CYBER THREATCAST

Identify every Oracle PeopleSoft PeopleTools 8.61 and 8.62 deployment and treat exposed instances as potential compromise until validated. Attackers are actively exploiting unauthenticated RCE CVE-2026-35273 in PeopleSoft, and Nissan has disclosed employee data exposure tied to the campaign; reported stolen data includes names, banking information, tax and financial records, and national ID numbers. PeopleSoft customers should prioritize external attack-surface review, access-log analysis, credential review, and containment planning for systems that handle HR, finance, or ratings data.

Take internet-facing SimpleHelp RMM servers running 5.5.1 through 5.5.15 or 6.0 pre-release builds before RC2 out of exposure until remediated and reviewed. CVE-2026-48558 lets unauthenticated attackers forge OpenID Connect identity tokens, obtain trusted technician sessions, and use SimpleHelp file transfer and remote execution features to deploy TaskWeaver and Djinn Stealer. MSPs and customers using SimpleHelp should audit technician sessions, file transfers, remote execution activity, and downstream customer access from affected servers.

Confirm Microsoft Defender and the Microsoft Malware Protection Engine have received Microsoft’s fix for BlueHammer CVE-2026-33825, then hunt for activity before the patch landed. CISA added the flaw to Known Exploited Vulnerabilities and flagged ransomware use, while Huntress observed pre-patch exploitation. Windows environments that depend on Defender should verify engine update status, investigate suspicious Defender-related behavior, and prioritize systems that would give ransomware operators broad access if compromised.

Rotate Fortinet FortiGate administrator and SSL VPN credentials and review internet-facing FortiGate devices for unauthorized access rather than waiting for a CVE patch. FortiBleed reportedly exposed working credentials for about 75,000 FortiGate firewalls across 194 countries through stolen configuration files, password reuse, and offline cracking of legacy hashes. Operators should assume valid credentials may be the intrusion path, check for firewall use as a listening post, and prioritize accounts reused across FortiOS and internal systems.

Update Amazon Q Developer to language server version 1.65.0 and review repositories for untrusted Model Context Protocol configuration files such as .amazonq/mcp.json. CVE-2026-12957 allowed repository MCP server configurations to execute automatically without user consent, and Wiz Research demonstrated that a malicious configuration could exfiltrate AWS credentials and API tokens inherited from the parent environment. Developer teams using the VS Code Amazon Q extension should restrict repository-supplied MCP execution and check whether sensitive tokens were exposed during prior use.