CYBER THREATCAST

Patch affected Apple devices against CVE-2026-86950 immediately, prioritizing personnel at elevated risk of targeted attacks. Apple confirmed exploitation against a small number of individuals, CISA added the CoreGraphics flaw to its Known Exploited Vulnerabilities catalog, and malicious images or PDFs can trigger memory corruption and potentially arbitrary code execution. A limited public proof of concept further increases the likelihood of broader exploit development.

Install the Oracle PeopleSoft patch for CVE-2026-35273 now and investigate exposed PeopleSoft Environment Management systems for compromise. ShinyHunters reportedly exploited the flaw in the wild, and attackers bypassed WAF protections by URL-encoding the initial character of the PSEMHUB endpoint. Do not treat existing WAF rules as sufficient protection; review request records for encoded traffic targeting that endpoint, particularly in government, education and healthcare environments.

Upgrade self-managed Citrix NetScaler ADC and Gateway appliances to fixed builds for CVE-2026-88779 without delay: 13.1-64.28 or later, 13.1-FIPS/NDcPP 13.1-37.282 or later, and 14.1 or 14.1-FIPS 14.1-73.41 or later. CISA added the flaw to KEV after reported zero-day exploitation. A remote unauthenticated attacker can reportedly crash a vulnerable SAML-enabled appliance with one crafted request, creating an immediate availability risk.

Upgrade Rejetto HFS 3.x to version 3.2.1 or later immediately and investigate previously exposed servers for unauthorized administrative activity. Attackers are reportedly exploiting CVE-2026-61500 to reconstruct the signed-cookie generator state, forge session cookies and obtain administrator access. That access can enable arbitrary JavaScript execution and complete server compromise; exploitation has been observed against systems in the United States and Japan.

Apply the available Thales SConnect patch for CVE-2026-18397 immediately wherever the software is deployed. Multiple researchers have reported drive-by attacks, and public proof-of-concept code is available. The flaw can reportedly cause memory corruption, attacker-controlled DLL loading and remote code execution through improper RSA signature validation and buffer handling; organizations should not wait for CISA to add it to KEV before acting.