CYBER THREATCAST

Install Citrix’s fixed builds for NetScaler ADC and NetScaler Gateway immediately, and treat exposed appliances as potential intrusion points rather than assuming patching ends the incident. CVE-2026-88771 and CVE-2026-88772 are independently exploitable remote-code-execution flaws rated CVSS 9.5, and CISA added both to its Known Exploited Vulnerabilities catalog after confirming global exploitation. Preserve evidence, investigate for compromise, and isolate exposed appliances where necessary.

Investigate internet-facing FortiGate firewalls and Fortinet SSL VPN gateways for unauthorized administrator accounts, credential changes, stolen sessions, lateral movement, and data access. FortiBleed operators use leaked or reused credentials, establish persistence, and sell access to INC and Lynx ransomware affiliates; at least 12 organizations reportedly suffered encryption. Do not rely on patching alone, because agencies warned that updates will not remove persistence already established on compromised devices.

Upgrade self-hosted Atlassian Data Center products to fixed releases and investigate suspicious resource requests immediately. Attackers reportedly began exploiting CVE-2026-21589 within hours of technical or proof-of-concept disclosure, while an available Nuclei template enables automated scanning. An unauthenticated attacker who knows an exact filename and path may retrieve sensitive files from the application web root. Atlassian Cloud customers require no action.

Apply Oracle’s patch for PeopleSoft CVE-2026-35273 and investigate affected systems for data theft or extortion-related compromise. ShinyHunters reportedly exploited the flaw as a zero-day beginning in June 2026 and stole data from dozens of systems across multiple industries. Organizations unable to update immediately can deploy Mandiant’s WAF rules as an interim measure, but should not treat them as equivalent protection because ShinyHunters claimed it could bypass those rules.

Identify and secure internet-facing LiteLLM, Ollama, Gitea, Gotenberg, and Ivanti Sentry servers, prioritizing systems affected by CVE-2026-10520, CVE-2026-42271, or CVE-2026-48710. The PoeLLM campaign compromised more than 3,400 exposed AI and developer servers, deployed cryptominers and remote-shell access, and used infected systems to scan for additional targets. Compromised hosts should be investigated for persistence and unauthorized remote access rather than returned to service after configuration changes alone.