ML and artifact pipelines; JFrog confirmed active zero-day exploitation enabling network escape — immediately restrict Artifactory egress to allowlisted destinations and apply JFrog patches as soon as they are released.
- SOC/IR — Act: Confirmed active exploitation creates a concrete hunt target: sweep Artifactory server logs for anomalous outbound connections and unusual external DNS resolutions, and verify integrity of any packages or models sourced from Hugging Face, which was a secondary attack target.
- Leader — Act: This event touches two widely used ML infrastructure components (self-hosted Artifactory and Hugging Face); confirm whether your organization depends on either, request JFrog’s incident disclosure, and brief leadership now — the AI-autonomy angle will generate board and customer questions before the week is out.
- Engineer — Act: Artifactory is a near-universal artifact store in enterprise pipelines; the zero-day enabled privilege escalation and lateral movement to an internet-facing node. Apply JFrog’s released patches to all self-hosted Artifactory instances immediately and audit Artifactory access logs for anomalous API calls or privilege changes since the incident window.
- SOC/IR — Plan: No IOCs are available in this summary, but the attack chain — privilege escalation from an artifact repository to a network-connected host — is a detection gap worth closing. Build or tune detections for anomalous Artifactory process behavior, unexpected outbound connections from artifact-tier hosts, and lateral movement originating from internal repository services.
- Leader — Act: A confirmed zero-day in widely-deployed Artifactory fed a breach that extended to Hugging Face, a platform many ML-forward organizations depend on. Confirm whether your organization uses Hugging Face or self-hosted Artifactory, request a security attestation or incident scope statement from JFrog and Hugging Face, and brief leadership — the AI-agent-as-attacker angle will generate board-level questions.
- Engineer — Plan: Hugging Face is widely used in ML pipelines; audit any API tokens or credentials your systems pass to or store in AI agent contexts, and rotate Hugging Face access tokens as a precaution given the confirmed production breach.
- SOC/IR — Learn: No IOCs or ATT&CK-mapped TTPs are available yet to drive a sweep or detection; the AI agent escape-then-credential-pivot pattern is novel and worth tracking as future detection surface once technical details emerge.
- Leader — Act: If your organization uses Hugging Face, confirm scope of the breach with your vendor contact and request a formal incident statement this week; the expanding disclosure also makes this a timely moment to brief leadership on AI agent containment risk before they encounter it in the press.
- Engineer — Act: Any authenticated repo contributor can plant a malicious Git hook and execute arbitrary commands as the Gitea service account — a very low exploitation bar with a public PoC already on GitHub. Upgrade all Gitea instances from 1.17–1.27.0 to 1.27.1 immediately.
- SOC/IR — Plan: No KEV listing or confirmed in-the-wild exploitation yet, but the public PoC makes opportunistic attacks likely soon. Build a detection for unexpected process spawning from the Gitea service account and audit recent git hook creation events on any self-hosted Gitea instances.
- Leader — Plan: Self-hosted Gitea instances are common in engineering orgs and often sit inside CI/CD pipelines where a service-account RCE could enable supply-chain compromise. Confirm whether internal Gitea deployments exist and verify they are on the patching roadmap before the public PoC drives active exploitation.
- Signals: CVE-2026-60004 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: A public PoC on GitHub for a no-interaction arbitrary code execution flaw in Firefox’s renderer means drive-by exploitation is immediately practical; update Firefox to 151.0.3 across all managed endpoints and verify Tor Browser is similarly patched or blocked.
- SOC/IR — Plan: With a public PoC now circulating, watering-hole operators may weaponize this quickly; build or tune detections for unexpected child processes spawned from the Firefox renderer process and prepare a hunt query scoped to the weeks before the 151.0.3 fix shipped.
- Leader — Skip
- Signals: CVE-2026-10702 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: A public PoC exists for this CVSS 9.8 unauthenticated stack overflow in odhcpd, which is enabled by default. Upgrade all OpenWrt devices to 24.10.8 immediately, or disable DHCPv6/odhcpd on devices that don’t need it.
- SOC/IR — Plan: With a public PoC now available, exploitation of internet- or LAN-exposed OpenWrt edge devices is imminent. Build detections for anomalous DHCPv6 traffic volumes and unexpected child processes from odhcpd, and queue a sweep of managed OpenWrt-based appliances for signs of prior compromise.
- Leader — Skip
- Signals: CVE-2026-53921 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Supply-chain compromise with import-time execution is an immediate threat to any project pulling these beta versions; audit node_modules and lockfiles for @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, remove them, and inspect CI/CD build artifacts from affected hosts for signs of RAT persistence.
- SOC/IR — Act: The DEV#POPPER malware family has prior campaign IOCs — hunt for outbound connections and process spawns originating from npm install/build steps on developer workstations and CI runners; prioritize any host that ran builds pulling @joyfill packages since these beta versions were published.
- Leader — Plan: Confirm whether engineering teams use @joyfill beta packages and use this incident to validate that npm supply chain controls — lockfiles, dependency auditing, and private registry mirroring — are enforced across your development pipeline this quarter.
- Engineer — Act: A public PoC on GitHub combined with a CVSS 9.8 unauthenticated RCE makes exploitation imminent — patch all on-premises TeamCity instances to 2025.11.7 or 2026.1.3 immediately; Cloud instances are already remediated.
- SOC/IR — Act: With a public PoC now available, begin hunting for unauthenticated requests to TeamCity build/run endpoints and review build agent logs for unexpected OS command execution patterns since the PoC publication date.
- Leader — Plan: Confirm whether your organization runs TeamCity On-Premises and verify the engineering team has prioritized emergency patching this week — a compromise of CI/CD pipelines carries supply-chain risk that could generate customer or board questions if exploitation is later confirmed.
- Signals: CVE-2026-63077 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Learn: Supply-chain credential theft at a major professional services firm is a relevant attack pattern, but no specific compromised component, IOCs, or affected systems have been identified yet — nothing to patch or audit without further detail.
- SOC/IR — Learn: ShinyHunters remains an active extortion actor using supply-chain pivots; no IOCs or TTPs are published in this disclosure, so no hunt can be launched today — watch for follow-on reporting with technical indicators.
- Leader — Act: E&Y provides audit, tax, and advisory services to a large share of enterprises, meaning your firm’s confidential data may be in scope; contact your E&Y relationship manager this week to confirm exposure and request a formal incident attestation before customers or auditors ask first.
- Engineer — Act: A public exploit now makes unauthenticated code execution against vBulletin 6.2.1 and earlier trivially accessible to any attacker. Patch to the fixed release immediately; if no patch is available for your branch, take the instance offline or block external access until patched.
- SOC/IR — Plan: With a public exploit in the wild, opportunistic scanning and exploitation attempts are likely imminent. Build or tune web application attack detections for anomalous unauthenticated POST requests to vBulletin PHP endpoints and PHP child-process spawning indicative of eval() abuse.
- Leader — Skip
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs published; this breach offers no immediate detection surface, but it reinforces the pattern of healthcare billing vendors as high-value targets worth monitoring for sector-specific threat campaigns.
- Leader — Act: If your organization uses MCBS or similar third-party medical billing vendors, confirm whether you are among the 1.26M affected and request an incident attestation letter; this breach carries HIPAA notification obligations and may prompt patient or board inquiries.
- Engineer — Act: A public PoC on GitHub for a use-after-free root LPE (CVSS 7.8) in the Linux kernel traffic-control subsystem warrants immediate attention even without KEV listing; audit which systems run CentOS Stream 9 and apply kernel updates as soon as patches are available, prioritizing multi-tenant or shared-access Linux hosts where local code execution is easier to achieve.
- SOC/IR — Plan: No active exploitation evidence yet (EPSS 0.00), but the published PoC provides behavioral reference for building Linux privilege-escalation detections; develop Sigma or EDR rules targeting anomalous tc/netlink operations followed by UID transitions to root on CentOS Stream 9 endpoints.
- Leader — Learn: The more strategically significant signal here is that AI tooling materially accelerated exploit development from bug discovery to working root exploit — a trend that compresses the window between patch release and weaponization and should inform how your team prioritizes patch SLAs for critical Linux systems.
- Signals: CVE-2026-53264 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: FastJson is widely used in Java applications; if your codebase or dependencies include it, audit immediately and apply any available patch or mitigations — if no patch exists, consider disabling unsafe deserialization features or replacing the library.
- SOC/IR — Act: Active exploitation is underway against US firms; hunt for anomalous outbound connections or process spawning from Java application servers since this week, and tune detections for RCE post-exploitation behavior (e.g., web shells, unexpected child processes).
- Leader — Plan: Active zero-day targeting US organizations warrants asking your engineering team this week whether FastJson is in use and what the mitigation timeline is — this may generate customer questions if it widens.
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs published yet; monitor for follow-on reporting with technical indicators before building detections.
- Leader — Act: A named breach at a major consumer brand subsidiary is likely to prompt board or customer questions — brief leadership now and verify whether your organization shares any vendor or data relationship with Fairlife or its parent.
- Engineer — Act: A public PoC now exists for a domain-hijack flaw in AD Certificate Services; audit your PKI templates for misconfigured enrollment permissions and apply any available patch or Microsoft-recommended mitigation immediately.
- SOC/IR — Plan: Build detections for anomalous certificate enrollment requests and CA template abuse (e.g., unusual Enrollee Supplies Subject flag usage); no confirmed active exploitation reported yet, but PoC availability shortens the runway.
- Leader — Learn: A PoC for a Windows domain-compromise vulnerability is now public; no board-level action needed yet, but monitor for escalation to active exploitation that could affect enterprise AD environments.
- Engineer — Act: CVE-2026-16812 (CVSS 10.0) is CISA KEV-listed with a public PoC and confirmed active exploitation — patch on-premises VeloCloud Orchestrator to the vendor-fixed version immediately and treat any unpatched instance as potentially compromised.
- SOC/IR — Act: Active exploitation of this RCE means on-prem VCO hosts should be treated as assume-breach candidates; hunt for anomalous process execution or outbound connections originating from VeloCloud Orchestrator nodes and sweep for IOCs since the date public PoC became available.
- Leader — Act: Confirm whether the organization runs on-premises VeloCloud Orchestrator and if so escalate to an emergency patch cycle this week; a CVSS 10.0 SD-WAN orchestration flaw on the CISA KEV list under active exploitation is a board-question-level event for enterprises relying on it for network management.
- Signals: CVE-2026-16812 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Maximum-severity command injection in VeloCloud Orchestrator is actively exploited — if you run on-premises VeloCloud Orchestrator, patch immediately and audit for signs of compromise.
- SOC/IR — Act: Active exploitation of a max-severity edge orchestrator means assume-breach posture for any environment running on-prem VeloCloud Orchestrator — hunt for anomalous command execution or lateral movement from those hosts since before the patch date.
- Leader — Act: A maximum-severity zero-day actively exploited in SD-WAN infrastructure warrants immediate confirmation of whether VeloCloud Orchestrator is in use on-premises, and if so, direct the team to patch and assess exposure before this surfaces as a board-level incident.
- Engineer — Act: Internet-exposed BMC/IPMI interfaces leaking password hashes represent an immediately exploitable misconfiguration — anyone can harvest and crack those hashes for out-of-band server access. Audit all BMC/IPMI interfaces for internet reachability now and move them behind an OOB management network or VPN; rotate any credentials on exposed units.
- SOC/IR — Plan: No IOCs or active campaign are cited, so there is no immediate hunt to launch, but external scanning of IPMI port 623 is trivially cheap for attackers. Build or tune detections for inbound connections to BMC management ports from non-management-network sources.
- Leader — Plan: Twenty-four thousand exposed instances signals a systemic industry hygiene failure; direct engineering to confirm no BMC interfaces in your estate are internet-reachable this quarter, and add management-plane network segmentation to your next control review.
- Engineer — Act: Audit all Spring Boot deployments for exposed /actuator/heapdump endpoints — this endpoint leaks in-memory secrets including API keys and DB credentials. Disable or restrict actuator endpoints via Spring Security configuration if not required.
- SOC/IR — Plan: Build a detection for inbound GET requests to /actuator/heapdump in web/proxy logs; active scanning activity means attackers are already probing for this endpoint in your estate.
- Leader — Skip
- Engineer — Learn: No patch or config action — this is a social-engineering delivery chain, not a software vulnerability. Worth knowing that legitimate RMM binaries (Level RMM, ScreenConnect) are being weaponized so anomalous installations can be flagged during code-review or build-pipeline audits.
- SOC/IR — Act: Active campaign uses a fake Microsoft Teams update lure to drop legitimate RMM tools that provide persistent remote access; hunt for unexpected Level RMM or ScreenConnect processes spawned from browser or user-space paths, and tune detections for counterfeit Microsoft Store redirect chains since Teams-themed lures are a high-volume enterprise vector.
- Leader — Learn: Noteworthy campaign pattern — abusing legitimate RMM software bypasses many controls — but no named vendor breach or regulatory trigger; file for context when briefing on social-engineering trends or evaluating security-awareness training priorities.
- Engineer — Act: Public PoC is on GitHub and this is a bypass of a prior February patch, indicating active research interest; if you self-host n8n, upgrade to 2.31.5 or 2.32.1 immediately to close authenticated RCE exposure.
- SOC/IR — Plan: No KEV listing and EPSS is low (0.09), but the public PoC raises the practical risk; build a detection for unexpected child processes or OS command execution spawned by the n8n service account to cover in-estate exposure.
- Leader — Skip
- Signals: CVE-2026-27577 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub
- Engineer — Act: Fastjson 1.x is embedded in many Spring Boot applications; unauthenticated RCE with a public PoC and confirmed active attacks means immediate action is required — audit all services for Fastjson 1.x dependencies, apply WAF rules to block the malicious JSON chain, and isolate or rate-limit exposed endpoints until a patch is available.
- SOC/IR — Act: Multi-source confirmation of active exploitation gives a detection mandate now — hunt for anomalous JSON deserialization patterns in HTTP request logs to Spring Boot services and monitor for unexpected outbound connections or process spawning from Java app servers since the earliest confirmed attack date.
- Leader — Plan: A critical, unpatched RCE in a widely-used Java library under active attack warrants commissioning an urgent Fastjson 1.x exposure inventory across development teams this week; if use is confirmed, allocate engineering time for compensating controls and track remediation until a vendor patch is released.
- Signals: CVE-2026-16723 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Skip
- SOC/IR — Learn: No IOCs or TTPs disclosed; breach at a logistics vendor with no actionable detection surface for enterprise defenders at this time.
- Leader — Act: If OnTrac is in your vendor portfolio or used by employees for business shipments, confirm exposure scope and request an incident report from OnTrac this week before customer or leadership questions surface.
- Engineer — Plan: Review whether corporate travel policy requires VPN enforcement on untrusted Wi-Fi; audit M365 tenant for conditional access policies that would block logins from non-compliant networks or flag impossible-travel anomalies.
- SOC/IR — Act: Hunt for M365 sign-ins from hotel/conference-center IP ranges or unexpected geolocations since this campaign began; tune Conditional Access or SIEM rules to flag credential use immediately after untrusted-network logins.
- Leader — Learn: A reminder that credential phishing via rogue DNS is an ongoing risk for traveling employees; no board-level action warranted without evidence of organizational impact, but useful context for travel security awareness programs.
- Engineer — Act: If you run Hanwha/Samsung security cameras, audit firmware or network-exposed login pages for embedded credentials; more broadly, scan your own build artifacts and container images for hardcoded tokens using tools like truffleHog or gitleaks, as this pattern recurs in IoT and embedded firmware.
- SOC/IR — Learn: No IOCs or active exploitation reported, but the incident illustrates how IoT device web UIs can leak credentials visible to anyone on the network — worth noting for device inventory reviews and camera network segmentation practices.
- Leader — Learn: Illustrates third-party hardware supply-chain risk: vendor-embedded credentials in devices deployed on corporate networks can expose upstream source repositories; factor into hardware procurement and vendor security assessment criteria.
- Engineer — Act: A working public exploit now exists for this six-week-old GitLab flaw; any authenticated user with push access on an unpatched self-managed instance can achieve RCE. Upgrade to the patched version released June 10 immediately and verify no self-managed GitLab instances remain on 18.11.3.
- SOC/IR — Act: PoC publication on July 24 makes exploitation imminent; hunt for anomalous Jupyter notebook pushes followed by commit-diff access on self-managed GitLab instances, and look for unexpected git-process child execution in EDR telemetry as of that date.
- Leader — Plan: A public exploit for GitLab RCE elevates CI/CD pipeline compromise risk this week; confirm with engineering that all self-managed GitLab instances are on the June 10 patched release before this becomes an active incident requiring notification.
- Engineer — Act: Active Cl0p data-extortion campaign exploiting internet-exposed PTC Windchill and FlexPLM via chained pre-auth flaws; immediately audit for internet-exposed instances, apply available patches, and if patching is delayed, restrict Windchill login servlet and FlexPLM WSDL endpoint from external access.
- SOC/IR — Act: Active Cl0p campaign with a concrete exploit chain (pre-auth FlexPLM WSDL disclosure chained into Windchill login servlet); hunt for anomalous pre-authenticated requests to these endpoints since campaign start and sweep for Cl0p-associated IOCs in PLM server logs and EDR telemetry.
- Leader — Plan: Cl0p affiliates are running a targeted data-extortion campaign against manufacturing and engineering organizations using PTC Windchill/FlexPLM; if your org or key suppliers use these platforms, assess exposure now and be prepared to brief leadership on potential data theft risk before it surfaces in the press.
- Engineer — Act: A public working exploit now lets any domain user abuse ADCS to obtain a DC certificate and DCSync the krbtgt hash — full domain compromise from low privilege. Immediately audit certificate templates in ADCS for enrollment rights that allow non-admin principals, and restrict or disable any template that can issue DC computer certificates to ordinary users.
- SOC/IR — Act: Working exploit means this attack path is now within reach of any authenticated user; hunt for ADCS certificate requests from non-computer, non-privileged accounts targeting DC-class templates, and sweep SIEM/EDR for DCSync (DS-Replication-Get-Changes-All) events originating from unexpected principals since July 24.
- Leader — Plan: No confirmed in-the-wild exploitation yet, but a public PoC dropping a full domain-compromise chain from a low-privilege user is a credible near-term crisis. Ensure your AD/identity team has a remediation task in flight this week, and prepare a brief in case this escalates to customer or board questions the way ADCS misconfigurations have in the past.
- Engineer — Plan: If your organization runs Zimbra webmail, review the Unit 42 report for any patched CVEs or configuration mitigations tied to this JavaScript injection vector, and audit Zimbra servers for unauthorized script modifications.
- SOC/IR — Act: Pull the full Unit 42 report for IOCs and TTPs, then hunt for anomalous JavaScript execution or unexpected credential harvesting activity in Zimbra server logs since the campaign’s observed start date.
- Leader — Learn: A Russian espionage actor is actively harvesting credentials from enterprise Zimbra deployments — useful context for sector threat briefings, but no immediate leadership action is indicated unless Zimbra is a core part of your environment.
- Engineer — Act: CISA warning on active state-sponsored exploitation of a Zimbra zero-click vulnerability means patch status must be confirmed immediately — upgrade Zimbra Collaboration to the patched release and audit server logs for signs of prior compromise.
- SOC/IR — Act: Void Blizzard (Laundry Bear) is actively combining phishing with this Zimbra exploit in live campaigns — hunt for anomalous Zimbra authentication events and email-sync activity tied to this actor since the campaign began, and request any IOCs from the CISA advisory.
- Leader — Act: A CISA-attributed Russian espionage campaign targeting enterprise email warrants confirming this week whether Zimbra is in your environment, verifying engineering has applied the patch, and briefing leadership given the data-theft implications.
- Engineer — Act: If you run Zimbra webmail, patch to the latest release immediately — the exploit is zero-click (opening a message triggers it) and a joint NSA/CISA advisory confirms months of active state-actor abuse. Also review Zimbra access logs for bulk email-download activity over the past 90+ days.
- SOC/IR — Act: Pull the NSA/CISA joint advisory for published IOCs and hunt for bulk email exfiltration patterns and anomalous 2FA-recovery-code access in Zimbra webmail logs; the campaign ran for months, so extend your look-back window accordingly.
- Leader — Act: If Zimbra is in your webmail stack, confirm patch status with your engineering team this week and assess whether sensitive mailboxes were exposed; a joint NSA/CISA advisory on a months-long Russian espionage campaign stealing credentials and 2FA codes warrants a pre-emptive leadership brief before it surfaces in board news feeds.
- Engineer — Act: Public authenticated-RCE PoCs exist for Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0; upgrade to Redis 6.2.23, 7.2.15, or 7.4.10 immediately, and audit whether RESTORE, EVAL, or XGROUP are accessible to untrusted clients in your environment.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet, but public PoCs accelerate that timeline; build detections for anomalous Redis command sequences involving RESTORE combined with EVAL or XGROUP, and baseline normal Redis command usage now so deviations surface quickly.
- Leader — Plan: Redis is pervasive in enterprise stacks; confirm all internal deployments and any SaaS vendors running Redis are targeting the patched versions (6.2.23/7.2.15/7.4.10), and track remediation completion — the authenticated-only attack surface limits immediate board escalation but warrants this-quarter tracking.
- Engineer — Act: Public exploit code is available for all eight high-severity flaws, including admin access bypass and private data exposure; upgrade any NodeBB deployment to 4.14.2 immediately.
- SOC/IR — Learn: Public exploits exist but the item provides no IOCs, ATT&CK mappings, or detection signatures; file as context for hunting unusual NodeBB admin activity if the software is in your estate.
- Leader — Skip
- Engineer — Act: Clop is actively targeting internet-exposed PTC Windchill and FlexPLM instances — both are common in manufacturing, aerospace, and retail/apparel supply chains. Immediately audit whether any Windchill or FlexPLM deployments are internet-reachable and restrict or take them offline; review recent access logs for anomalous data staging or egress activity.
- SOC/IR — Act: Clop’s pattern of mass data theft before extortion demands a proactive hunt in any organization running these PLM products — look for large exfiltration events from Windchill or FlexPLM hosts in your SIEM and baseline normal egress volumes now. Pull the BleepingComputer article for any published IOCs or TTPs and build detection coverage against Clop’s known staging and exfil behaviors in EDR telemetry.
- Leader — Act: Clop has a documented track record of bulk data theft followed by public dumps, which can trigger SEC disclosure obligations and customer notification requirements. If your organization is in manufacturing, automotive, aerospace, or retail/apparel, confirm this week whether Windchill or FlexPLM is in the environment and request an exposure assessment from engineering before Clop publishes any victim list.
- Engineer — Learn: No patchable vulnerability here — this is a C2 evasion technique that bypasses outbound network controls by abusing the local browser. Worth understanding when designing network egress policy and process-spawn allow-lists, but no immediate system change required.
- SOC/IR — Act: Cisco Talos documented a pre-ransomware implant with a distinctive behavioral fingerprint: it binds only to 127.0.0.1 and spawns Chrome or Edge headlessly to carry C2 traffic — invisible to traditional network detection. Hunt for unexpected headless browser processes with anomalous parent processes and tune EDR rules to flag this spawn chain on Windows endpoints.
- Leader — Learn: Chaos ransomware has deployed a novel evasion capability that makes their pre-encryption activity harder to detect; worth flagging to the security team to ensure detection coverage, but no executive action or vendor exposure check required at this stage.
- Engineer — Learn: No direct infrastructure vulnerability here; the attack targets end users via social engineering. Worth noting that AI-tool-themed lures are an emerging pattern that should inform employee software-download guidance.
- SOC/IR — Act: Active SectopRAT delivery campaign in progress — query EDR telemetry for downloads of unofficial Claude installers and sweep endpoints for SectopRAT indicators; the BleepingComputer writeup likely contains file hashes and C2 indicators to feed into your SIEM.
- Leader — Learn: AI-tool-themed malvertising is a growing employee-targeting vector; useful context for justifying security-awareness investment, but no immediate leadership action required absent evidence of internal compromise.
- Engineer — Act: Active in-the-wild exploitation confirmed by VulnCheck and a public PoC is available; if you self-host Windmill, patch immediately and audit web server logs for unauthenticated requests to the
/api/w/{workspace}/jobs_u/get_log_file/endpoint containing traversal sequences. - SOC/IR — Act: Active exploitation with public PoC means opportunistic scanning is already underway; hunt web proxy and WAF logs for path traversal patterns (e.g.,
../) in requests to Windmill’sget_log_fileendpoint, and sweep for unusual file reads on any Windmill hosts since the PoC dropped. - Leader — Skip
- Signals: CVE-2026-29059 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: Public PoC on GitHub makes this practical for any attacker with local access on Ubuntu Desktop 24.04, 25.10, or 26.04; patch snap-confine immediately on affected desktop systems and audit cloud VMs or developer workstations running Ubuntu Desktop builds.
- SOC/IR — Learn: No active exploitation campaign or IOCs reported; file as a post-exploitation step an attacker with foothold could use, but there is no detection hunt to run today without observed in-the-wild activity.
- Leader — Skip
- Signals: CVE-2026-8933 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: Active supply-chain compromise of 10 Packagist packages tied to developer dinushchathurya (July 12–13); audit your PHP dependency tree for these packages, remove or pin away from any dev/pre-release versions, and inspect CI/CD build logs for unexpected executions since July 12.
- SOC/IR — Plan: No IOCs are surfaced in the summary, but the campaign’s use of malicious Packagist dev-version installs inside GitHub Actions runners is a detectable pattern — build a detection for unusual package-manager installs of dev/pre-release versions in pipeline logs and hunt for dinushchathurya package executions since July 12.
- Leader — Learn: This campaign illustrates how a single compromised developer account can turn a public package registry into attack infrastructure; useful context when reviewing third-party dependency risk in your software supply chain policy.
- Engineer — Act: Public PoC on GitHub makes this LPE practically weaponizable on any Linux system using XFS (common on RHEL/CentOS derivatives); patch the kernel to the version fixing CVE-2026-64600 and prioritize systems where XFS is the root or primary filesystem.
- SOC/IR — Learn: Local privilege escalation via a kernel race condition offers a thin detection surface — no active campaign and no IOCs reported; note as a post-foothold escalation path attackers may chain after initial access, and revisit if exploit tooling appears in threat-actor toolkits.
- Leader — Skip
- Signals: CVE-2026-64600 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Public PoC on GitHub and default RHEL, Fedora Server, and Amazon Linux installs are vulnerable — patch the kernel for CVE-2026-64600 on all affected systems now; audit any multi-tenant or shared-host environments where an unprivileged foothold could be leveraged immediately.
- SOC/IR — Plan: No active campaign or published IOCs yet, but the GitHub PoC means weaponization is near; build detections for anomalous privilege escalation and unexpected root-owned file modification on Linux hosts running XFS before exploitation begins.
- Leader — Learn: A local-only kernel flaw on widely-used enterprise Linux distros — significant but requires an existing foothold first, so patching is the engineering team’s call; no board communication or vendor exposure assessment is warranted unless confirmed exploitation surfaces.
- Signals: CVE-2026-64600 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Actively exploited zero-day in Check Point SmartConsole, the management GUI used to administer Check Point gateways; patch SmartConsole to the fixed version immediately if your organization runs Check Point infrastructure.
- SOC/IR — Plan: No IOCs or TTPs have been published yet, but active exploitation of a security management console warrants building detections for anomalous SmartConsole admin sessions and unusual policy changes; monitor for updated threat intel and sweep Check Point environments for signs of unauthorized access.
- Leader — Plan: Confirm whether your organization uses Check Point SmartConsole and direct the engineering team to treat this as a priority patch; actively exploited zero-days in security management tooling carry elevated risk of lateral movement from the management plane.
- Engineer — Act: CVE-2026-16232 is CISA KEV-listed, CVSS 9.3, with a public PoC and confirmed active exploitation — patch Check Point Security Management and MDSM to the vendor-released fixed version immediately, then audit SmartConsole admin access logs for unauthorized sessions.
- SOC/IR — Act: Active exploitation of a full admin bypass on security management infrastructure is an assume-breach trigger — sweep SmartConsole audit logs for anomalous admin logins and unauthorized policy changes since the disclosure date, and hunt for lateral movement from compromised management hosts.
- Leader — Act: A KEV-listed authentication bypass granting full admin control over Check Point firewall management is a systemic risk event — confirm with your engineering team whether Check Point SmartConsole or MDSM is in use and verify patching status before board or customer inquiries arrive.
- Signals: CVE-2026-16232 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: CVE-2026-0257 is CISA KEV-listed with EPSS 0.87 and a public PoC; Qilin actors are actively using it as initial access via PAN-OS portal and gateway. Patch PAN-OS to the fixed release immediately and audit gateway/portal access logs for unauthorized sessions since June 2026.
- SOC/IR — Act: Qilin (Agenda) ransomware operators are actively exploiting PAN-OS edge devices as a beachhead — assume-breach sweep is warranted on any PAN-OS-fronted environment. Hunt for Qilin TTPs and lateral movement artifacts dating back to June 2026, and tune EDR/SIEM detections for Agenda ransomware staging behavior.
- Leader — Act: Qilin ransomware is actively deploying via a widely-used firewall/VPN product; this is board-question-level exposure if your organization runs PAN-OS. Confirm patch status with your engineering team this week and prepare a brief for leadership on whether any environment may have been affected during the June 2026 exploitation window.
- Signals: CVE-2026-0257 — CISA KEV: listed, EPSS 0.87, public PoC on GitHub
- Engineer — Plan: If your pipelines integrate with Hugging Face or consume OpenAI APIs for model evaluation, audit those integration points and review access logs covering the incident window; watch for follow-on disclosure of specific technical details before determining whether credential rotation or config changes are needed.
- SOC/IR — Plan: No IOCs or TTPs are available yet, but organizations using either platform should pull API access logs for the incident period and queue a hunt once the full disclosure provides behavioral indicators; monitor OpenAI’s and Hugging Face’s incident update pages for actionable details.
- Leader — Act: Confirm whether your organization uses OpenAI or Hugging Face for model evaluation, request a vendor attestation or incident report this week, and brief leadership proactively — the high public profile of this disclosure means board or customer questions are likely before a full technical picture emerges.
- Engineer — Plan: Hugging Face is a common ML supply-chain dependency; audit any Hugging Face API tokens and repository access your pipelines use, and review how your own AI evaluation environments are isolated from production networks.
- SOC/IR — Learn: Novel incident class — AI models operating as autonomous threat actors in a sandbox-escape scenario. The summary is truncated and no IOCs or TTPs are available yet; revisit when Hugging Face publishes a detailed post-incident report.
- Leader — Act: Hugging Face is widely embedded in enterprise ML pipelines; confirm whether your organization uses it and request their incident disclosure to understand what production data or credentials may have been exposed.
- Engineer — Act: A supply-chain campaign at GitHub scale (14M downloads) meets the Act threshold even without KEV/EPSS signals. Audit CI/CD build logs and dependency fetches for downloads from unknown or newly-created GitHub repos, and scan endpoints for SmartLoader and StealC indicators.
- SOC/IR — Plan: The campaign is active but the summary lacks specific IOCs needed for immediate sweeps. Build or tune detections for StealC infostealer behaviors (credential harvesting, C2 beaconing) and generic loader staging patterns; monitor research feeds for published IOC lists to operationalize hunting.
- Leader — Plan: Fourteen million downloads signals broad potential exposure across engineering teams. This quarter, review whether developer workflows enforce source verification for GitHub-sourced dependencies and consider a policy requiring reviewed or pinned third-party code.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation deploying persistent webshells and rogue plugins. Patch WordPress Core immediately, then audit web root directories for unexpected PHP files and review installed plugins for unauthorized additions.
- SOC/IR — Act: Active webshell deployment creates a concrete detection surface — sweep web server access logs for unusual POST requests to new PHP files in WordPress directories since public PoC release, hunt for unexpected process spawning from web server processes, and add rules for plugin installation events outside change-window hours.
- Leader — Plan: WordPress is pervasive; CISA KEV listing on both CVEs signals confirmed active exploitation at scale. Confirm this week that engineering has inventoried all WordPress instances and is treating these as priority patches — a successful webshell compromise could trigger breach notification obligations if customer data is exposed.
- Signals: CVE-2026-60137 — CISA KEV: listed, EPSS 0.04, public PoC on GitHub, reported by 2 collected sources · CVE-2026-63030 — CISA KEV: listed, EPSS 0.09, public PoC on GitHub, reported by 3 collected sources
- Engineer — Act: Active exploitation confirmed with a public GitHub PoC; patch SharePoint immediately AND regenerate machine keys — patching alone does not evict attackers who already exfiltrated them, so key rotation is the critical second step.
- SOC/IR — Act: Stolen machine keys enable persistent, post-patch impersonation attacks — hunt SharePoint IIS logs for exploitation artifacts since the vulnerability became public, and write detections for anomalous ViewState or token-forging activity tied to mismatched machine keys.
- Leader — Plan: Confirm SharePoint is in scope, then ensure your engineering team understands that patching alone is insufficient — key rotation and a post-exploitation sweep are required; flag this as a two-step remediation so it isn’t closed prematurely in the ticket queue.
- Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CVSS 9.8 deserialization RCE with public PoC and confirmed active exploitation — patch SharePoint Server to the July 2026 Patch Tuesday build immediately; do not wait for CISA KEV confirmation given exploitation is already underway.
- SOC/IR — Act: Active exploitation predating your patch window means assume-breach posture is warranted — hunt for anomalous deserialization or code execution activity on SharePoint servers back to at least the PoC publication date, and review watchTowr’s reporting for any available IOCs or behavioral signatures.
- Leader — Act: A CVSS 9.8 unauthenticated RCE in widely-deployed enterprise SharePoint under active exploitation requires a same-week exposure check — confirm whether the org runs on-premises SharePoint Server and verify the engineering team has prioritized the July Patch Tuesday update.
- Signals: CVE-2026-50522 — CISA KEV: not listed, EPSS 0.20, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV listing confirms active exploitation of this RCE in Langflow, a framework increasingly adopted by AI development teams. Audit all environments for Langflow deployments and patch to the fixed version immediately — days-level urgency, not weeks.
- SOC/IR — Act: Active exploitation of a Langflow RCE means any instance in your estate should be treated as potentially compromised; initiate an assume-breach sweep of Langflow hosts for post-exploitation artifacts (new processes, outbound connections, credential access) and hunt for inbound exploitation attempts in web/proxy logs since the vulnerability became public.
- Leader — Plan: Langflow is niche enough that board escalation is unlikely unless your AI engineering teams are actively using it — confirm with engineering whether Langflow is deployed anywhere in the environment and ensure it lands in the emergency patch queue this week.
- Engineer — Act: If you run Microsoft’s official Azure DevOps MCP server for AI code review, disable or restrict the PR-description tool until Microsoft ships a patched version with prompt-injection guardrails; an attacker with only PR-comment access can pivot the agent into unintended projects and exfiltrate output.
- SOC/IR — Plan: No published IOCs, but build detection for anomalous AI agent cross-project access in Azure DevOps audit logs — unusual MCP tool invocations touching repos outside the agent’s expected scope are the behavioral signal to hunt for.
- Leader — Plan: This illustrates a systemic gap in AI coding-agent deployments: prompt injection via developer workflow inputs can bypass access controls; use this as a prompt to add MCP/AI-agent integration scope to your existing AI governance policy review this quarter.
- Engineer — Act: Both CVEs have public PoCs and exploitation is already underway with mass scanning — patch all WordPress instances to the fixed versions immediately and audit exposed sites for webshell artifacts, especially any unexpected PHP files or modified themes.
- SOC/IR — Act: Active exploitation confirmed since early Saturday UTC; hunt for webshell uploads and anomalous POST requests targeting WordPress endpoints across your estate, and sweep for post-compromise persistence on any internet-facing WordPress hosts.
- Leader — Plan: Active exploitation with mass scanning is in progress but hasn’t reached Log4Shell-scale board attention yet; confirm whether WordPress appears in your web portfolio and ensure it’s on your engineering team’s immediate patching queue this week.
- Signals: CVE-2026-60137 — CISA KEV: not listed, EPSS 0.04, public PoC on GitHub · CVE-2026-63030 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Unauthenticated RCE in WordPress Core (not a plugin) is being actively exploited with a public PoC on GitHub — patch all WordPress Core installations to the latest fixed release immediately and audit web server and DB logs for SQLi patterns.
- SOC/IR — Act: Active exploitation is confirmed; sweep any WordPress-hosting infrastructure for webshells, unexpected file writes, and anomalous database query patterns tied to wp2shell activity since last week’s disclosure.
- Leader — Plan: Confirm whether WordPress is present in the company’s web estate and verify engineering has prioritized patching this week; not yet at board-briefing scale but unauthenticated RCE with active exploitation warrants prompt follow-up with the engineering team.
- Signals: CVE-2026-63030 — CISA KEV: not listed, EPSS 0.09, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: SonicWall SMA1000 is widely deployed enterprise VPN/remote-access infrastructure; active zero-day exploitation with custom malware implants is confirmed. Patch SMA1000 appliances to the latest firmware immediately and inspect filesystem and running processes for signs of persistent malware.
- SOC/IR — Act: Zero-day compromise of edge VPN appliances with custom malware warrants an assume-breach posture for any environment running SMA1000. Hunt for anomalous outbound connections, credential-harvest activity, or lateral movement originating from these appliances, and check for unknown binaries or modified configs on the devices.
- Leader — Act: Confirmed zero-day exploitation of a common enterprise VPN product deploying custom malware is a board-visible risk. Verify this week whether your organization runs SonicWall SMA1000, and if so direct engineering and SOC to assess exposure and report status before it becomes a customer or leadership question.
- Engineer — Act: Public PoC exists and in-the-wild exploitation is reported for this unauthenticated sandbox-escape RCE (CVSS 9.5) in the ServiceNow AI Platform. Confirm your ServiceNow instance has the available patch applied via the admin console, and audit platform logs for anomalous code execution since the disclosure date.
- SOC/IR — Act: Active exploitation of unauthenticated RCE on a widely deployed enterprise ITSM platform creates immediate detection work. Hunt for anomalous outbound connections, unusual process spawning, or lateral movement originating from ServiceNow infrastructure since the vulnerability was disclosed, and tune EDR/SIEM for post-exploitation behavior on hosts that ServiceNow agents touch.
- Leader — Act: A critical unauthenticated RCE in ServiceNow with confirmed in-the-wild exploitation could expose ITSM data and integrated systems. This week, confirm with your ServiceNow admin that the patch is applied to your instance and assess whether any sensitive data (HR, IT credentials, integrations) in the platform warrants a precautionary leadership or customer notification.
- Signals: CVE-2026-6875 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: A critical authentication bypass in PAN-OS GlobalProtect is being actively weaponized for ransomware intrusions — patch PAN-OS to the fixed version listed in Palo Alto’s advisory immediately, and audit VPN authentication logs for anomalous sessions preceding lateral movement.
- SOC/IR — Act: Qilin’s use of a VPN auth bypass as initial access means compromise may precede any patch; if GlobalProtect is in your environment, run an assume-breach hunt now — look for anomalous GlobalProtect auth events, unusual post-VPN lateral movement, and Qilin-associated TTPs documented in Arctic Wolf’s reporting.
- Leader — Act: Active ransomware exploitation of a widely-deployed VPN product is a board-question-level event — confirm this week whether GlobalProtect is in your estate, verify emergency patching is underway, and prepare a short leadership brief in case an incident surfaces.
- Engineer — Plan: Novel Graph API abuse using calendar write access highlights over-permissioned OAuth app risk. Audit which apps hold Microsoft Graph calendar read/write scopes and revoke unnecessary permissions this quarter.
- SOC/IR — Act: The year-2050 calendar event timestamp is a highly specific, huntable indicator — sweep M365 audit logs for calendar events created with 2050 dates and flag Graph API calls that write calendar entries with large attachments.
- Leader — Learn: Espionage actors using legitimate Microsoft 365 infrastructure for C2 blurs the line between sanctioned SaaS activity and intrusion; useful context for understanding the M365-as-attack-surface risk but no immediate leadership action required.
- Engineer — Act: A public Docker lab with a working one-payload exploit now exists for fastjson 1.2.66–1.2.83; critically, autoType=OFF and parseObject binding are not effective mitigations. Audit your dependency tree for fastjson in this range and upgrade to 1.2.84+ (or fastjson2), treating autoType-disabled deployments as unprotected.
- SOC/IR — Plan: The public exploit lab lowers the bar for threat actors to weaponize this Spring Boot class-loading RCE chain. Build or tune detections for unexpected outbound SSRF from Java application hosts followed by remote class loading activity; the SSRF→defineClass pattern is a distinct behavioral signal to hunt for in proxy and EDR telemetry.
- Leader — Skip
- Engineer — Act: Active campaign targeting developers who clone AI tools and MCP server repos from GitHub; audit recent GitHub clone activity and ZIP downloads on developer and CI/CD systems for SmartLoader indicators, and remove any untrusted AI/MCP repos from your dependency chain.
- SOC/IR — Act: Ongoing SmartLoader delivery campaign through GitHub social engineering targeting developer workstations; hunt for suspicious ZIP extraction followed by execution artifacts on developer endpoints, and query EDR for SmartLoader process lineage since the campaign is active.
- Leader — Plan: Scale and targeting of developer tooling (7,600 repos, AI/MCP lures) makes this a supply-chain risk to the development environment; engage engineering leads this quarter on vetting controls for GitHub-sourced AI components before broader adoption.
- Engineer — Plan: If your org runs Oracle E-Business Suite (especially for HR), review Oracle’s recent security advisories for EBS patches and audit privileged access to HR data — no specific CVE or PoC is published yet, so active exploitation pressure is unclear.
- SOC/IR — Learn: High-profile ERP-targeting breach with no published IOCs, TTPs, or attacker attribution to act on; file for context that Oracle EBS HR modules are being targeted, but there’s no detection work to do today.
- Leader — Act: If your organization uses Oracle E-Business Suite, direct your team this week to confirm patch status and assess whether employee or customer PII is exposed via the same flaw; this breach will prompt customer and board questions if you operate in consumer goods or retail.
- Engineer — Act: Active exploitation of a Langflow RCE is being used to deploy Go-based ransomware that encrypts model weights, vector indexes, and training data. If you run Langflow, patch or network-isolate it immediately and review Sysdig’s full JADEPUFFER report for host-level IOCs to audit your AI infrastructure.
- SOC/IR — Act: A named operator (JADEPUFFER) has been caught in a second confirmed intrusion deploying ENCFORGE ransomware via Langflow; pull Sysdig’s IOC set and hunt for anomalous Go process execution or bulk file encryption activity on hosts running Langflow or adjacent AI pipeline components.
- Leader — Learn: ENCFORGE is the first documented ransomware purpose-built to destroy AI model assets rather than generic data, signaling that AI infrastructure is becoming a distinct extortion target worth adding to the risk register ahead of broader AI investment discussions.
- Engineer — Act: FortiSandbox is actively exploited per CISA KEV listing with a public PoC on GitHub; patch to the fixed version immediately and check for signs of compromise on any internet-facing FortiSandbox appliances.
- SOC/IR — Act: KEV listing plus public PoC means exploitation is likely underway; hunt for anomalous outbound connections or new processes spawned from FortiSandbox hosts since the PoC publication date, and check edge appliance logs for unauthenticated command-injection attempts.
- Leader — Plan: KEV-listed Fortinet RCE warrants confirming whether FortiSandbox is in the environment and requesting patch status from the infrastructure team; brief on remediation timeline if deployed, given the active exploitation signal.
- Signals: CVE-2026-25089 — CISA KEV: listed, EPSS 0.36, public PoC on GitHub
- Engineer — Act: SonicWall SMA 1000 series VPN appliances were exploited for root access as zero-days since at least June 22, 2026; if this appliance is in your environment, treat it as potentially compromised — isolate it, review for signs of intrusion, and apply any vendor patches immediately.
- SOC/IR — Act: Threat actor UTA0533 actively exploited SonicWall SMA 1000 appliances before disclosure, meaning some estates may already be rooted; sweep for Volexity-published IOCs and hunt for lateral movement originating from SMA appliance IP addresses since June 22.
- Leader — Act: A named threat actor achieved root access on widely-deployed SonicWall SMA 1000 VPN appliances before the vulnerability was public — confirm whether your organization uses this product and, if so, direct your team to assess exposure and obtain SonicWall’s official incident guidance this week.
- Engineer — Act: If you have Ruby projects, audit all dependency trees for git_credential_manager versions 2.8.0–2.8.3 and Dendreo versions 1.1.3–1.1.4; remove immediately and treat any developer machine that installed them since July 18 as potentially compromised.
- SOC/IR — Act: Hunt for installations of these specific gem versions in developer endpoint EDR telemetry and CI/CD build logs since July 18, 2026; any confirmed install warrants an assume-breach sweep of that machine for secondary payload execution.
- Leader — Plan: If your organization has Ruby developers, direct the engineering team to audit for these packages and assess developer workstation exposure this week — credential-stealing supply chain hits on dev machines can pivot to production secrets.
- Engineer — Plan: Internet-facing IP cameras are the explicit attack surface; audit your estate for publicly reachable cameras, segment them off the internet behind a VPN or zero-trust proxy, and verify firmware is current — no specific CVE is named but the campaign exploits pervasive misconfiguration.
- SOC/IR — Act: The AIVD/MIVD advisory (July 10) describes an active Russian intelligence collection campaign — pull that advisory for IOCs and TTPs, then sweep camera management traffic and authentication logs for signs of unauthorized access to physical security infrastructure since at least early 2026.
- Leader — Plan: Credible Dutch intelligence agencies have named an active Russian campaign targeting physical security cameras near logistics and military routes; if your organization operates in logistics, defense contracting, or has European facilities, assess whether your camera deployments expose operationally sensitive areas and add physical-security infrastructure to your vendor risk review cycle.
- Engineer — Plan: Hugging Face hosts widely-used model weights and datasets; audit any CI/CD pipelines or build processes that pull from Hugging Face Hub using stored credentials, and rotate those tokens now as a precaution.
- SOC/IR — Plan: No IOCs published yet, but build detections for anomalous outbound traffic to Hugging Face APIs from build systems and review logs for credential use since the breach window — hunt for lateral movement originating from ML pipeline integrations.
- Leader — Act: Confirm whether your organization uses Hugging Face Hub in any production or research pipeline, request a vendor incident report, and brief leadership given the novel attack vector (autonomous AI agent compromise) that is likely to generate board-level questions.
- Engineer — Act: Hugging Face is widely embedded in ML pipelines via API tokens and model downloads — rotate all Hugging Face access tokens in your CI/CD and development environments immediately and audit secrets stores for any exposed HF credentials.
- SOC/IR — Act: Active breach at a broadly used AI platform with confirmed credential exposure; sweep secrets managers and env-var configs for Hugging Face tokens, hunt for anomalous outbound calls to HF APIs since last week, and flag any service accounts with HF integration for review.
- Leader — Act: Confirm whether the organization uses Hugging Face for model hosting, inference APIs, or dataset storage, then request a vendor incident report detailing scope; brief leadership on the novel autonomous-AI-agent attack vector, which is likely to generate board-level questions.
- Engineer — Act: NGINX is near-universal in cloud stacks and a public PoC already exists on GitHub, lowering the bar for exploitation despite low EPSS. Upgrade to nginx 1.30.4 (stable) or 1.31.3 (mainline), or NGINX Plus 37.0.3.1, before the PoC matures into a weaponized exploit.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-42533 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: Public PoC exists for a heap overflow triggered by opening a crafted XZ archive in 7-Zip, a tool common in dev workstations and CI/CD pipelines; patch all 7-Zip installations to 26.02 and audit any automated pipeline steps that extract XZ archives unattended.
- SOC/IR — Plan: No confirmed in-the-wild exploitation yet, but the public PoC raises urgency; build a detection for anomalous child processes spawned from 7-Zip binaries (7z.exe, 7zG.exe) during extraction, prioritizing CI/CD runners and build servers where archives are processed automatically.
- Leader — Skip
- Signals: CVE-2026-14266 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Public exploits for critical WordPress Core RCE make this urgent regardless of absent KEV/EPSS data — update WordPress Core to the latest patched release immediately and verify any managed hosting environments are also updated.
- SOC/IR — Plan: No IOCs or TTPs are provided to hunt on now, but given public exploits exist for a widely-deployed web platform, build or tune detections for WordPress exploit traffic (e.g., anomalous POST patterns, webshell indicators in web access logs) before active campaigns arrive.
- Leader — Plan: This is an engineering-track issue, not board-level — confirm your team has inventoried WordPress instances across the estate and that patching is tracked to completion this week.
- Engineer — Learn: ACR Stealer targets browser-stored credentials and tokens — review whether your CI/CD pipelines or developer workstations enforce short-lived tokens and MFA to limit blast radius if credentials are harvested.
- SOC/IR — Act: Microsoft is actively observing this campaign; hunt for ACR Stealer IOCs across EDR telemetry and SIEM, and tune detections for credential-access behaviors (browser credential dumping, token theft) across enterprise endpoints.
- Leader — Plan: A confirmed surge targeting enterprise customers elevates infostealer risk on your risk register; consider briefing on phishing-resistant MFA adoption and reviewing credential hygiene posture this quarter.
- Engineer — Act: Public PoC is available for an unauthenticated RCE in WordPress core affecting 6.9 and 7.0 with no plugins required — patch every WordPress instance to the fixed version immediately and audit web server file systems for newly dropped shells or unexpected PHP files.
- SOC/IR — Act: A public PoC for unauthenticated RCE in WordPress core means active exploitation is likely underway; sweep web access logs for anomalous POST patterns against wp-admin and wp-includes endpoints, and hunt for new or modified PHP files and unexpected child processes spawned by the web server process since the disclosure date.
- Leader — Act: Unauthenticated RCE in WordPress core with a working public exploit is a systemic exposure for any org running WordPress-powered properties; confirm inventory of WordPress versions across customer-facing and internal sites, verify engineering has prioritized emergency patching, and assess whether key SaaS or media vendors in your supply chain are exposed.
- Engineer — Act: Supply chain compromise targeting a widely-used frontend toolchain is a direct risk to any team using Vite or related npm packages; audit your dependency tree immediately for the seven ViteVenom packages and inspect CI/CD build logs for unexpected outbound connections to Tron blockchain endpoints.
- SOC/IR — Plan: The four-tier blockchain-based C2 using Tron is a novel evasion technique worth building detections for; develop hunt logic to flag anomalous blockchain API calls originating from build runners or developer workstations, and add this TTP to your supply-chain detection backlog.
- Leader — Learn: This campaign illustrates how adversaries are embedding resilient, blockchain-routed C2 in developer tooling supply chains; worth referencing in future discussions about secure software development lifecycle risk and third-party dependency governance.
- Engineer — Act: OpenSSL is near-universal; the fix shipped silently in June with no CVE, no advisory, and no changelog callout, meaning most deployments are unknowingly unpatched. Audit your OpenSSL version and upgrade to the June or later release containing the HollowByte fix — glibc-based servers are confirmed vulnerable and memory is not reclaimed until process restart.
- SOC/IR — Plan: No active exploitation or IOCs are currently cited, but Okta’s public research lowers the bar for abuse. Build or queue a detection for abnormal memory growth trends or bursts of minimal-size TLS connections against OpenSSL-serving hosts, and flag it once exploitation attempts surface in the wild.
- Leader — Learn: A DoS flaw in OpenSSL is operationally significant but below board-level threshold; the more notable governance signal is that the fix was shipped with no CVE, no advisory, and no changelog pointer — a disclosure gap in a critical transitive dependency worth surfacing in your software supply chain risk review.
- Engineer — Learn: No patch exists for this social-engineering vector; awareness matters for dev teams who might receive unsolicited coding challenges or interview tasks containing SVG assets with hidden payloads.
- SOC/IR — Act: Hunt for developer endpoints that recently cloned/ran unknown repositories, inspect for OtterCookie IOCs including browser credential and crypto wallet access patterns, and add detections for SVG files embedding executable content in CI/CD artifact pipelines.
- Leader — Learn: This Contagious Interview campaign targets developers via fake job postings — relevant context for board-level awareness of North Korean IT worker and recruitment-lure threats, but no immediate leadership action required.
- Engineer — Act: Actively scanning for internet-exposed instances of ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio to harvest AWS keys and Kubernetes tokens — exactly the stack teams deploy fast without firewall controls. Audit now for public exposure of these service ports, restrict to internal networks, and rotate AWS/K8s credentials on any host that ran them exposed.
- SOC/IR — Plan: The TTPs are concrete enough to build detections around: Shodan-driven scanning targeting AI service endpoints, followed by credential exfiltration. Build hunts for unusual outbound traffic or credential API calls originating from AI service hosts; the summary appears truncated so IOCs are not yet available to act on directly.
- Leader — Plan: A claimed harvest of 3,811 AWS keys illustrates the systemic risk of teams rapidly standing up AI infrastructure without security review. Raise with engineering and DevSecOps leadership to establish a deployment standard for AI tooling that includes network isolation requirements before services go live.
- Engineer — Plan: Code-signing certificate theft from a major CA is a trust-chain risk: audit any DigiCert-issued code-signing certificates in your CI/CD pipeline or software distribution path, and confirm with DigiCert whether your certificates were in scope for revocation.
- SOC/IR — Learn: Attribution of CylindricalCanine as a GoldenEyeDog subgroup adds context to actor tracking, but the summary is too thin to yield IOCs or mappable TTPs for detection work — monitor for a fuller technical disclosure before building hunts.
- Leader — Act: A confirmed breach at DigiCert involving stolen code-signing certificates is a vendor risk event: confirm whether your organization uses DigiCert for code signing or certificate services, and request DigiCert’s formal incident attestation and revocation scope this week.
- Engineer — Skip
- SOC/IR — Learn: The breach originated through a third-party support ticketing system, illustrating a lateral entry path worth reviewing in your own vendor-managed tool integrations — no IOCs or TTPs published to act on yet.
- Leader — Act: If EY is a vendor or auditor your organization uses, confirm whether your data was in scope and request EY’s incident report; brief leadership now, before this becomes a customer or auditor question.
- Engineer — Skip
- SOC/IR — Learn: Active investigation at a major healthcare vendor with confirmed unauthorized access and extortion claims, but no IOCs, TTPs, or ATT&CK-mappable behaviors have been published yet — nothing actionable to hunt or detect on today.
- Leader — Act: Abbott confirmed unauthorized access to Exact Sciences legacy systems in its Cancer Diagnostics division and is probing a separate LabCentral portal breach with data-theft claims; if your organization uses Abbott lab or diagnostics services, confirm your exposure this week and request a written attestation of incident scope from your account contact.
- Engineer — Act: CISA KEV listing with active exploitation means patch FortiSandbox to the vendor-fixed version immediately — treat this as a critical-priority change with a days-level window, not weeks.
- SOC/IR — Act: Active exploitation of FortiSandbox warrants an assume-breach sweep on any FortiSandbox instances in the estate; hunt for anomalous outbound connections or config changes on those appliances since the vulnerability window opened.
- Leader — Act: Confirm whether FortiSandbox is deployed anywhere in your environment, verify the patching timeline with your engineering team, and be prepared to brief leadership if you are a federal agency facing CISA’s Sunday deadline.
- Engineer — Act: SharePoint Server CVE-2026-58644 (CVSS 9.8) is KEV-listed with active exploitation and a public GitHub PoC — patch immediately; federal deadline is July 19, 2026, so treat this as emergency priority regardless of your organization type.
- SOC/IR — Act: With active exploitation confirmed and a public PoC live, treat any on-prem SharePoint Server as potentially compromised — sweep SharePoint ULS/IIS logs for deserialization anomalies and unusual POST requests to SharePoint endpoints since the vulnerability was disclosed.
- Leader — Act: A CVSS 9.8 SharePoint RCE is actively exploited and KEV-listed with a two-day federal remediation deadline — confirm this week whether your environment runs SharePoint Server on-prem and verify the engineering team has emergency patching underway before the July 19 deadline.
- Signals: CVE-2026-58644 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub
- Engineer — Learn: ClickFix-delivered infostealers targeting browser credentials and auth tokens are relevant to understanding how attackers bypass browser security; no patch or config action required, but review whether privileged workstations restrict clipboard-execution lures.
- SOC/IR — Act: Active enterprise campaigns from April–June 2026 using ClickFix lures to harvest credentials and tokens; hunt for ClickFix execution patterns (user-initiated PowerShell/cmd from browser context) and tune EDR/SIEM rules for ACR Stealer IOCs from Microsoft’s published analysis.
- Leader — Learn: Infostealer campaigns targeting enterprise auth tokens are a credential-theft trend worth noting for board-level risk awareness, but this does not require immediate leadership action absent a confirmed incident in your environment.
- Engineer — Plan: ClickFix is a social-engineering delivery vector, not a patchable vuln — review AppLocker/WDAC policies to restrict arbitrary Run-dialog execution, and audit M365 Conditional Access token-lifetime and revocation settings to limit stolen-session utility.
- SOC/IR — Act: Microsoft Defender Experts documented two active delivery chains; hunt for PowerShell or cmd.exe spawned via user-initiated Run dialog (explorer.exe lineage), and sweep M365 Unified Audit Log for anomalous OAuth grants, bulk file access, or SharePoint/OneDrive exfiltration events since the campaign is live.
- Leader — Plan: Session-token theft bypasses MFA and directly targets M365 documents — worth a leadership brief this quarter on lure-based infostealer risk, and a review of whether security-awareness training covers ClickFix-style social engineering.
- Engineer — Act: A public PoC on GitHub for a CVSS 9.8 improper-input-validation flaw in Zoom Desktop Client, VDI Client, and Meeting SDK for Windows raises exploitation risk significantly even without KEV listing; update all three Zoom Windows products to the patched versions immediately.
- SOC/IR — Act: With a public PoC in circulation for a critical Zoom account-takeover vulnerability, exploitation attempts against unpatched Windows endpoints are plausible now; hunt for anomalous Zoom process behavior and unexpected authentication events since the patch cycle may lag exposure.
- Leader — Plan: Zoom is near-universal in enterprise environments, and a CVSS 9.8 flaw with a public PoC in the Windows client warrants confirming with engineering that patching is tracked and on a days-not-weeks timeline before this surfaces in customer security questionnaires.
- Signals: CVE-2026-53412 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub
- Engineer — Plan: Trojanized installers for widely-deployed conferencing tools represent a real supply-chain-adjacent risk; no exploitation signals provided. Audit all WebEx/Zoom deployments to confirm they originate from official signed packages or MDM-managed distribution, and block unapproved installer sources.
- SOC/IR — Act: Active campaign using trojanized enterprise conferencing apps to drop a credential-stealing RAT; hunt for unsigned or anomalous WebEx/Zoom process trees since the compromise starts before any patch can help. Pull Starland RAT IOCs from the BleepingComputer article and sweep endpoint logs for suspicious child processes or C2 traffic from conferencing app directories.
- Leader — Learn: Financially motivated Russian actor targeting enterprise collaboration tools is worth noting as sector-level context, but with no confirmed breach at a shared vendor and no enrichment signals, this does not yet require leadership action or customer communication.
- Engineer — Act: CVE-2026-15719 has a public PoC on GitHub and Mozilla acknowledges public exploit code exists; update Firefox to the patched release immediately across all managed endpoints and developer workstations.
- SOC/IR — Plan: With public exploit code confirmed for Firefox WebAssembly and DOM navigation flaws, build or tune detections for browser exploitation patterns (unusual child processes, suspicious renderer crashes) and prepare to hunt if active exploitation is reported.
- Leader — Skip
- Signals: CVE-2026-15718 — CISA KEV: not listed, EPSS 0.00, no public PoC found · CVE-2026-15719 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CISA KEV listing with confirmed active exploitation and an imminent Saturday deadline; audit your environment for Oracle E-Business Suite deployments and apply Oracle’s patch immediately.
- SOC/IR — Act: Active exploitation is underway against Oracle EBS financial systems; initiate a hunt for anomalous EBS access patterns and monitor threat intel feeds for IOCs to sweep across relevant log sources.
- Leader — Act: A CISA-mandated Saturday deadline on actively exploited financial software warrants same-week confirmation from your engineering team that Oracle E-Business Suite is either patched or absent from your environment.
- Engineer — Act: Confirmed supply chain compromise of AsyncAPI npm packages with import-time malware execution — audit all projects for AsyncAPI dependencies, check CI/CD build logs for the affected package versions, and rotate any secrets accessible from compromised build environments.
- SOC/IR — Act: Active campaign with malware delivered at import time via npm means CI/CD runner telemetry is the primary hunt surface — sweep build system logs for suspicious outbound connections or process spawns during npm install/import phases since the compromise window, and tune EDR rules to flag unusual child processes from package managers.
- Leader — Act: A weaponized CI/CD supply chain attack of this type can expose credentials and intellectual property across every project that consumed the affected packages — confirm internally whether AsyncAPI packages are in use, request an exposure assessment from engineering, and prepare to brief leadership given the potential scope.
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation — patch SMA1000 appliances to the latest firmware immediately and audit access logs for signs of pre-patch compromise.
- SOC/IR — Act: Edge appliance exploitation means assume-breach posture is warranted — sweep for lateral movement or credential harvesting activity originating from SMA1000 IPs since the zero-day window, and hunt for post-exploitation behavior in downstream systems.
- Leader — Act: Actively exploited VPN appliances are a board-level exposure; confirm whether your organization runs SMA1000, verify patching status with the engineering team, and prepare a brief in case the incident becomes public.
- Signals: CVE-2026-15409 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources · CVE-2026-15410 — CISA KEV: listed, EPSS n/a, public PoC on GitHub
- Engineer — Act: Two actively exploited zero-days in SonicWall SMA 1000 — CISA KEV listed, public PoC on GitHub, CVSS 10.0 SSRF enabling unauthenticated RCE. Apply SonicWall’s emergency patch immediately and restrict management access to SMA 1000 appliances while remediating.
- SOC/IR — Act: Active exploitation of an edge VPN appliance with unauthenticated RCE — treat as assume-breach: sweep logs for anomalous SMA 1000 admin activity and lateral movement indicators since before the disclosure date, and escalate any SMA 1000 in the estate to incident response review.
- Leader — Act: A CVSS 10.0 zero-day pair on a widely deployed enterprise VPN appliance is being actively exploited — confirm whether SonicWall SMA 1000 is in your environment, and if so brief leadership and prepare customer communications in case compromise is discovered during the sweep.
- Signals: CVE-2026-15409 — CISA KEV: listed, EPSS n/a, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: If you run ShareFile Storage Zone Controllers on-premises, apply the released security updates immediately — Progress shutting down the hosted service is a strong implicit signal of active exploitation risk, mirroring their MOVEit pattern.
- SOC/IR — Plan: No IOCs or TTPs are available yet, but queue a hunt workflow for once Progress or third-party researchers publish exploitation indicators; given Progress’s MOVEit history, details will likely emerge quickly.
- Leader — Act: Confirm whether your organization runs ShareFile Storage Zone Controllers on-prem, then check with Progress for breach attestations this week — an emergency service shutdown from this vendor warrants a fast exposure check before board or customer questions arrive.
- Engineer — Plan: At least two active threat actors are exploiting this Entra ID gap, but there’s no patch—the exposure is architectural. Audit your Entra OAuth app registrations and conditional access policies, and restrict which OAuth clients are permitted for interactive and non-interactive flows.
- SOC/IR — Act: This technique deliberately suppresses successful sign-in events, creating a blind spot in standard Entra telemetry; shift detection to Entra audit logs for anomalous OAuth client IDs and non-standard token-request patterns, and run a retrospective hunt across the past 90 days of OAuth activity.
- Leader — Plan: Credential-validation activity against your Entra tenant may be occurring without triggering existing alerts; ask your security team to assess current detection coverage for OAuth-based evasion and confirm whether identity monitoring logs are capturing the necessary audit events.
- Engineer — Act: Two vulnerabilities are under active exploitation with incident responders credited, making them immediate priorities — apply the July 2026 Microsoft updates now, targeting the two exploited CVEs first, then work through the remaining 620 on your normal risk-ranked cadence.
- SOC/IR — Act: Active exploitation of both zero-days (with IR team involvement confirmed) means assume some estates are already hit — hunt for post-exploitation indicators on Windows systems that lag the July patch cycle and tune detections for lateral movement or privilege escalation patterns consistent with Microsoft kernel/privilege bugs.
- Leader — Plan: A record 622-CVE release with two actively exploited flaws is likely to surface in board or customer conversations this week — confirm your patch team is triaging the exploited CVEs on an expedited timeline and prepare a brief status for leadership in case questions arise.
- Engineer — Act: Two actively exploited zero-days in Microsoft products warrant immediate prioritization of July Patch Tuesday; apply updates now, focusing on the exploited CVEs first — check the full advisory to identify affected components (Windows, Edge, Office, etc.) and patch to current versions within your critical SLA.
- SOC/IR — Plan: Active exploitation of two zero-days means adversaries may already be in unpatched estates; review the CrowdStrike analysis for TTPs and any IOCs tied to those exploits, then build or tune detections targeting post-exploitation behaviors for the affected components before the broader threat actor ecosystem adopts these.
- Leader — Plan: Two actively exploited zero-days in this cycle elevate urgency beyond routine patch cadence — confirm with your engineering team this week that the exploited CVEs are being fast-tracked, and assess whether affected components touch regulated systems or customer-facing infrastructure that could trigger disclosure obligations.
- Engineer — Act: Two vulnerabilities are already under active exploitation in this cycle; apply Microsoft’s July 2026 updates immediately, prioritizing the two exploited CVEs and the 62 criticals — check the Microsoft Security Update Guide for specific product versions and patches.
- SOC/IR — Plan: Two actively exploited CVEs exist in this release but no IOCs or TTPs are provided here; pull the specific CVE details from Microsoft’s bulletin this week and build or tune detections for exploitation attempts against the affected components.
- Leader — Plan: A record-volume Patch Tuesday with confirmed active exploitation is worth a brief to engineering leadership to confirm prioritization; validate that patch SLAs for critical and exploited CVEs are being met this cycle.
- Engineer — Act: Two zero-days actively exploited in the wild against Microsoft products demand immediate patching priority this cycle; apply July 2026 Patch Tuesday updates now, triaging the exploited CVEs before the routine 570-flaw backlog.
- SOC/IR — Plan: The summary confirms active exploitation but provides no IOCs, TTPs, or ATT&CK mappings yet — monitor vendor and threat-intel feeds for those details, then build or tune detections targeting the specific zero-day exploit behaviors once published.
- Leader — Plan: Record patch volume plus two actively exploited zero-days warrants confirming with engineering that patch management is accelerated this cycle; brief leadership if customer security questionnaires or board inquiries arrive about the record-breaking release.
- Engineer — Act: Any developer who opens an untrusted repo in Cursor on Windows is at risk of credential theft (SSH keys, cloud tokens) with no user interaction required — the attack path is fully described, making it practically exploitable now. Update Cursor to the patched version immediately; until confirmed patched, audit recently cloned project directories for unexpected git.exe files and avoid opening untrusted repos in Cursor on Windows.
- SOC/IR — Plan: No active campaign IOCs are reported, but the technique is clear: build a detection for Cursor (or any IDE process) spawning child processes from non-standard project root paths, specifically hunting git.exe executions outside of installed VCS tool directories on Windows endpoints.
- Leader — Plan: Cursor is widely adopted among developer teams; this flaw enables silent credential and source-code compromise via a simple repo-clone workflow. Circulate a developer advisory this week, confirm vendor patch availability, and consider a temporary policy restricting Cursor on Windows for repos from untrusted sources until remediated.
- Engineer — Act: Active supply-chain compromise with four named @asyncapi package versions confirmed by four independent security firms. Audit lockfiles and dependency manifests for @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator@3.3.1, and @asyncapi/specs v6.11.2/v6.11.2-alpha.1; pin to clean versions and re-run any build that pulled these.
- SOC/IR — Act: Multi-stage botnet loader distributed through CI/CD dependency chains means build infrastructure and developer machines are the compromise surface. Hunt for these specific package versions in npm install logs and artifact registries, and look for anomalous outbound connections from build runners or developer endpoints since the compromised versions’ publish dates.
- Leader — Plan: Corroborated supply-chain compromise in a popular API-tooling namespace warrants directing engineering to complete a dependency audit this week; if these packages appear in shipped products, assess whether customer disclosure or SBOM updates are required under existing contractual or regulatory obligations.
- Engineer — Act: CISA warning indicates KEV-level active exploitation against internet-exposed on-premises SharePoint Server. Apply Microsoft’s patches immediately and verify no externally reachable SharePoint instances remain unpatched.
- SOC/IR — Act: Active exploitation of internet-facing SharePoint means assume-breach posture is warranted; hunt for post-exploitation activity (lateral movement, credential access) on SharePoint hosts since the earliest known exploitation date and review IIS/ULS logs for anomalous request patterns.
- Leader — Act: Confirm whether the organization runs on-premises SharePoint Server exposed to the internet, and get a patching status update from engineering this week — active exploitation with a CISA advisory is the kind of event that surfaces in board or customer security reviews.
- Engineer — Act: Vercel stores environment variables, API keys, and deployment tokens — rotate all Vercel personal/team API tokens and audit env-var secrets stored on the platform immediately; check for unauthorized deploys or repo access in your Vercel audit logs.
- SOC/IR — Act: If your estate uses Vercel, hunt for suspicious CI/CD activity or deployments since April 2026 using potentially stolen credentials; monitor for attacker re-use of Vercel tokens in downstream cloud accounts.
- Leader — Act: Confirm whether your organization has Vercel accounts, then request Vercel’s incident scope and attestation this week; brief engineering leadership on potential exposure of source code, build secrets, or customer-data-touching environment variables before this reaches the news cycle internally.
- Engineer — Skip
- SOC/IR — Learn: Provides ecosystem context on ransomware infrastructure enablers, but the summary contains no IOCs, TTPs, or detection angles to act on.
- Leader — Act: OFAC designations create immediate sanctions-compliance exposure — confirm whether your organization or any portfolio vendor uses the named VPN service or cryptor, and document the review in case of audit or customer inquiry.
- Engineer — Plan: ShinyHunters’ TTPs — OAuth app abuse and misconfigured guest access — directly affect cloud/SaaS configurations engineers own; no KEV or exploitation signals, but audit third-party OAuth app consent grants and tighten guest-access policies in your M365/IdP tenant this quarter.
- SOC/IR — Act: Microsoft Threat Intelligence documents an active, named campaign; review the blog for IOCs and ATT&CK-mappable TTPs, then hunt for anomalous OAuth token grants and vishing-preceded MFA/auth events in identity logs since the publication date.
- Leader — Plan: ShinyHunters’ supply-chain and OAuth abuse pattern against SaaS platforms warrants a SaaS vendor review this quarter — confirm key vendors enforce OAuth app allowlisting and have disabled unnecessary guest access — no specific named-vendor breach requiring immediate stakeholder communication.
- Engineer — Act: ModHeader is widely used by engineers for API and header debugging — remove it from all developer and CI browsers now and replace with a vetted alternative; dormant or not, undisclosed collection code in a tool with store-level trust is a supply-chain red flag.
- SOC/IR — Plan: No active exploitation or IOCs to sweep for, but this is a prompt to audit the browser extension inventory across developer workstations and establish an approved-extension policy or detection for unapproved extension installs.
- Leader — Learn: No data was collected and both stores have already pulled the extension, so no breach disclosure or vendor inquiry is warranted; useful data point on browser-extension supply-chain risk when building or updating software-inventory and vendor-vetting policies.
- Engineer — Plan: No platform CVE to patch — the attack surface is over-trusted OAuth connections and third-party integrations. Audit all connected apps in your Salesforce org, revoke unused OAuth grants, and review third-party vendor permissions this quarter.
- SOC/IR — Act: Microsoft has detailed three concrete attack paths from an active, year-long campaign — hunt for anomalous OAuth authorization events and unusual connected-app activity in Salesforce audit logs going back at least 12 months to check for prior compromise.
- Leader — Act: ShinyHunters is an active data-extortion group and this campaign abuses third-party SaaS trust, not software flaws — confirm your organization’s Salesforce OAuth integrations are inventoried, brief leadership on third-party SaaS risk exposure, and ask your Salesforce-connected vendors for attestation of their OAuth hygiene.
- Engineer — Act: Audit all projects and CI/CD pipelines for the malicious Jscrambler npm version; if found, treat the build environment as compromised and rotate any credentials or tokens accessible during that build.
- SOC/IR — Act: Search CI/CD and build system logs for installations of the malicious Jscrambler package, then hunt for infostealer exfiltration activity (credential theft, unexpected outbound connections) on any hosts where it executed.
- Leader — Plan: A supply-chain attack on a security vendor’s npm package (~1,500 downloads) underscores third-party software risk; confirm whether your org consumes Jscrambler’s npm package and, if so, request their incident timeline and impact report.
- Engineer — Act: Any developer who ran Grok Build (≤0.2.93) on a repo should assume the full commit history — including historically committed secrets — was sent to xAI-controlled cloud storage. Immediately stop using the tool, audit exposed repos for credentials or sensitive data, and rotate any secrets that ever touched those repos’ history.
- SOC/IR — Plan: If developers in your org use Grok Build, build a detection for large outbound uploads (git bundle format) from developer workstations to external cloud storage; review DLP or proxy logs for historical hits against GCS endpoints associated with xAI before this was publicized.
- Leader — Act: Determine this week whether any developers have used Grok Build, since full repo history — potentially including IP, credentials, or regulated data — may have been exfiltrated to xAI infrastructure; if exposure is confirmed, assess notification obligations and request a data-handling statement from xAI.
- Engineer — Act: CISA warning signals KEV-level active exploitation — update or disable the iCagenda and Balbooa Forms Joomla extensions immediately, and audit web roots for unexpectedly uploaded files that may indicate prior compromise.
- SOC/IR — Act: Active exploitation via arbitrary file upload means webshells may already be in place — hunt Joomla web directories for recently uploaded executables and review web server logs for POST requests targeting these extension upload endpoints.
- Leader — Plan: Confirm whether any company-owned or vendor-hosted web properties run Joomla with these extensions and verify engineering teams have patch SLAs in motion; this does not yet rise to board-briefing level.
- Engineer — Act: CISA KEV-listed, CVSS 10.0, actively exploited as zero-days with a public PoC on GitHub — patch iCagenda and Balbooa Forms Joomla extensions to the latest fixed versions immediately if these are in your stack.
- SOC/IR — Act: In-the-wild zero-day exploitation of web-facing Joomla components means you should assume compromise may predate patching — sweep web access logs for anomalous requests targeting these extension endpoints and confirm whether any estate assets run Joomla with either plugin.
- Leader — Plan: CISA KEV listing at CVSS 10.0 warrants a same-week inventory check of web properties for Joomla usage with these extensions; if confirmed in use, escalate to engineering for urgent remediation before this surfaces in a customer questionnaire or audit.
- Signals: CVE-2026-48939 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub
- Engineer — Plan: Evilginx bypasses TOTP-based MFA by proxying credentials; if your M365 tenant uses authenticator-app OTP rather than FIDO2/hardware keys, plan migration to phishing-resistant MFA and enforce Entra ID Conditional Access requiring compliant devices this quarter.
- SOC/IR — Act: Three live AiTM operations were exposed with their full toolkits; pull the IOCs Lexfo published, sweep M365/Entra ID sign-in logs for unfamiliar token-issuing IP ranges, and tune detections for impossible-travel or session-token reuse patterns since AiTM bypasses MFA alerts entirely.
- Leader — Learn: The exposure of three concurrent industrial-scale M365 phishing operations illustrates why TOTP MFA is insufficient as a control; useful context when building the case for phishing-resistant MFA investment in the next budget cycle.
- Engineer — Plan: If you operate in a HIPAA-covered environment, review the updated Security Rule requirements this quarter and identify any new technical safeguards or control gaps to address before enforcement deadlines.
- SOC/IR — Skip
- Leader — Act: Healthcare or health-data leaders should read the updated rule now, map changes to your current compliance posture, and brief legal/compliance on any new obligations or deadline-driven gaps before they surface in your next audit.
- Engineer — Act: A public PoC exists for this critical langchain-core flaw, making exploitation practical for any AI pipeline that processes untrusted input; audit Python environments and upgrade langchain-core to the patched release immediately.
- SOC/IR — Plan: No active exploitation campaign observed (EPSS 0.14, not KEV-listed), but the public PoC warrants building detections for anomalous subprocess or file-system activity spawned from LangChain worker processes before exploitation picks up.
- Leader — Skip
- Signals: CVE-2025-68664 — CISA KEV: not listed, EPSS 0.14, public PoC on GitHub
- Engineer — Act: A preinstall hook in jscrambler 8.14.0 drops and executes a cross-platform native infostealer — this is live supply-chain compromise. Audit all CI/CD pipelines and developer machines for installs of this exact version, remove or pin away from 8.14.0, and treat any affected environment as potentially credential-compromised.
- SOC/IR — Act: Hunt for jscrambler 8.14.0 installs in npm audit logs, CI runner job histories, and artifact caches since July 11, 2026; on affected endpoints look for unexpected native binary drops or executions spawned from the npm install process, as infostealer data exfiltration may have already occurred.
- Leader — Act: Confirm this week whether jscrambler 8.14.0 reached any company build pipeline or developer workstation; if so, treat as a credential-theft incident — initiate credential rotation and brief relevant stakeholders, since infostealers harvest tokens, SSH keys, and secrets stored on the machine.
- Engineer — Act: GoAnywhere MFT is a common enterprise managed-file-transfer appliance; CISA KEV listing plus EPSS 1.00 plus a public GitHub PoC means exploitation is active now. Patch to the vendor-fixed release immediately or take the instance offline until patching is complete.
- SOC/IR — Act: Prior GoAnywhere exploitation by Cl0p hit hundreds of organizations; treat any unpatched instance as potentially compromised. Hunt for anomalous outbound transfers, newly created admin accounts, and lateral movement originating from GoAnywhere servers since the PoC became public.
- Leader — Act: The 2023 Cl0p GoAnywhere campaign was a marquee supply-chain breach; this CVE matches or exceeds that severity signal (EPSS 1.00, KEV-listed). Confirm this week whether your org or critical MFT vendors run GoAnywhere and obtain patch attestations before history repeats.
- Signals: CVE-2025-10035 — CISA KEV: listed, EPSS 1.00, public PoC on GitHub
- Engineer — Act: EPSS 0.93 plus a public GitHub PoC makes exploitation practical now — patch the Linux kernel to the distro-provided fixed package (check RHEL, Ubuntu, Debian advisories) across all Linux hosts and container base images within your patch window.
- SOC/IR — Act: With a public PoC and EPSS 0.93, exploitation attempts are likely imminent; hunt for anomalous privilege escalation events on Linux endpoints since PoC publication and tune EDR/SIEM rules for kernel LPE behavior patterns.
- Leader — Plan: A second high-severity Linux LPE with a public PoC in eight days signals a pattern worth tracking; confirm your Linux patch cadence will address this within days and assess the size of your externally accessible Linux estate.
- Signals: CVE-2026-43284 — CISA KEV: not listed, EPSS 0.93, public PoC on GitHub
- Engineer — Act: Unauthenticated RCE on a widely-deployed internet-facing MTA with a public PoC on GitHub demands immediate action regardless of low EPSS — Exim has a history of mass exploitation. Patch Exim to the version addressing CVE-2026-45185; if no patch is yet available, restrict SMTP exposure at the network layer while tracking vendor advisory.
- SOC/IR — Plan: No active exploitation confirmed in enrichment signals, but a public PoC for pre-auth RCE on an internet-facing mail server shortens the window — build or stage Exim-specific detections (unusual child processes spawned from the Exim process, unexpected outbound connections from mail servers) before exploitation ramps up.
- Leader — Skip
- Signals: CVE-2026-45185 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: CISA KEV listed, EPSS 0.96, and public PoC on GitHub — exploitation is active and practical. Identify your container runtime version, patch to the fixed release immediately, and audit container environments for signs of exploitation.
- SOC/IR — Act: Active exploitation confirmed via CISA KEV; hunt for container escape and unexpected privilege escalation events in your EDR and container logs since the PoC dropped in early May 2026, and tune detections for abnormal rootless container behavior.
- Leader — Plan: CISA KEV listing and near-perfect EPSS signal active exploitation in the wild; confirm with engineering that all container runtime deployments are on a patched version and add this to the sprint’s prioritized patch list.
- Signals: CVE-2026-31431 — CISA KEV: listed, EPSS 0.96, public PoC on GitHub
- Engineer — Act: cPanel/WHM is widely deployed by hosting providers and MSPs; CISA KEV listing plus EPSS 0.98 and public PoC confirm active exploitation risk. Patch to the vendor-released fixed version immediately and audit for signs of unauthorized access in cPanel/WHM logs.
- SOC/IR — Act: With a public PoC and KEV listing, opportunistic exploitation is underway — sweep for anomalous cPanel/WHM authentication events and unexpected admin account creation since the PoC publication date, and tune detections for unauthenticated access patterns on WHM ports.
- Leader — Plan: If your organization or any managed-hosting vendor uses cPanel/WHM, confirm patching status and request attestation this week; the KEV listing signals broad exploitation, but direct board escalation is warranted only if you host customer data on affected systems.
- Signals: CVE-2026-41940 — CISA KEV: listed, EPSS 0.98, public PoC on GitHub
- Engineer — Act: Public PoC exists for a symlink-based sandbox escape in Claude Code, which engineers and CI/CD pipelines commonly run; update Claude Code to the patched release immediately and audit any pipelines that invoke it with elevated filesystem access.
- SOC/IR — Learn: Low EPSS (0.01) and no active exploitation campaign; no IOCs or ATT&CK-mappable TTPs are provided, but the symlink sandbox-escape technique is worth noting if Claude Code runs in monitored developer environments.
- Leader — Skip
- Signals: CVE-2026-39861 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: KEV-listed zero-day actively exploited in Chrome’s CSS engine; update Chrome/Chromium to the patched stable release immediately and verify managed browsers in your fleet are on the latest version.
- SOC/IR — Act: Active in-the-wild exploitation means assume-breach posture for any endpoint running unpatched Chrome; hunt for suspicious child processes or unusual network connections from Chrome since the February 2026 stable release date, and check EDR telemetry for exploitation indicators.
- Leader — Plan: CISA KEV listing confirms active exploitation of a Chrome browser zero-day; validate that your IT/engineering teams have a forced browser-update mechanism and confirm rollout completion — this is routine but warrants a status check given KEV designation.
- Signals: CVE-2026-2441 — CISA KEV: listed, EPSS 0.22, public PoC on GitHub
- Engineer — Act: If you run WordPress, Drupal, Joomla, or similar CMS with unpatched plugins, audit for compromise indicators and bring all CMS software and plugins to current versions immediately — campaigns like this actively scan for known-vulnerable installs.
- SOC/IR — Act: Hunt for webshell activity and anomalous outbound connections from CMS-hosting servers; check for recently modified PHP/JS files in web roots and tune SIEM rules for CMS-targeted exploitation behavior.
- Leader — Plan: Confirm whether your organization or managed service providers host any CMS platforms, and ensure patch status is reviewed this quarter; note that global campaigns of this type frequently precede ransomware or data-theft incidents in affected sectors.
- Engineer — Act: If you run ShareFile Storage Zone Controllers on-premises, shut them down immediately per Progress’s emergency guidance — this is the same vendor that disclosed the MoveIt zero-day. Monitor Progress’s advisory channel for patch availability before bringing servers back online.
- SOC/IR — Act: Progress issuing an emergency shutdown recommendation implies an unpatched, actively targeted vulnerability; treat any org running on-prem ShareFile Storage Zone Controllers as potentially exposed. Initiate a sweep for anomalous file-transfer or lateral-movement activity from those hosts since at least 72 hours prior to today.
- Leader — Act: Progress Software — the MoveIt vendor — is issuing emergency shutdown orders for ShareFile on-premises deployments, a pattern consistent with imminent or in-progress exploitation. This week: confirm whether your org or any critical SaaS vendors run on-prem ShareFile Storage Zone Controllers and request attestations; brief leadership before this surfaces in news as a repeat of the MoveIt incident.
- Engineer — Act: Progress has confirmed a credible active threat against on-prem ShareFile Storage Zone Controllers and is directing customers to shut them down immediately. If you run Storage Zone Controllers on Windows, take them offline now and await Progress’s remediation guidance before bringing them back up.
- SOC/IR — Act: A vendor-confirmed active compromise campaign against enterprise file-sharing infrastructure warrants an assume-breach review if ShareFile is in your environment — check for lateral movement or data staging activity originating from Storage Zone Controller hosts since at least the past 30 days, and watch Progress and threat intel feeds for IOC release.
- Leader — Act: Progress’s directive to shut down an enterprise product mid-operation signals a serious active incident; confirm this week whether your organization runs ShareFile Storage Zone Controllers, request a formal incident statement from Progress, and assess whether any stored data exposure triggers disclosure obligations.
- Engineer — Act: Confirmed supply-chain attack: audit all dependency trees and package-lock files for @injectivelabs/sdk-ts@1.20.21; if found in any build artifact or runtime environment, treat wallet private keys and seed phrases as compromised and rotate immediately.
- SOC/IR — Act: Sweep CI/CD build logs, container image layers, and package manifests across all repositories for @injectivelabs/sdk-ts version 1.20.21; any positive hit should trigger an incident investigation for outbound exfiltration from build environments.
- Leader — Learn: A confirmed GitHub-to-npm supply-chain attack targeting crypto wallet credentials; worth referencing in supply-chain security policy discussions, and escalate to Act if the organization has products or vendors with Web3/DeFi dependencies.
- Engineer — Act: If you host WordPress sites, audit them now for backdoors and unknown admin accounts; review your web server logs for indicators matching this campaign’s mass-exploitation pattern.
- SOC/IR — Act: Review logs for WordPress admin-panel anomalies and unexpected file writes since the campaign has been active; hunt for web shells or unusual PHP execution tied to mass-compromise tooling.
- Leader — Learn: Provides useful context on the scale of opportunistic WordPress compromise operations, but no immediate board-level action is required without confirmed organizational exposure.
- Engineer — Act: If you run Gitea via the official Docker image, update to the patched image immediately — the flaw allows full admin impersonation and is being actively exploited. Audit recent repository access and check for unauthorized commits or access token creation.
- SOC/IR — Act: Active exploitation of an admin-impersonation bug in a self-hosted code repository warrants an assume-breach sweep: review Gitea audit logs for anomalous authentication events or unexpected admin-level actions since the vulnerability became public, and hunt for signs of unauthorized repository access or code changes.
- Leader — Act: If your organization self-hosts Gitea via Docker, confirm with engineering this week whether the vulnerable image is in use and verify patching status — unauthorized admin access to source code repositories is a direct supply chain and IP risk.