CISA Flags Active Exploitation as Snowflake Theft Case Advances

Top Stories

CISA warns of active exploitation targeting Langflow, N-central, and Apache Tomcat

CISA added vulnerabilities affecting Langflow, N-central, and Apache Tomcat to its active exploitation warning pipeline, giving U.S. federal agencies three days to mitigate them, according to BleepingComputer (source).

Why it matters: when CISA sets a short remediation deadline, defenders should treat that as a high-confidence sign that exploitation is already operational, not theoretical.

What to do now: - Inventory exposed Langflow, N-central, and Tomcat instances. - Prioritize internet-facing systems first. - Review recent admin logins, configuration changes, and web shell indicators. - If emergency patching is not possible, restrict access with IP allowlists, VPN gating, or reverse proxy controls. For more on reverse proxy security best practices, visit our guide here.

Canadian pleads guilty in Snowflake cloud data-theft attacks

A Canadian man pleaded guilty to participating in the Snowflake-related data theft campaign that impacted at least 165 organizations, per BleepingComputer (source).

Why it matters: this case remains a strong reminder that cloud account compromise often comes down to identity hygiene, exposed credentials, missing MFA, and weak monitoring rather than exotic zero-days.

What to do now: - Audit Snowflake and other cloud data platforms for MFA enforcement, token sprawl, and dormant accounts. - Review login telemetry for impossible travel, unfamiliar IP space, and scripted access patterns. - Rotate credentials tied to service accounts and third-party integrations where justified.

Ransom Cartel ransomware creator sentenced to 16 years

Maksim Silnikau, identified as the creator and administrator of the Ransom Cartel operation, was sentenced to 16 years in prison, according to BleepingComputer (source).

Why it matters: law enforcement pressure on ransomware operators is meaningful, but it does not reduce near-term operational risk for defenders. Affiliates, leaks, tooling reuse, and copycat groups persist.

What to do now: - Maintain tested offline backups. - Verify EDR coverage for lateral movement and credential theft behaviors. - Reassess ransomware playbooks for business-critical systems and recovery sequencing.

Researchers say Chinese-made Zbtlink routers contain a backdoor

Reuters reported that researchers identified a backdoor in Zbtlink routers, raising concerns around edge-device trust and supply-chain exposure (source.

Why it matters: unmanaged or low-cost network gear often sits outside normal enterprise monitoring and patch workflows.

What to do now: - Enumerate small-office and branch routers. - Check for unsupported or unmanaged hardware in production. - Move admin interfaces off the public internet and rotate device credentials.

Attackers ran the khunt post-exploitation toolkit from inside an Oracle database

BleepingComputer reported on attackers exploiting SQL injection and installing the khunt post-exploitation toolkit directly inside an Oracle database during a corporate network breach (source).

Why it matters: defenders should assume attackers will abuse databases as execution and persistence surfaces, not just data stores.

What to do now: - Review database audit logs for suspicious stored procedures, jobs, or external calls. - Hunt for newly created users, unusual scheduler activity, and outbound connections from database hosts. - Reassess application-layer SQL injection defenses and WAF visibility.

COLDCARD phishing campaign pushes ScreenConnect remote access software

A phishing campaign is exploiting concern around a recent COLDCARD wallet vulnerability and a suspected major Bitcoin theft to trick victims into installing ScreenConnect, according to BleepingComputer (source).

Why it matters: attackers are turning breaking security news into lures fast, using fake remediation or audit messaging to get remote access tools onto endpoints.

What to do now: - Warn users not to install support tools from email links or social posts. - Restrict remote admin tools to approved IT workflows. - Alert on new ScreenConnect installations outside change windows.

Google Blogger locked blogs in a malware false positive event

Google reportedly locked hundreds of Blogger sites after false positives triggered malware policy enforcement, with some sites deleted, according to BleepingComputer (source).

Why it matters: automated trust and safety enforcement can disrupt legitimate publishing and business operations, especially for teams using third-party platforms.

What to do now: - Keep independent backups of hosted content. - Maintain alternate communication channels and domains. - Document emergency recovery processes for SaaS content platforms.

AI-powered phishing is outpacing traditional blocklists

BleepingComputer highlighted research arguing that AI-assisted phishing infrastructure changes too quickly for blocklist-based defenses to keep up (source).

Why it matters: defenders relying mainly on domain and URL deny lists will increasingly miss short-lived, personalized, and fast-rotating phishing campaigns.

What to do now: - Emphasize browser isolation, identity protections, and behavior-based detection. - Strengthen MFA, conditional access, and session risk monitoring. - Train users on workflow verification, not just suspicious-domain spotting.

Critical Vulnerabilities

CVE-2026-10090: Red Hat Advanced Cluster Management privilege escalation

• CVSS: 9.9
• Affected area: Application Subscription controller in Red Hat Advanced Cluster Management for Kubernetes
• Risk: a user with namespace-scoped edit rights can create a malicious Channel and Subscription to deploy cluster-scoped resources and escalate to full cluster-admin.
• References: Red Hat advisory, Bugzilla

Defender takeaway: if you run ACM in shared or delegated admin models, validate who can create Channel and Subscription resources right now.

CVE-2026-71268: OpenPLC Runtime arbitrary file write leading to RCE

• CVSS: 9.9
• Affected area: compile_program() in webserver/openplc.py
• Risk: uploaded Structured Text files can abuse (*FILE:path content*) directives to write attacker-controlled files outside the intended directory, potentially leading to remote code execution.
• References: Project repository, Relevant source file

Defender takeaway: OpenPLC deployments should be treated as high priority, especially if reachable over a network and still using default credentials.

CVE-2026-61484: Apache Lucy deserialization flaw

• CVSS: 9.8
• Status: unsupported project, no fix planned
• References: Apache thread, Openwall post

Defender takeaway: if Apache Lucy is still present anywhere, compensating controls are not enough for the long term. Plan migration.

CVE-2026-61486: Apache Lucy stack-based buffer overflow

• CVSS: 9.8
• Status: unsupported project, no fix planned
• References: Apache thread, Openwall post

Defender takeaway: this is another signal to identify and retire abandoned components before they become permanent exposure.

CVE-2026-71207: Stock-Inventory-Management-System auth bypass

• CVSS: 9.8
• Affected area: login.php
• Risk: SQL injection-based authentication bypass plus hardcoded admin credential logic.
• Reference: Source file

Defender takeaway: if this application is deployed anywhere, assume compromise is possible if internet exposed and isolate it immediately.

What Defenders Should Do Today

1. Patch and contain actively exploited systems first.
   Start with any exposed Langflow, N-central, and Apache Tomcat assets mentioned in CISA reporting (source).

2. Audit cloud identity controls.
   The Snowflake case reinforces the need for MFA, token governance, anomaly detection, and aggressive credential hygiene (source).

3. Hunt for database-driven post-exploitation.
   If you operate Oracle or other major databases, look for abuse of scheduler jobs, suspicious external calls, and unusual admin actions following web-layer attacks (source).

4. Tighten remote access tool controls.
   Block or heavily monitor unsanctioned ScreenConnect and similar tooling in response to phishing-led installation attempts (source).

5. Review edge-device trust.
   Investigate router inventory, firmware provenance, and whether any branch devices fall outside patch management or monitoring.

6. Replace unsupported software.
   Apache Lucy’s newly listed issues matter because there is no vendor fix path. Unsupported software should move from “technical debt” to “security risk” status.

Technical Deep Dive

Technical Notes: Quick checks for internet-facing exposure

Use asset inventory, reverse proxies, and port scans to identify externally reachable admin surfaces.

# Example: enumerate known web services and banners
nmap -sV -Pn -p 80,443,8080,8443 <target-range>

# Search internal DNS or CMDB exports for likely products
grep -Ei 'langflow|tomcat|n-central|openplc' asset-inventory.csv

If you do not have a formal CMDB, export public DNS, load balancer backends, and VPN-less admin portals first.

Technical Notes: Hunt for suspicious remote access tool installs

On Windows endpoints, check recent software installs and service creation around phishing reports.

Get-WinEvent -LogName System | Where-Object {
  $_.Id -in 7045,7036
} | Select-Object TimeCreated, Id, ProviderName, Message | Sort-Object TimeCreated -Descending

Look for terms such as: - ScreenConnect - ConnectWise - unexpected service names - silent install switches in command lines

Sysmon-heavy environments should also review: - Event ID 1 for process creation - Event ID 7 for image loads - Event ID 11 for file creation in unusual temp or user directories

Technical Notes: Oracle and database post-exploitation hunting

Review database host telemetry for unusual outbound traffic and scheduler activity.

# Linux example: identify unexpected outbound connections from DB hosts
ss -plant | grep -E 'oracle|1521'
journalctl -S today | grep -Ei 'cron|sql|oracle|scheduler|job'

Questions to answer: - Were new scheduled jobs created after a web app alert? - Did the database begin reaching out to unfamiliar IPs? - Were stored procedures modified outside maintenance windows?

Technical Notes: Kubernetes RBAC review for ACM environments

For environments concerned about CVE-2026-10090, validate who can create or manage the affected resources.

kubectl get rolebindings,clusterrolebindings -A | grep -Ei 'subscription|cluster-admin|open-cluster-management'
kubectl auth can-i create subscriptions --as=<user> -n <namespace>
kubectl auth can-i create channels --as=<user> -n <namespace>

Also review for unexpected cluster-scoped resources created from application subscription flows: - ClusterRole - ClusterRoleBinding - service accounts tied to tenant namespaces with elevated roles

Technical Notes: Log patterns worth prioritizing today

Focus detections on these patterns: - Cloud identity: successful logins from new ASN, impossible travel, sudden bulk data access. - Web exploitation: bursts of 4xx/5xx responses followed by admin session creation or shell upload. - Database abuse: new jobs, new users, suspicious external procedures, or outbound connections. - Phishing to RAT: email click followed by installer execution and a new remote access service. - Router compromise: management logins from unknown IPs and unexpected config changes.

Bottom Line

Today’s threat picture combines three recurring defender lessons: active exploitation moves faster than normal patch cycles, identity failures still drive major cloud breaches, and attackers keep expanding into overlooked infrastructure layers such as routers and databases.

For most teams, the best use of today’s time is simple: - patch what CISA is flagging, - verify cloud identity controls, - hunt for post-exploitation signs in databases and remote access tooling, - and start retiring unsupported software before it becomes the next incident.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.