Cybersecurity Specialist: 2026-09-28
28 minutes in total
Canadian Centre for Cyber Security, 2026-09-27. Read, 5 min.
The Cyber Centre warns of two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, and says reports indicate they are being exploited across multiple Citrix customer environments worldwide, although the full extent of the activity remains unknown. It asks organizations to review Citrix's September 27 bulletin, prioritize Internet-facing systems, and investigate for signs of compromise.
Why it matters for this role: Sequence this week's NetScaler work as evidence first and patch second, where feasible, because the Cyber Centre reports exploitation across Citrix customer environments worldwide.
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Google Cloud (Mandiant and Google Threat Intelligence Group), 2026-09-25. Read, 14 min.
Mandiant and Google Threat Intelligence Group report renewed mass exploitation of the Oracle PeopleSoft vulnerability CVE-2026-35273 by UNC6240 (ShinyHunters), which modified its exploit to bypass WAF rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint, and say their analysis indicates web shells were deployed on dozens of systems globally, in sectors including higher education, healthcare, and government. Oracle released a Security Alert for the flaw on June 10, 2026, and the post says the campaign targets organizations that implemented WAF rules but did not patch.
Why it matters for this role: Look past the WAF rule on any PeopleSoft system still missing Oracle's June 10 Security Alert patch and check it for web shells, which Mandiant's analysis indicates the actor placed on dozens of systems.
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
Patchstack, 2026-09-25. Read, 9 min.
Patchstack disclosed a cross-site request forgery vulnerability in the Elementor Website Builder plugin for WordPress, in which one link opened by a logged-in user makes that user carry out any REST API action their account is permitted to perform, so that on a stock installation an administrator clicking the link creates a second administrator account for the attacker. Elementor fixed it in version 4.3.2, released September 24, 2026.
Why it matters for this role: Any WordPress site on Elementor 4.3.0 or 4.3.1 needs 4.3.2, because on a stock install one link clicked by a signed-in administrator creates a second administrator account for an attacker.
Sign in to take it.