Incident Responder: 2026-09-28
19 minutes in total
Canadian Centre for Cyber Security, 2026-09-27. Read, 5 min.
The Cyber Centre warns of two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, and says reports indicate they are being exploited across multiple Citrix customer environments worldwide, although the full extent of the activity remains unknown. It asks organizations to review Citrix's September 27 bulletin, prioritize Internet-facing systems, and investigate for signs of compromise.
Why it matters for this role: Under this alert, a suspected NetScaler compromise means isolating the appliance, assessing credential exposure, and being ready to reset credentials, invalidate sessions, and replace certificates, as the Cyber Centre lists.
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Google Cloud (Mandiant and Google Threat Intelligence Group), 2026-09-25. Read, 14 min.
Mandiant and Google Threat Intelligence Group report renewed mass exploitation of the Oracle PeopleSoft vulnerability CVE-2026-35273 by UNC6240 (ShinyHunters), which modified its exploit to bypass WAF rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint, and say their analysis indicates web shells were deployed on dozens of systems globally, in sectors including higher education, healthcare, and government. Oracle released a Security Alert for the flaw on June 10, 2026, and the post says the campaign targets organizations that implemented WAF rules but did not patch.
Why it matters for this role: Inspect the PSEMHUB.war directory for files that are not part of the shipped product and rotate credentials the PeopleSoft service account can read, two steps in Mandiant's quick guide.
Sign in to take it.