CYBER THREATCAST

Restrict internet access to Oracle PeopleSoft personnel portals and immediately investigate exposed deployments for unauthorized access and data extraction. ShinyHunters allegedly exploited a previously unknown PeopleSoft flaw in the FBI’s public-facing personnel portal and stole sensitive personnel and emergency-contact information. Organizations using PeopleSoft for workforce data should preserve relevant logs, assess what records were accessible, and prepare notifications for affected personnel if compromise is confirmed.

Hunt immediately across on-premises Microsoft SharePoint servers for web shells, stolen ASP.NET machine keys, and subsequent access to Windows domain environments. Warlock is actively using compromised SharePoint servers to disable endpoint defenses and deploy ransomware; one intrusion pushed a security-disabling tool to at least 40 hosts and ransomware to at least 33 systems. Government, education, telecommunications, water, and other critical-infrastructure operators should treat any exposed SharePoint compromise as an enterprise-wide incident.

Upgrade Cisco Catalyst SD-WAN Manager to a fixed release now; CVE-2026-76504 has no workaround and is reportedly under active exploitation. The CVSS 9.8 authentication bypass allows crafted HTTP requests to obtain administrator-level API privileges. Inventory every deployment, prioritize internet-accessible managers, and verify remediation rather than relying on compensating controls. CISA added the flaw to its Known Exploited Vulnerabilities catalog with an October 3, 2026 deadline.

Apply Fortinet’s workaround for FortiMail CVE-2026-104286 immediately and deploy permanent fixes when available. The actively exploited zero-day permits unauthenticated arbitrary file writes and may enable remote code execution through the FortiMail Identity-Based Encryption GUI. Administrators should identify exposed FortiMail systems and prioritize them for containment and remediation; CISA added the flaw to its Known Exploited Vulnerabilities catalog and directed federal civilian agencies to remediate by October 4, 2026.

Update affected Apple devices to iOS or iPadOS 26.7.1, macOS Sequoia 15.8.1, or macOS Tahoe 26.7.1 or later. Apple says CVE-2026-86950 was exploited in an extremely sophisticated campaign targeting specific individuals; processing a maliciously crafted file can corrupt memory and enable arbitrary code execution or sensitive-information disclosure. Prioritize devices used by personnel at elevated risk of targeted surveillance or intrusion.