CYBER THREATCAST

Update exposed Citrix NetScaler ADC and NetScaler Gateway appliances immediately, then preserve forensic evidence and investigate them for compromise. CVE-2026-88771 and CVE-2026-88772 are in CISA’s KEV catalog and are under active global exploitation; attackers have gained unauthenticated command execution and reportedly installed persistent webshells. A public proof of concept is also available for CVE-2026-88771, increasing the risk to roughly 22,000 internet-exposed systems.

Remediate CVE-2026-65660 on Microsoft SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, and perform forensic triage rather than treating the update as routine patching. CISA identifies the critical remote-code-execution flaw as actively exploited, has added it to the KEV catalog, and required both remediation and forensic review for affected federal civilian agencies.

Apply Oracle’s patch for CVE-2026-35273 to PeopleSoft immediately instead of relying on workarounds or literal-path WAF rules, and inspect database activity for suspicious access to sensitive records. ShinyHunters resumed exploitation against systems protected only by workarounds, bypassing WAF rules through URL encoding. Compromised systems received JSP webshells, the SideEye backdoor, and tools for tunneling and lateral movement, giving attackers operating-system control or access to sensitive PeopleSoft data.

Deploy Apple’s security updates for CVE-2026-86950 across affected iOS, iPadOS, and macOS Sequoia systems, prioritizing users at elevated risk of targeted attacks. Apple said the CoreGraphics out-of-bounds write may have been exploited in sophisticated attacks against specific individuals; opening a malicious file could enable arbitrary code execution. Apple addressed the flaw through improved bounds checking in multiple operating-system updates.

Upgrade Kyverno to version 1.19.1 on Kubernetes clusters where tenants can create namespaced Kyverno policies or use apiCall functionality. CVE-2026-100706 has a CVSS score of 9.9 and allows URL-encoded traversal sequences to bypass namespace restrictions, potentially letting a namespace-limited tenant perform cluster-level operations. No exploitation was reported, but the privilege boundary failure warrants prompt remediation.