Two Citrix NetScaler Zero-Days Actively Exploited in the Wild

Attackers are actively exploiting CVE-2026-88771 and CVE-2026-88772 against Citrix NetScaler ADC and Gateway appliances. Mandiant observed exploitation affecting organizations in North America and Europe, with post-exploitation tooling including custom WHIPSHOT web shells and the SLAPSHOT tunneler used for internal reconnaissance and credential theft.

Source: Google Threat Intelligence Group

ShinyHunters Renews Mass Exploitation of Oracle PeopleSoft

Google Threat Intelligence Group and Mandiant identified a renewed global exploitation campaign targeting CVE-2026-35273 in Oracle PeopleSoft. The ShinyHunters-linked actor modified its exploit to bypass WAF rules by URL-encoding part of the vulnerable PSEMHUB path, allowing attacks against systems whose operators may have believed the exposure was mitigated.

Source: Google Threat Intelligence Group

Microsoft SharePoint RCE Now Exploited in Attacks

Microsoft confirmed active exploitation of CVE-2026-65660, a SharePoint remote code execution vulnerability patched in August. An authenticated attacker with low-level access can exploit the code injection flaw to execute arbitrary code on an affected SharePoint server without user interaction.

Source: SecurityWeek

Bitget Says $387.5 Million Theft Began With Zero-Days in Security Appliances

Cryptocurrency exchange Bitget said attackers gained access to its wallet environment by exploiting zero-day vulnerabilities in two third-party security appliances. The attackers deployed web shells and malware inside the production environment before using a custom withdrawal tool to steal approximately $387.5 million from hot and warm wallets.

Source: BleepingComputer

Apple Patches CoreGraphics Zero-Day Used in Targeted Attacks

Apple patched CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics that may have been exploited in what the company described as an extremely sophisticated attack against specific individuals. Processing a maliciously crafted file can lead to arbitrary code execution on affected iOS and macOS devices.

Source: SecurityWeek

Zammad Zero-Days Exploited in AI-Powered Attack Against DIVD

The Dutch Institute for Vulnerability Disclosure said attackers compromised its infrastructure by exploiting two previously unknown vulnerabilities in the Zammad support platform. DIVD described the operation as an automated agentic AI-powered attack and initiated a full incident response after detecting the compromise on September 21.

Source: SecurityWeek

Storm-3168 Uses Compromised Service Principals for Destructive Azure Attacks

Microsoft documented destructive Azure activity associated with Storm-3168, also known as JADEPUFFER, involving compromised service principals and stolen cloud credentials. The actor performed bulk destructive operations against storage accounts, SQL databases, Key Vaults, virtual machines, Function Apps, App Services and recovery protection controls.

Source: Microsoft

Zimbra RCE Exploitation Leads to Web Shells, Credential Theft and Persistent Access

Microsoft published new details on exploitation of CVE-2026-73570, an unauthenticated command injection vulnerability affecting internet-facing Zimbra servers with specific SNMP functionality enabled. Observed post-exploitation activity included JSP web shells, reverse shells, privilege escalation, persistent remote-access tooling, mailbox access and collection of authentication data.

Source: Microsoft

Official MCP Python SDK Flaw Could Expose OAuth Credentials

A vulnerability in the official Model Context Protocol Python SDK could allow a malicious MCP server to redirect OAuth token exchanges to attacker-controlled infrastructure. Affected clients could disclose the client secret, authorization code and PKCE proof key, allowing the attacker to obtain access tokens carrying the application’s permissions.

Source: The Hacker News

Re-Enabled GitHub Actions Reactivated Mini Shai-Hulud Supply Chain Malware

Two GitHub Actions compromised during the Mini Shai-Hulud campaign became accessible again while their release tags still referenced malicious code. Workflows using those version tags consequently resumed downloading and executing the compromised actions until GitHub disabled the repositories again.

Source: Socket

Warlock Ransomware Group Targets Water and Telecom Operators

The China-nexus group behind Warlock ransomware has continued using Microsoft SharePoint vulnerabilities to compromise organizations. Recent victims included a water utility and a telecommunications provider, along with a regional government organization and a university across Europe, Africa and Latin America.

Source: Security.com

SalesBleed Flaws Enabled Zero-Click Data Exfiltration Through Salesforce Agentforce

Researchers disclosed three vulnerabilities in Salesforce Agentforce that could allow attackers to inject malicious instructions through Web-to-Lead forms. Two of the flaws could trigger zero-click extraction of sensitive CRM data when an Agentforce agent later processed a poisoned lead, while another could turn the agent into a phishing delivery mechanism.

Source: SecurityWeek

Public Exploit Released for Critical Next.js Remote Code Execution Flaw

A working proof-of-concept exploit is publicly available for CVE-2026-94545, a critical vulnerability in the Next.js next/og image API. A single unauthenticated request can execute commands on vulnerable servers, although no confirmed in-the-wild exploitation had been reported at the time of publication.

Source: SecurityOnline

Times Car Data Breach Affects 6.6 Million Accounts

Japanese car-sharing provider Times Car confirmed that attackers compromised approximately 6.6 million user accounts after gaining unauthorized access to its systems. The company initially investigated whether personal information had been accessed and later confirmed that data had been stolen.

Source: BleepingComputer

NeedyMantis Malware Used for Persistent Access in Targeted Operations

Microsoft identified NeedyMantis, a modular post-compromise malware family used in targeted operations against telecommunications organizations, universities, medical nonprofits, intergovernmental organizations and government contractors. The malware is deployed after initial compromise to maintain long-term access and support follow-on activity, with observed operations aligning with China-based threat actors.

Source: Microsoft