CYBER THREATCAST

Deploy Apple’s fixes for CVE-2026-86950 immediately across supported iOS, iPadOS, and macOS devices. Apple confirmed targeted exploitation, and a malicious image, PDF, or document can trigger an out-of-bounds write with potential arbitrary code execution; public proof-of-concept code is also available, increasing risk for targeted Apple users.

Patch SAML-enabled Citrix NetScaler ADC and Gateway appliances for CVE-2026-88779 without delay, prioritizing customer-managed systems exposed to untrusted networks. The flaw affects deployments configured as SAML service providers or identity providers, is under targeted exploitation, and has been added to CISA’s Known Exploited Vulnerabilities catalog.

Remove Rockwell Automation MicroLogix and other industrial controllers from direct internet exposure, replace weak or default credentials, and secure remote-access pathways. U.S. water utilities in at least seven states suffered controller changes that altered passwords, addresses, project files, and control logic, causing flooding and reduced water pressure; exposed Unitronics controllers have also been compromised through weak or default passwords.

Patch or isolate internet-facing routers, DVRs, cameras, and other devices using the Realtek Jungle SDK affected by CVE-2021-35394. Cling actively exploits the flaw, persists through startup files, hides in system directories, disables watchdog functions, and turns compromised devices into scanners, tunnels, proxies, and denial-of-service nodes; investigate exposed devices for those changes.

Install the Oracle PeopleSoft security patch for CVE-2026-35273 and review access to the PSEMHUB endpoint for encoded request variants. ShinyHunters allegedly exploited the flaw against PeopleSoft environments, and attackers reportedly bypassed WAF rules by URL-encoding the endpoint’s initial character; organizations should not treat existing WAF coverage as a substitute for patching.