Cybersecurity Brief – 2026-09-27

Sun, 27 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Two unpatched zero-day remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances are being actively exploited in the wild ^[1].
The ShinyHunters extortion group is exploiting Oracle PeopleSoft CVE-2026-35273 using a web application firewall bypass technique, enabling renewed attacks ^[3].
A campaign involving compromised GitHub Actions was re-enabled and remained accessible for over a week, with workflows still pointing to malicious Mini Shai-Hulud payloads ^[6].
The Microsoft SharePoint vulnerability CVE-2026-65660 is now being actively exploited, prompting CISA to add it to the Known Exploited Vulnerabilities catalog ^[8].

Two new unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and Gateway appliances allow for remote code execution and are under active exploitation ^[1].

The ShinyHunters group is using a URL-encoding trick to bypass web application firewall rules and exploit Oracle PeopleSoft CVE-2026-35273 ^[3].
The Lunex Stealer malware-as-a-service platform is distributing the Psychedelic Stealer via compromised Ukrainian websites, abusing an AMD driver to disable security monitoring and exfiltrate browser credentials ^[2].

Threat actors are leveraging URL-encoding techniques to bypass web application firewall protections in Oracle PeopleSoft attacks ^[3].
The Lunex Stealer platform demonstrates the increasing sophistication of malware-as-a-service offerings, including advanced evasion tactics such as abusing legitimate drivers to disable security tools ^[2].
Compromised third-party GitHub Actions remain a persistent risk, with attackers able to maintain malicious payloads even after initial takedowns ^[6].

CISA has added Microsoft SharePoint CVE-2026-65660 to its Known Exploited Vulnerabilities catalog, setting a federal patching deadline of September 28 ^[8].
The United States and China have agreed to establish a dedicated communication channel for artificial intelligence safety incidents as part of ongoing trade and military discussions ^[9].
Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after reports of Office 2016 and Office 2019 license deactivations and removals ^[5].