CYBER THREATCAST

Install Citrix’s fixed builds for NetScaler ADC and NetScaler Gateway immediately, prioritizing internet-exposed appliances. CISA has confirmed global exploitation of CVE-2026-88771 and CVE-2026-88772, both of which can enable remote code execution. Preserve evidence and investigate affected appliances before remediation; isolate exposed systems when necessary. Include CVE-2026-88779 in threat hunting because it is also being exploited in targeted attacks.

Patch affected self-hosted Atlassian Data Center products now and investigate suspicious resource requests or access to sensitive configuration files. Attackers began attempting to exploit unauthenticated CVE-2026-21589 within two hours of technical disclosure, and Crowd credentials may be extracted and abused to create administrators or change permissions. Isolate unpatched instances or apply Atlassian’s request-filtering rules until updates are installed; Atlassian Cloud customers require no action.

Apply Oracle’s patch for PeopleSoft CVE-2026-35273 and investigate systems for data theft or unauthorized access dating to June. ShinyHunters exploited the flaw as a zero-day to steal data and extort organizations, including Jeppesen ForeFlight. Do not treat Mandiant’s temporary WAF rules as a substitute for patching: ShinyHunters claims it can bypass those protections.

Audit npm dependencies, CI/CD pipelines, and build logs for ChainDrop execution, then quarantine affected environments and rotate potentially exposed cloud IAM keys, CI and OIDC tokens, npm and GitHub credentials, and SSH keys. The worm infected more than 400 npm packages through malicious preinstall behavior, with matching exfiltration patterns found in 453 public GitHub repositories and execution observed in 10 environments. Treat stolen npm publishing tokens as a route to further package compromise and republication.

Review every internet-facing Fortinet FortiGate firewall and SSL VPN gateway for FortiBleed activity, focusing on unexpected administrator accounts, altered credentials, stolen sessions, disabled accounts, and unexplained data access. Replace leaked or reused credentials and remove unauthorized persistence. US agencies warn that attackers are compromising exposed devices, preserving access with administrator accounts and session cookies, and supplying that access to ransomware affiliates; compromised devices have already served as ransomware entry points.