Palo Alto Exploited, Chrome Zero-Day Patched, and Three Critical CVEs

Top Stories

CISA orders urgent ColdFusion patching

CISA has ordered federal agencies to patch an actively exploited maximum-severity Adobe ColdFusion vulnerability by Friday, according to BleepingComputer’s report citing the agency directive: BleepingComputer.

So what?
If you run ColdFusion internally or expose it to the internet, this is the strongest signal you will get short of confirmed compromise. A CISA deadline usually means exploitation is credible and active enough to warrant immediate action.

What to do next - Inventory all Adobe ColdFusion servers, including forgotten dev and staging nodes. - Patch immediately based on vendor guidance. - Restrict public access where possible until patching is complete. - Hunt for suspicious administrator creation, web shell behavior, unexpected scheduled tasks, and outbound traffic from ColdFusion hosts.

Accenture confirms a breach after stolen data claim

Accenture confirmed a security breach after a threat actor offered allegedly stolen data for sale, per BleepingComputer: BleepingComputer.

So what?
Third-party risk remains a practical security problem, not just a procurement checkbox. If your organization shares code, documentation, tickets, credentials, or managed access with large service providers, this type of event may become your incident too.

What to do next - Review vendor access paths into your environment. - Rotate credentials or tokens shared with service providers where feasible. - Verify logging around MSP, integrator, and support access. - Ask impacted partners for indicators, scope, and containment details.

LONGLEASH malware expands ORB infrastructure through edge devices

BleepingComputer reports that Chinese threat actors tracked as UAT-7810 are using LONGLEASH malware to grow an Operational Relay Box network by compromising internet-facing devices, especially unpatched Ruckus routers: BleepingComputer.

So what?
Unmanaged network appliances are still prime infrastructure for covert relays, persistence, and traffic forwarding. Even if the device is not your crown jewel, it can become an attacker-controlled foothold for proxying operations or masking intrusions elsewhere.

What to do next - Patch internet-facing routers and wireless infrastructure. - Audit management plane exposure. - Disable remote administration from untrusted networks. - Compare running configurations against known-good baselines. - Review outbound connections from edge devices for unusual destinations.

Hidden backdoor found in Tenda router firmware

Researchers found a hidden authentication backdoor in multiple Tenda router firmware versions that could allow admin access to the web management panel, according to BleepingComputer: BleepingComputer.

So what?
This is especially relevant for small offices, branch sites, home offices, and unmanaged retail deployments where low-cost routers often live for years without firmware review.

What to do next - Identify any Tenda devices in branches, labs, kiosks, or remote worker environments. - Apply updated firmware if available. - If no trustworthy remediation exists, plan replacement. - Move management interfaces behind VPN or internal-only access controls. - Reset and revalidate configurations after upgrades.

Spain arrests suspected member of pro-Russian hacktivist groups

Spanish authorities arrested a suspected member of CyberArmy of Russia Reborn and Z-Pentest, according to BleepingComputer: BleepingComputer.

So what?
Arrests disrupt individuals, but they rarely eliminate the broader operational risk. Organizations in government, transportation, media, and critical infrastructure should still expect nuisance DDoS, defacement attempts, credential attacks, and opportunistic scanning from loosely aligned hacktivist ecosystems.

What to do next - Confirm DDoS playbooks are current. - Review externally exposed services and weak auth paths. - Coordinate monitoring with ISP or scrubbing providers if you are a likely target.

Public GitHub issues may expose private data to agentic workflows

The Hacker News reported that a public GitHub issue could trick agentic workflows into leaking private repository data: Hacker News.

BleepingComputer also highlighted GitHub Actions attack patterns that many CI scanners miss: BleepingComputer.

So what?
This is a supply chain and trust-boundary problem. A passing scan on workflow files does not mean secrets, tokens, artifacts, or repository context are safe from abuse through event chaining, untrusted input, or over-permissioned automation.

What to do next - Restrict workflow token permissions. - Separate trusted and untrusted workflow triggers. - Prevent secrets from being exposed to workflows triggered by public input. - Review self-hosted runner isolation. - Audit third-party actions and pin immutable references.

Januscape raises VM escape concerns in Linux environments

A Linux kernel flaw nicknamed Januscape may allow VM escape and host code execution on Intel and AMD systems, according to BleepingComputer: BleepingComputer.

So what?
If you operate shared compute, virtualized labs, VDI, or multi-tenant infrastructure, VM escape risk changes your containment assumptions. A guest compromise may no longer stay a guest compromise.

What to do next - Identify affected kernel versions and hypervisor dependencies. - Prioritize patching for shared and exposed virtualization estates. - Tighten tenant isolation and reduce unnecessary host-guest integration features. - Increase monitoring for host-level anomalies originating from VM workloads.

Critical Vulnerabilities

CVE-2026-56843: WebPros Plesk XML-RPC cross-tenant credential exposure

CVE-2026-56843 is a critical authorization flaw in the Plesk XML-RPC API affecting versions before 18.0.78.4. According to the vendor advisory, a low-privileged authenticated customer may enumerate domains they do not own, retrieve other tenants’ FTP credentials stored in cleartext, and potentially execute code as another tenant’s system user: Plesk Advisory.

Why it matters - Shared hosting and multi-tenant Plesk deployments are at highest risk. - The issue crosses tenant boundaries, which is a severe trust failure. - Credential disclosure can lead to lateral movement and web content compromise.

Immediate actions - Upgrade Plesk to 18.0.78.4 or later. - Review XML-RPC exposure and restrict access if not required. - Reset FTP credentials for hosted tenants if compromise is suspected. - Audit for cross-tenant access anomalies.

Technical Notes

Check the installed Plesk version:

plesk version

Search web and panel logs for suspicious XML-RPC usage:

grep -Ri "xmlrpc" /var/log/plesk* /var/log/sw-cp-server* /var/www/vhosts/system/*/logs 2>/dev/null

Review external exposure:

ss -tulpn | grep -E '(:8443|:8880|:8447)'

CVE-2026-33264: Apache Airflow deserialization bug can lead to RCE

CVE-2026-33264 affects Apache Airflow and stems from unrestricted import_string() usage during deserialization. The issue allows a DAG author to craft a malicious trigger that executes code in the Scheduler or API Server, crossing a core Airflow security boundary. Apache advises upgrading to apache-airflow 3.3.0 or later, with additional hardening via [core] allowed_deserialization_classes where DAG author trust is limited: GitHub PR 66002, GitHub PR 68528, Apache advisory thread, Openwall post.

Why it matters - This is not just a vulnerable package issue. It is a trust-boundary failure between DAG authors and control-plane processes. - Environments with multiple teams contributing DAGs are at higher risk. - RCE in the Scheduler or API Server can expose secrets, metadata, and orchestration control.

Immediate actions - Upgrade to Airflow 3.3.0 or later. - Limit who can author or modify DAGs. - Reduce deserialization exposure with a restrictive allowlist. - Review existing DAGs for unusual triggers or imports.

Technical Notes

Check Airflow version:

airflow version
python -c "import airflow; print(airflow.__version__)"

Example defense-in-depth configuration:

[core]
allowed_deserialization_classes = airflow.*,datetime.*,builtins.*

Search DAGs for suspicious import patterns:

grep -RniE "import_string|deserialize|trigger|__import__|eval\(" /opt/airflow/dags

Inspect scheduler and API logs:

grep -RniE "deserialize|import_string|trigger" /opt/airflow/logs

CVE-2026-53481 and CVE-2026-53483: Dell PowerProtect Data Domain critical remote risks

Dell disclosed two critical issues affecting PowerProtect Data Domain. CVE-2026-53481 is a path traversal flaw, and CVE-2026-53483 is an improper authentication flaw. Dell states unauthenticated remote attackers could exploit these issues and recommends upgrading as soon as possible: Dell Advisory.

Why it matters - Backup infrastructure is a high-value target in ransomware operations. - Unauthenticated remote access issues on backup appliances require executive-level urgency. - Compromise here can impact recovery integrity, retention, and incident response options.

Immediate actions - Apply Dell’s recommended updates on all affected releases. - Remove direct internet exposure immediately if present. - Restrict management interfaces to dedicated admin networks. - Validate backup integrity and review recent administrative actions.

Technical Notes

Validate exposure of management interfaces and appliance services from approved networks only:

nmap -Pn <dd-appliance-ip>

Review firewall rules for administrative segmentation:

iptables -S
firewall-cmd --list-all

Sample review points for backup security: - Unexpected new administrators - Changes to retention or replication settings - Disabled alerts or tampered audit logging - Unscheduled configuration exports or support bundle creation

CVE-2011-10043: Perl Module::Load arbitrary module loading

CVE-2011-10043 affects Module::Load versions before 0.22 for Perl and may allow arbitrary code execution if an attacker can influence module names passed to load. Reference details are available from the maintainer write-up and MetaCPAN change history: blog post, changes, diff.

Why it matters - The age of the bug does not eliminate risk if old packaged applications still depend on vulnerable behavior. - This is most relevant for legacy internal tooling and long-lived appliances with embedded Perl components.

Immediate actions - Identify Perl applications that use Module::Load. - Upgrade to version 0.22 or later where supported. - Review code paths that load modules from user-controllable input.

Technical Notes

Check installed module version:

perl -MModule::Load -e 'print $Module::Load::VERSION . "\n"'

Search application code for unsafe dynamic loading:

grep -Rni "Module::Load\|load(" /opt /srv /usr/local 2>/dev/null

What Defenders Should Do Today

1. Patch internet-facing systems first

Prioritize: 1. Adobe ColdFusion 2. Plesk 3. Dell PowerProtect Data Domain 4. Airflow control-plane components 5. Edge routers and exposed management interfaces

If patching cannot happen today, apply compensating controls: - Disable or restrict public access - Enforce VPN-only administration - Add temporary firewall rules - Increase logging and alerting

2. Review trust boundaries, not just CVSS scores

Several items in today’s digest share a pattern: - Airflow breaks the DAG-author to scheduler trust boundary. - Plesk breaks tenant isolation. - GitHub workflows blur trusted automation and untrusted external input. - Router malware and backdoors turn infrastructure into attacker relay points.

That means defenders should map where low-trust actors or inputs can influence higher-trust systems.

3. Hunt for signs of compromise in control planes

Focus on: - Admin panel logins from unusual IPs - Service account misuse - Newly created scheduled tasks or jobs - Unexpected outbound traffic from appliances - Secret access from CI/CD systems - Backup policy or retention changes

Technical Notes

Useful quick checks across Linux hosts:

last -a | head
journalctl -p warning --since "24 hours ago"
ss -tulpn
crontab -l
find /tmp /var/tmp -type f -mtime -2

For web-accessible management panels, search reverse proxy or web logs for unusual methods, paths, or user agents:

grep -RniE "POST|PUT|/api|/xmlrpc|/login" /var/log/nginx /var/log/apache2 /var/log/httpd 2>/dev/null | tail -n 200

4. Reassess CI/CD permissions

For GitHub Actions and similar platforms: - Set least-privilege GITHUB_TOKEN permissions. - Separate workflows for pull requests from forks and trusted internal branches. - Do not expose secrets to workflows triggered by untrusted content. - Pin actions by commit SHA where practical. - Isolate or avoid self-hosted runners for public repository events.

Example minimal workflow permission model:

permissions:
  contents: read
  issues: read

5. Protect backup and recovery systems as tier-one assets

Backup appliances should be treated like domain controllers during triage: - No direct internet exposure - MFA and network segmentation for administration - Centralized logging - Frequent restore testing - Rapid patch windows for critical advisories

Bottom Line

Today’s cybersecurity threats are less about a single headline and more about systemic exposure across control planes, shared platforms, and edge infrastructure. The ColdFusion patch order demands immediate attention, but Plesk, Airflow, Dell backup systems, and router management surfaces also deserve same-day review.

If your team has limited time, spend it on the systems that can grant broad access if compromised: web admin panels, schedulers, backup appliances, and CI/CD automation. That is where today’s risk is concentrated.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.