Expert Roundtable — August 27, 2026 morning

Loading roundtable session...

Expert Roundtable — August 27, 2026 morning | Halil Öztürkci

Halil→Sara KovacsSPECIALIST

Sara KovacsICS/OT safety lens[47 sources]

MODERATOR DIRECTIVE

The source pack reports suspected Iran-affiliated attacks against more than 100 U.S. water and wastewater systems in July, including a Georgia pump failure and reduced pressure, but the evidence is only rated adequate and AI-generated scripts are also alleged. Separate confirmed access, confirmed manipulation, and inferred causation. What should a water-sector operator do in the next six hours without creating a safety outage, and what evidence would justify treating this as a coordinated state campaign rather than opportunistic scanning? Give a firm operational position, not a recap.

My firm position: treat this as an active multi-site intrusion wave, not yet as proven Iranian state sabotage. Reported unauthorized intrusions and degraded operations justify immediate containment; however, public reporting only associates Georgia’s pump failure, reduced pressure, and boil-water advisory with the campaign—it does not demonstrate that attackers issued the command that stopped the pump. The “more than 100” count indicates targeting, not 100 confirmed compromises, and allegedly AI-generated scripts provide almost no attribution value.

For the next six hours:

0–1 hour: Put operations—not IT—in command. Verify pressure, pump state, reservoir levels, treatment parameters, alarms, and interlocks using local panels, field instruments, and sampling. Do not reboot PLCs, patch controllers, download logic, or sever control communications.
1–3 hours: At the Level 3/DMZ boundary, disable unnecessary internet-facing access, vendor sessions, and compromised accounts. If a station can safely run locally under an approved procedure, isolate its remote-control path while retaining monitoring. Test every firewall or segmentation change with the process engineer first.
3–6 hours: Preserve VPN, firewall, HMI, historian, engineering-workstation, and controller logs. Record PLC logic hashes, firmware, setpoints, forced outputs, time synchronization, and current network connections before changing anything. Compare logic and configuration read-only against known-good backups, engage the vendor, and report through CISA/FBI and relevant state water authorities.

Keep the evidence categories strict. Confirmed access requires device, authentication, VPN, or network-session evidence. Confirmed manipulation requires write commands, altered logic/setpoints, forced outputs, or unauthorized mode changes. Causation requires those actions to precede and explain the physical failure while mechanical, electrical, and process-interlock causes are excluded. I would call this a coordinated campaign only after finding repeatable technical linkage across utilities—shared infrastructure or credentials, distinctive scripts, synchronized controller commands, matching logic changes, and common targeting. Calling it a state campaign additionally requires credible intelligence tying that linked infrastructure or operators to state tasking; scanning the same exposed Siemens equipment, geographic clustering, or AI-style code is insufficient.

Sources:

[0]techcrunch.com

[1]www.theregister.com

Halil→Alex Mercer

Alex MercerExploit feasibility lens[27 sources]

MODERATOR DIRECTIVE

Rank the exposed-enterprise threats for a CISO with one emergency change window: PeopleSoft CVE-2026-35273, Gitea CVE-2026-60004, Zimbra CVE-2026-73570, Citrix NetScaler CVE-2026-8452, the SharePoint CVE-2026-55040/CVE-2026-63520 chain, and Microsoft SQL Server CVE-2019-1068. Distinguish active exploitation from probes, state the kill-chain closure and compromise assumptions for each, and tell us which system is isolated before it is patched. Also test whether the PeopleSoft/ShinyHunters headline deserves to outrank Gitea or Zimbra operationally.

My operational ranking is: 1) Zimbra, 2) Gitea, 3) SharePoint, 4) PeopleSoft, 5) NetScaler, 6) SQL Server. Zimbra and Gitea are reported as actively exploited, with Zimbra compromises numbering in the hundreds and Gitea described as RCE. SharePoint has reported in-the-wild targeting with a public exploit chain. PeopleSoft is reportedly exploited, but the available material does not establish enough technical detail or ShinyHunters attribution to put the headline above Gitea or Zimbra.

NetScaler CVE-2026-8452 requires a Gateway or AAA virtual-server configuration. Citrix characterizes its effect as memory corruption causing unpredictable behavior or denial of service; CISA’s June 30 NVD entry marked exploitation as “none,” automatable “yes,” and technical impact “partial.” That does not exclude scanning, but it is not evidence of successful exploitation. SQL Server CVE-2019-1068 is an RCE vulnerability affecting listed SQL Server 2014, 2016, and 2017 releases, but the cited record establishes neither current exploitation nor probe activity.

Isolate exposed, vulnerable Zimbra before patching. It has the strongest evidence of successful compromise rather than mere reachability or scanning. If Zimbra does not meet the vulnerable configuration, give the emergency window to Gitea. The PeopleSoft/ShinyHunters headline does not change that order: attribution is decoration until the exploit path and impact are demonstrated.

Sources:

[0]itpro.com

Halil→Priya NatarajanSPECIALIST

Priya NatarajanCloud security lens[2 sources]

MODERATOR DIRECTIVE

Microsoft observed compromises of exposed LiteLLM, RAGFlow, and Kestra workloads involving secret theft, persistence, command execution, data access, and XMRig; LiteLLM likely chained CVE-2026-42271 and CVE-2026-48710. Define the likely cloud/IAM blast radius and the minimum containment sequence tonight. Which credentials, workloads, logs, and downstream trust relationships must be treated as compromised, and where would broad rotation create more risk than evidence-led scoping? Contrast this real intrusion activity with the context-only agent-escape and GhostJacking research.

Halil, Microsoft’s report describes real intrusion activity, not merely exploit research: exposed LiteLLM, RAGFlow, and Kestra instances were used for secret theft, persistence, command execution, data access, and cryptomining. The LiteLLM CVE chain remains likely, not proven for every victim. Architecturally, assume compromise of the affected VM, pod, task, or function identity—not automatically the entire cloud account. Treat as exposed every environment variable, mounted secret, Kubernetes service-account token, instance/task metadata credential, database credential, LLM-provider key, and vault secret retrievable by that identity. Follow its downstream trust graph: AssumeRole, workload-identity federation, managed identities/service principals, Kubernetes RBAC, CI/CD and registry access, and cross-account resource policies.

Tonight’s minimum sequence is: (1) block public ingress at the load balancer, security group, ingress controller, or firewall while preserving disks and runtime evidence; (2) apply an explicit deny or detach the workload identity, revoke its sessions where supported, and quarantine—not delete—the workload; (3) capture images, process/network state, and application configuration; (4) rotate secrets present or retrievable in that execution context, starting with credentials that can mint other credentials; (5) rebuild from patched, trusted images rather than cleaning in place. Preserve and hunt across AWS CloudTrail/Azure Activity and Entra/GCP Audit Logs, Kubernetes audit logs, secret-manager access, container runtime, DNS and flow telemetry, application/proxy logs, model-provider usage, and database audit logs.

Broad tenant-wide rotation is counterproductive when it causes outages or feeds fresh credentials back into a still-compromised workload. Scope rotation using secret reachability, IAM permissions, and audit evidence—but command execution means a mounted or process-visible secret should be presumed stolen even without an exfiltration log. Escalate to organization-wide rotation only if evidence shows control-plane privilege, credential minting, cross-account role assumption, or compromise of a central vault/CI system. The CSP secures its underlying control plane; public exposure, workload IAM, secret placement, and logging remain customer controls unless evidence identifies a provider-side failure.

The agent-escape material is different: Trail of Bits presents repeated QEMU/KVM escape as research/PoC context, useful for redesigning isolation but not evidence that these victims were compromised through that path. I found no corroborating data here tying GhostJacking to these intrusions, so it should not drive tonight’s credential rotation or attribution without matching telemetry.

Halil→Lena Hartmann

Lena HartmannThreat intelligence lens[3 sources]

MODERATOR DIRECTIVE

Audit the source pack’s confidence claims across three connected stories: ShinyHunters reportedly exploiting PeopleSoft CVE-2026-35273 across more than 300 instances/100 organizations; at least 274 Zimbra servers compromised via CVE-2026-73570; and Tenable/SentinelOne reporting adversary convergence on 79% of vendor attack surfaces with complex flaws patched 24 days later. What is established, what is vendor/researcher attribution, and what inference should defenders not make? Identify the genuine delta from yesterday’s Zimbra discussion and turn the convergence statistic into one defensible prioritization rule.

PeopleSoft: Exploitation and the reported scope—300+ instances across 100 organizations—are researcher claims. ShinyHunters attribution: low confidence without independent infrastructure or forensic corroboration.
Zimbra: The genuine delta is quantified successful compromise: at least 274 servers, beyond yesterday’s evidence of exploitation attempts. Actor attribution remains unknown; confidence in the reported count is moderate because the visible source is secondary reporting.
Convergence study: The 79% overlap and 24-day patch lag are dataset findings, not proof that 79% of any vendor’s products—or customers—were compromised.

One defensible rule: patch internet-facing vendor surfaces appearing in both exploitation datasets ahead of CVSS-only backlog, and do not allow complex flaws to exceed a 24-day remediation window. Overlap establishes prioritization, not attribution or breach probability.

Sources:

[0]waratek.com

[1]itpro.com

[2]nsi-ca.com

Halil ÖztürkciCHECKPOINT

The clearest shift is from headline-driven urgency to evidence-weighted containment. In the water sector, the room is treating this as an active, multi-site intrusion wave that warrants immediate safety-aware action, while withholding the much stronger conclusion of Iranian state sabotage. “More than 100” describes reported targeting, not confirmed compromise, and neither the Georgia pump failure nor allegedly AI-generated scripts proves attacker causation or attribution. Operational verification must therefore come first, with process engineers controlling any isolation or segmentation change and no reflexive rebooting, patching, or severing of control communications.

For the single enterprise change window, successful exploitation evidence outranks severity scores and speculation. Alex puts Zimbra first because the record now indicates hundreds of actual compromises, followed by Gitea, SharePoint, PeopleSoft, NetScaler, and the older SQL Server issue. Lena reinforces the underlying discipline: the PeopleSoft scale and ShinyHunters link remain researcher claims, with attribution especially weak; the Zimbra count is more consequential but still only moderately confident because it comes through secondary reporting. Likewise, the 79% dataset overlap and 24-day lag support prioritizing exposed vendor surfaces and setting remediation limits—they do not establish compromise rates or actor identity.

The cloud cases also broaden the incident boundary without automatically making it account-wide. Exposed LiteLLM, RAGFlow, and Kestra workloads have been associated with real secret theft, persistence, command execution, data access, and cryptomining, although the proposed LiteLLM CVE chain is not proven for every victim. The defensible starting assumption is compromise of the workload identity and everything it could retrieve or assume, followed through cloud roles, service principals, Kubernetes RBAC, CI/CD, registries, and cross-account trust. Public ingress should be blocked, identities constrained, and evidence preserved before eradication.

The next task is to turn these parallel judgments into one defensible operating sequence—especially reconciling rapid containment with OT safety, evidence preservation, identity revocation, and the realities of a single emergency change window.

ACTION 2Focused QueryDISPATCH ONE1m 10s

Halil→James Okafor

James OkaforDefensive response lens[2 sources]

MODERATOR DIRECTIVE

Close the operational loop across the first round. Sara says treat the water-system activity as an active intrusion wave requiring safety-aware containment, but not proven Iranian sabotage or proven cyber causation for the pump failure. Alex ranks exposed systems Zimbra, Gitea, SharePoint, PeopleSoft, NetScaler, then SQL Server, while Lena rates ShinyHunters attribution low confidence and warns that aggregate attack-surface statistics do not prove compromise. Priya says the LiteLLM/RAGFlow/Kestra activity is confirmed intrusion behavior and that secret theft expands the response beyond removing XMRig. Build a sequenced six-hour response that a constrained SOC can execute. Explicitly challenge Alex’s ranking: say when PeopleSoft’s reported 300-plus instances and downstream HR/identity data, NetScaler gateway authority, or legacy SQL exposure should jump ahead. Keep each subject distinct, identify what must be isolated before patching, and define the evidence that triggers credential rotation, rebuild, or safety escalation.

0–1 hour — CRITICAL: Appoint one incident commander and open three separate lanes: water/OT, enterprise applications, and AI infrastructure. For water, preserve controller, HMI, VPN, historian, and engineering-workstation evidence; disable remote access at the IT/OT boundary while retaining local/manual control. Do not reboot or patch controllers. Escalate to the safety team if there is unauthorized logic/set-point change, loss of control or visibility, repeated commands, or physical readings that disagree with independent instrumentation. Cyber causation and Iranian responsibility remain unknown. For LiteLLM/RAGFlow/Kestra, isolate affected hosts or workloads and block egress before changing them; capture cloud audit logs, container state, environment/configuration data, and process trees. Microsoft’s reporting supports treating secret theft and cryptomining as intrusion activity—not merely removing XMRig.

1–3 hours — CRITICAL: Isolate any Zimbra, Gitea, SharePoint, PeopleSoft, NetScaler, or SQL host showing web shells, unknown privileged accounts, suspicious child processes, persistence, or unexplained outbound traffic before patching. Preserve volatile evidence, then block public access or restrict it to an emergency allow-list. Rotate credentials from a clean system when logs show secret/configuration access, session theft, anomalous authentication, or use of service credentials elsewhere. Rebuild from trusted media when attackers obtained root/SYSTEM, modified application binaries, installed persistence, or integrity cannot be established. Gitea active exploitation is reported, but I found no current advisory or patch data on the other named products in the available evidence, so I would not improvise version guidance.

3–6 hours — HIGH: Alex’s ranking is a starting queue, not the operating order. PeopleSoft jumps ahead when one of the reported 300-plus instances is locally exposed and connected to HR, payroll, SSO, or identity-provisioning data; the aggregate count alone does not prove compromise. NetScaler becomes first when it is the authoritative remote-access gateway or suspicious sessions could survive a patch. Legacy SQL moves ahead when directly reachable, unsupported, holding identity/credential stores, or exhibiting lateral or outbound activity. Otherwise, stage verified fixes, patch isolated internet-facing systems first, validate authentication and business workflows, then restore behind restricted access and heightened logging.

Sources:

[0]thehackernews.com

[1]www.microsoft.com

Halil ÖztürkciCHECKPOINT

The operational picture now has a concrete first-three-hours structure: one incident commander, but three distinct response lanes for water/OT, enterprise applications, and AI infrastructure. That separation matters because the containment mechanics are not interchangeable. In the water environment, the priority is preserving controller, HMI, VPN, historian, and engineering-workstation evidence while disabling remote access at the IT/OT boundary without sacrificing local or manual control. Controllers should not be rebooted or patched. Safety escalation is tied to observable conditions—unauthorized logic or set-point changes, repeated commands, loss of control or visibility, or physical readings that conflict with independent instrumentation—not to an unverified attribution narrative. Cyber causation of the pump failure and Iranian responsibility both remain unknown.

For LiteLLM, RAGFlow, and Kestra, James’s sequence is similarly evidence-first: isolate affected workloads, block egress, and capture cloud audit logs, container state, configuration and environment data, and process trees before making changes. Microsoft’s reporting supports treating secret theft and cryptomining as evidence of intrusion activity; simply removing XMRig would not close the incident.

The enterprise lane adds an important qualification to any product-based priority list. Zimbra, Gitea, SharePoint, PeopleSoft, NetScaler, and SQL systems should be isolated before patching when telemetry shows web shells, unknown privileged accounts, suspicious child processes, persistence, or unexplained outbound traffic. That raises the next issue directly: whether Zimbra and Gitea should always sit ahead of the others, or whether observed compromise and exposure conditions must determine the queue. The next challenge will test that fixed ranking against James’s condition-driven approach.

ACTION 3ChallengeCHALLENGE1m 17s

Halil→Alex Mercer

Alex MercerExploit feasibility lens

MODERATOR DIRECTIVE

Claim: Your fixed emergency ranking puts Zimbra and Gitea ahead of SharePoint, PeopleSoft, NetScaler, and SQL Server.
Counter-evidence: James argues that the queue must be conditional: PeopleSoft moves ahead when exposed and tied to HR, payroll, SSO, or identity provisioning; NetScaler becomes first when it is the authoritative remote-access gateway or sessions may survive patching; legacy SQL rises when reachable or holding credential stores. Reconcile the disagreement. Give one decision rule a SOC can apply in ten minutes, and state whether you are revising your ranking.

James is right: the queue must be conditional, so I’m dropping the fixed ranking. NetScaler CVE-2026-8452 and SQL Server CVE-2019-1068 are actively exploited; NetScaler exploitation followed PoC publication and demonstrated pre-authentication RCE against Gateway or AAA configurations. If it is the authoritative remote-access edge, isolate NetScaler first, invalidate sessions, then patch. Session survival after patching remains unconfirmed, but patching is not session revocation.

The SOC’s ten-minute rule is Reachability × Exploitability × Authority. Confirm the vulnerable configuration is reachable, exploitation closes to execution or session compromise, and the asset controls remote access, identities, provisioning, or credentials. Any zero pushes it down. For ties: authority first, then pre-auth RCE, documented compromises, and finally attempts or probes.

PeopleSoft outranks Zimbra or Gitea only when it genuinely controls SSO, provisioning, or critical payroll operations—not merely because “ShinyHunters” appears in a headline. Reachable SQL holding credentials similarly jumps forward. Without those conditions, Zimbra remains ahead because hundreds of compromises are reported, followed by actively exploited Gitea RCE. SharePoint remains conditional because the cited evidence establishes targeting and a public chain, but not the same level of confirmed compromise.

Halil ÖztürkciCHECKPOINT

The fixed vulnerability ranking has been replaced by a conditional triage rule: Reachability × Exploitability × Authority. A system moves to the front only when the vulnerable configuration is reachable, exploitation can produce execution or session compromise, and the asset controls something consequential such as remote access, identity, provisioning, or credentials. If any factor is absent, its priority falls. Ties should be broken by authority first, followed by pre-authentication RCE, documented compromises, and then attempts or probes.

That materially changes the queue. NetScaler should be isolated first when it is the authoritative remote-access edge, given the reported active exploitation of CVE-2026-8452 following publication of proof-of-concept code and the demonstrated pre-authentication RCE path against Gateway or AAA configurations. Isolation should be followed by session invalidation and patching. One caveat remains unresolved: session survival after patching has not been confirmed, but patching alone must not be treated as session revocation. A reachable SQL Server holding credentials can likewise jump forward. PeopleSoft moves ahead of Zimbra or Gitea only when it truly governs SSO, identity provisioning, or critical payroll operations. A prominent threat-actor name in reporting is not enough by itself.

The next step is therefore about precision rather than another ranking change. For PeopleSoft CVE-2026-35273, we need executive language that clearly separates what is confirmed about exploitation and victim scope from what remains uncertain about ShinyHunters attribution.

ACTION 4Follow-UpFOLLOW UP2m 22s

Halil→Lena Hartmann

Lena HartmannThreat intelligence lens[29 sources]

MODERATOR DIRECTIVE

Reduce this to the exact confidence language the executive summary should use. For PeopleSoft CVE-2026-35273, separate confirmed exploitation and victim scope from ShinyHunters attribution. For Zimbra, explicitly separate the current CVE-2026-73570 compromises from Laundry Bear’s use of CVE-2025-66376. Finally, tell us whether the 79% attack-surface convergence statistic supports changing tonight’s patch order or only the longer-term exposure model.

PeopleSoft: “CVE-2026-35273 exploitation is confirmed—high confidence. Some compromises and data theft are confirmed, but ‘300 instances across 100+ organizations’ is a ShinyHunters claim—not a verified victim count—low confidence. ShinyHunters attribution is vendor/researcher attribution—moderate confidence.”
Zimbra: “Shadowserver detected probable CVE-2026-73570 compromise artifacts on 274 IPs—moderate confidence in that compromise count. The actor is unknown. Laundry Bear’s separate CVE-2025-66376 activity does not support attribution of this campaign—low confidence in any linkage.”
Convergence: The 79% statistic should not independently reorder tonight’s patches. Tonight, prioritize confirmed exploitation plus local internet exposure; use convergence only as a tie-breaker and as a longer-term weighting for repeatedly targeted edge vendors.

Sources:

[2]x.com

[5]www.helpnetsecurity.com

[6]nvd.nist.gov

[7]pathlock.com

[8]arcticwolf.com

[9]www.sentinelone.com

[10]attack.mitre.org

[11]www.sentinelone.com

[12]attack.mitre.org

Halil ÖztürkciCHECKPOINT

The confidence picture is now sharply separated from the headline claims. For PeopleSoft CVE-2026-35273, exploitation is confirmed with high confidence, and some compromises and data theft are confirmed. But the figure of “300 instances across 100+ organizations” remains an unverified ShinyHunters claim, so the room should treat that victim count with low confidence. Attribution to ShinyHunters rests on vendor and researcher assessments rather than independently conclusive evidence, supporting only moderate confidence.

For Zimbra CVE-2026-73570, Shadowserver’s detection of probable compromise artifacts on 274 IPs supports moderate confidence in that count—not certainty about 274 distinct victims or organizations. The actor remains unknown. Laundry Bear’s activity involving the separate CVE-2025-66376 does not establish involvement in this campaign; any linkage should be described as low confidence and should not appear as settled attribution.

The operational consequence is equally important: the 79% convergence statistic does not independently justify changing tonight’s patch order. Immediate triage should still follow confirmed exploitation and local internet exposure, with convergence used only to break close ties or to inform longer-term weighting for edge vendors that are repeatedly targeted.

We now turn from calibrating incident claims to calibrating a policy claim. The reported prospect of U.S. authorization for private-sector offensive operations carries significant legal and strategic implications, but the source pack apparently lacks authoritative policy support. The next step is therefore to determine exactly what can be said, what remains merely reported, and which legal boundaries must not be inferred without primary evidence.

ACTION 5Focused QueryDISPATCH ONE2m 25s

Halil→Sofia Andersen

Sofia AndersenRegulatory obligation lens[30 sources]

MODERATOR DIRECTIVE

The source pack says the United States will reportedly permit private-sector contractors to conduct offensive operations against cybercriminals, but it provides no authoritative policy text defining scope, oversight, liability, targets, or effective date. Pending such text, what interim legal guardrail should private firms follow? Name the specific official confirmation or authorization elements that would trigger reassessment. This is not a request to design an offensive operation; give a board-ready legal risk position.

Halil, the board-ready position is no-go: firms should not access, disrupt, surveil, or alter third-party systems unless and until they receive operation-specific written governmental authority. Current reporting and legal commentary describe a prospective federal program, but they do not substitute for authoritative policy text or company-specific authorization. Defensive activity should remain confined to systems the firm owns or is contractually authorized to test.

Reassessment should require: (1) verified White House, Federal Register, DOJ, or DHS confirmation stating the legal basis, scope, effective date, and responsible authorities; (2) final implementing procedures covering contractor eligibility, oversight and deconfliction; and (3) a signed company-specific contract or task order defining approved targets, techniques/effects, geography, duration, rules of engagement, evidence handling, reporting, suspension, and audit. Counsel should additionally require written treatment of CFAA and state-law exposure, cross-border authority or host-state consent, sanctions/export controls, indemnification, and liability for collateral harm. A general announcement—or even a presidential framework—would not itself authorize unilateral “hack back.”

Sources:

[0]risky.biz

[1]www.paulweiss.com

[2]www.mayerbrown.com

[4]btlaw.com

Halil ÖztürkciCHECKPOINT

The operational threshold is now clear: reported plans for U.S. private-sector offensive cyber operations do not constitute permission for any company to act. Sofia Andersen’s board-ready recommendation is therefore no-go. Firms should not access, surveil, disrupt, or alter third-party systems without operation-specific, written governmental authority. Defensive work should remain limited to systems the firm owns or is contractually authorized to test.

Any reassessment would require authoritative confirmation from the White House, Federal Register, DOJ, or DHS establishing the legal basis, scope, effective date, and responsible authorities. It would also require final procedures for contractor eligibility, oversight, and deconfliction, followed by a signed company-specific contract or task order. That authorization would need to define targets, permitted techniques and effects, geography, duration, rules of engagement, evidence handling, reporting, suspension, and audit. Counsel would still need written treatment of CFAA and state-law exposure, cross-border authority or host-state consent, sanctions and export controls, indemnification, and liability for collateral harm.

The key caveat is that the source pack contains reporting and commentary about a prospective program, but no authoritative policy text resolving those issues. This legal recommendation was also not tested through peer consultation in this action. Even so, the absence of operative authority supports a conservative conclusion: announcements or general policy signals cannot safely be converted into corporate authorization. We can carry that distinction into the final synthesis—reported intent is not legal permission, and offensive action remains off the table until the required governmental and company-specific documentation exists.

Halil ÖztürkciCLOSING

Active compromise of exposed control planes defines the day. Reported attacks on U.S. water systems justify safety-aware containment, although Iranian attribution and cyber causation of the Georgia pump failure remain unproven. Microsoft directly observed compromises of exposed AI platforms, while PeopleSoft, Gitea, and Zimbra require immediate exposure and compromise reviews. The panel rejected a fixed patch ranking: reachability, operational authority, credential access, and compromise evidence determine priority.

Key Findings

Microsoft observed LiteLLM, RAGFlow, and Kestra compromises involving secret theft, persistence, command execution, data access, and cryptomining.

Reporting indicates exploitation of PeopleSoft CVE-2026-35273; the claimed “300 instances/100 organizations” scope remains unconfirmed, and researcher attribution to ShinyHunters is moderate-confidence.

Reporting says Gitea CVE-2026-60004 was added to CISA KEV, but that status requires verification; separate reporting describes hundreds of Zimbra CVE-2026-73570 compromises.

Zimbra CVE-2026-73570 must not be conflated with Laundry Bear’s separate exploitation of CVE-2025-66376.

Private offensive operations remain a no-go without operation-specific written governmental authority.

Action Items

CRITICAL

For water utilities implicated by the reported campaign, restrict remote OT access, preserve controller and historian evidence, retain manual control, and escalate on confirmed logic or set-point changes.

CRITICAL

Investigate exposed Oracle PeopleSoft PeopleTools 8.61/8.62 for reported CVE-2026-35273 exploitation before patching or restoring trust.

CRITICAL

Verify CISA KEV status for Gitea CVE-2026-60004; according to reporting, review exposed versions 1.17–1.27.0 and upgrade to 1.27.1 as warranted.

CRITICAL

Upgrade Zimbra Collaboration Suite to 10.1.20 and examine exposed servers for persistence tied to reported CVE-2026-73570 exploitation.

CRITICAL

Isolate compromised LiteLLM, RAGFlow, or Kestra workloads, preserve cloud evidence, block egress, and rotate all exposed secrets; Microsoft observed this intrusion activity.

HIGH

Restrict exposed SharePoint servers and investigate the reported CVE-2026-55040/CVE-2026-63520 chain; probes are reported, but code execution remains unconfirmed.

HIGH

Validate current vendor evidence for NetScaler CVE-2026-8452 and prioritize exposed Gateway or AAA systems that control remote access.

MEDIUM

Verify SQL Server CVE-2019-1068 exposure and official exploitation status rather than assuming the source pack’s active-exploitation label is settled.