Major Incidents or Breaches

  • Two unpatched zero-day remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances are being actively exploited in the wild [1].
  • The ShinyHunters extortion group is exploiting Oracle PeopleSoft CVE-2026-35273 using a web application firewall bypass technique, enabling renewed attacks [3].
  • A campaign involving compromised GitHub Actions was re-enabled and remained accessible for over a week, with workflows still pointing to malicious Mini Shai-Hulud payloads [6].
  • The Microsoft SharePoint vulnerability CVE-2026-65660 is now being actively exploited, prompting CISA to add it to the Known Exploited Vulnerabilities catalog [8].

Newly Discovered Vulnerabilities

  • Two new unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and Gateway appliances allow for remote code execution and are under active exploitation [1].

Notable Threat Actor Activity

  • The ShinyHunters group is using a URL-encoding trick to bypass web application firewall rules and exploit Oracle PeopleSoft CVE-2026-35273 [3].
  • The Lunex Stealer malware-as-a-service platform is distributing the Psychedelic Stealer via compromised Ukrainian websites, abusing an AMD driver to disable security monitoring and exfiltrate browser credentials [2].

Trends, Tools, or Tactics of Interest

  • Threat actors are leveraging URL-encoding techniques to bypass web application firewall protections in Oracle PeopleSoft attacks [3].
  • The Lunex Stealer platform demonstrates the increasing sophistication of malware-as-a-service offerings, including advanced evasion tactics such as abusing legitimate drivers to disable security tools [2].
  • Compromised third-party GitHub Actions remain a persistent risk, with attackers able to maintain malicious payloads even after initial takedowns [6].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has added Microsoft SharePoint CVE-2026-65660 to its Known Exploited Vulnerabilities catalog, setting a federal patching deadline of September 28 [8].
  • The United States and China have agreed to establish a dedicated communication channel for artificial intelligence safety incidents as part of ongoing trade and military discussions [9].
  • Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after reports of Office 2016 and Office 2019 license deactivations and removals [5].

Sources#

  1. Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation - thehackernews.com
  2. ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks - bleepingcomputer.com
  3. GitHub Actions re-enabled with Mini Shai-Hulud payload still active - bleepingcomputer.com
  4. Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks - securityweek.com
  5. Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials - thehackernews.com
  6. China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks - securityweek.com
  7. Microsoft pauses KB5002907 update after Office license deactivations - bleepingcomputer.com