Security Analyst: 2026-09-28
19 minutes in total
Canadian Centre for Cyber Security, 2026-09-27. Read, 5 min.
The Cyber Centre warns of two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, and says reports indicate they are being exploited across multiple Citrix customer environments worldwide, although the full extent of the activity remains unknown. It asks organizations to review Citrix's September 27 bulletin, prioritize Internet-facing systems, and investigate for signs of compromise.
Why it matters for this role: Request the NetScaler logs, remote syslog records, and support bundles before those appliances are patched or rebuilt, since the Cyber Centre also asks organizations to investigate for signs of compromise.
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Google Cloud (Mandiant and Google Threat Intelligence Group), 2026-09-25. Read, 14 min.
Mandiant and Google Threat Intelligence Group report renewed mass exploitation of the Oracle PeopleSoft vulnerability CVE-2026-35273 by UNC6240 (ShinyHunters), which modified its exploit to bypass WAF rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint, and say their analysis indicates web shells were deployed on dozens of systems globally, in sectors including higher education, healthcare, and government. Oracle released a Security Alert for the flaw on June 10, 2026, and the post says the campaign targets organizations that implemented WAF rules but did not patch.
Why it matters for this role: Mandiant's quick guide names two leads for PeopleSoft hosts, an unexpected MeshCentral agent and outbound traffic to the indicators it lists, and either one is reason to open a case.
Sign in to take it.