CYBER THREATCAST

Patch Citrix NetScaler ADC and Gateway appliances immediately, prioritizing internet-exposed systems, and investigate for compromise that predates remediation. Attackers are exploiting two critical remote-code-execution flaws worldwide, with about 22,000 NetScaler systems reportedly exposed; affected releases include ADC and Gateway versions before 13.1-64.23 and 14.1-73.37.

Apply Microsoft's fix for SharePoint Server CVE-2026-65660 and examine supported SharePoint Server 2016, 2019, and Subscription Edition systems for webshells or other compromise. Microsoft has reliable evidence of active exploitation, public proof-of-concept code is reported, and observed attacks attempted to install webshell backdoors; CISA added the flaw to its KEV catalog with a September 28 federal remediation deadline.

Investigate Palo Alto Networks GlobalProtect gateways for exploitation of CVE-2026-0257, unauthorized VPN sessions and subsequent data theft. Operation Master used the flaw to establish sessions without valid credentials, compromised seven gateways in four countries, deployed AdaptixC2 against at least two Windows server identities and exfiltrated some records through structured DNS requests; businesses serving Brazilian customers and energy-sector organizations face documented exposure.

Upgrade Roundcube Webmail to 1.6.16 or 1.7.1 wherever the virtuser_query plugin is enabled, and prioritize installations running 1.6.x before 1.6.16 or 1.7.x before 1.7.1. CVE-2026-48842 permits unauthenticated SQL injection in configurations using that plugin and is reportedly being exploited in the wild.

Install Oracle's official PeopleSoft fix rather than relying on temporary mitigations, then assess exposed environments for unauthorized access and theft of payroll, banking, employee or personnel records. ShinyHunters reportedly renewed attacks after bypassing temporary mitigations where the official fix was absent, affecting government, healthcare, higher education and automotive organizations worldwide.