CYBER THREATCAST

Restrict or remove internet exposure for SimpleHelp RMM immediately, then review all technician sessions, file-transfer activity, and remote-execution events for signs of unauthorized use. Attackers exploited CVE-2026-48558 to forge OpenID Connect login tokens, gain authenticated Technician sessions without credentials, and deploy TaskWeaver and Djinn Stealer; MSPs should also assess downstream customer environments because trusted RMM access can turn one compromised server into customer compromise.

Lock down Oracle PeopleSoft Environment Management Hubs and investigate for automated, passwordless access attempts tied to CVE-2026-35273. Attackers exploited the critical PeopleSoft remote-code-execution zero-day in a ShinyHunters-linked campaign, and Nissan disclosed employee data theft involving names, banking information, tax and financial records, national ID numbers, and possibly Social Security numbers; organizations running exposed PeopleSoft systems should treat suspicious access as a potential data breach, not just a vulnerability event.

Apply Oracle’s May 2026 updates for Oracle E-Business Suite Payments and hunt for POST requests to /OA_HTML/ibytransmit on versions 12.2.3 through 12.2.15. CVE-2026-46817 is a 9.8-rated Oracle Payments File Transmission flaw under active exploitation, and more than 900 Oracle E-Business Suite instances were reported exposed online; finance and ERP teams should prioritize externally reachable systems and preserve logs before remediation where compromise is suspected.

Verify April 2026 Microsoft Defender updates are installed on Windows systems and prioritize any gaps as ransomware exposure. CVE-2026-33825, the BlueHammer privilege-escalation flaw, was observed by Huntress before patches were available, Microsoft patched it in April, and CISA added it to the Known Exploited Vulnerabilities catalog with ransomware use noted; incident responders should review unpatched endpoints for post-exploitation activity rather than assuming antivirus presence reduced risk.

Inventory libssh2 and self-hosted Gitea Docker deployments, apply available fixes or upstream commits where operationally feasible, and isolate systems until vendors ship tagged releases. Public exploit code was dumped for multiple products, including actively exploited CVE-2026-55200 in libssh2 and CVE-2026-20896 in Gitea Docker deployments; a malicious SSH server can trigger the libssh2 flaw before authentication, while the Gitea issue can allow user impersonation and Git server takeover.