CYBER THREATCAST

Patch Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 immediately for CVE-2026-35273, and review internet-exposed Environment Management Hub access to /PSEMHUB/hub. The CVSS 9.8 unauthenticated remote code execution flaw was exploited as a zero-day before Oracle released a fix, is now in CISA’s KEV catalog, and was used by UNC6240/ShinyHunters against higher education organizations.

Upgrade Citrix NetScaler ADC and NetScaler Gateway SAML IdP deployments to fixed builds—13.1-63.18 or later, or 14.1-72.61 or later—and investigate malformed SAML AuthnRequest activity to POST /saml/login. CVE-2026-8451 was exploited less than 24 hours after patches were released, and crafted unauthenticated requests can leak protected process memory through NSC_TASS cookie responses.

Prioritize Cisco Secure Firewall Management Center exposure checks, patch planning, and compromise hunting for CVE-2026-20131. SOCRadar reports Interlock ransomware operators exploited the critical insecure deserialization flaw to execute arbitrary Java code and gain root access, with activity involving JavaScript and Java RATs, a fileless webshell, HAProxy, and PowerShell reconnaissance.

Remove internet exposure from Langflow instances, patch CVE-2025-3248, and inspect connected MinIO, MySQL, PostgreSQL, Nacos, and database systems for stolen secrets or configuration tampering. Sysdig reported attackers exploited a critical Langflow authentication bypass for code execution, used an LLM to hunt secrets and pivot, abused Nacos weaknesses including CVE-2021-29441, and encrypted 1,342 configuration items.

Harden AWS and Microsoft 365 accounts against AndroxGh0st by remediating exposed web applications tied to CVE-2021-41773, CVE-2018-15133, and CVE-2017-9841, then hunt with the reported domains, hashes, and IP indicators. SOCRadar tracks active scanning and exploitation of public-facing applications by the Python malware campaign to target cloud and Microsoft 365 accounts.