The Hot Drop

Oct 5

The Hot Drop for 10-05-2026

Citrix zero-days exploited globally for weeks before patch? And an AI agent just chained two Zammad flaws to breach DIVD. Are we safe?

Since the last show: 8 developing · 100% overlap with the previous show

Contents

  1. Citrix NetScaler Zero-Days Exploited Globally for Weeks Before Patch Release
  2. Citrix patches actively exploited SAML zero-day CVE-2026-88779 in NetScaler ADC and Gateway
  3. AI Agent Chains Zammad Zero-Days to Breach DIVD
  4. CISA mandates urgent patch for actively exploited FortiMail zero-day
  5. ShinyHunters member detained in Jordan, cooperating with FBI
  6. Microsoft Issues Emergency Exchange Update for Elevation of Privilege Flaw
  7. CISA and Red Hat issue urgent warning for XZ Utils supply chain compromise
  8. Warlock ransomware hits critical infrastructure in Portuguese and Spanish-speaking regions

1. Citrix NetScaler Zero-Days Exploited Globally for Weeks Before Patch Release (Lead)

Event now covered by 5 outlets (was 4); Blast radius expanded: new product(s): netscaler gateway, netscaler adc; 1 new indicator(s) observed

What changed

Citrix NetScaler appliances have been under active attack for weeks, with attackers exploiting two critical zero-days before the public patch dropped on September 27. The vulnerabilities, CVE-2026-88771 and CVE-2026-88772, allow unauthenticated remote code execution on both ADC and Gateway products. GreyNoise spotted exploitation attempts from IP 149[.]104[.]78[.]141 on September 24, but Mandiant and other researchers indicate the campaign targeting government and financial sectors in North America and Europe started much earlier. Five independent outlets, including Rapid7 and Censys, confirm the core facts, though some reports differ on whether specific APT groups are behind the campaign. CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog, mandating that federal agencies apply mitigations by September 30, 2026. Private sector defenders need to act now. Check your NetScaler versions immediately; you need 14.1-73.37 or later. Advanced persistent threat groups and ransomware affiliates have confirmed exploitation of Citrix NetScaler ADC. They leveraged lightweight installer web shells to assert the setuid bit on the /bin/sh executable for persistent root-level execution. Attackers gained root access on these FreeBSD-based systems by deploying custom malware named WHIPSHOT and SLAPSHOT. The threat actor conducted credential theft on the compromised appliances, a behavior verified alongside the deployment of the custom malware named WHIPSHOT and SLAPSHOT. Look for the specific IOCs, including the attacker infrastructure IPs 45[.]141[.]21[.]130 and 64[.]94[.]85[.]67.

How it works

Citrix NetScaler ADC versions before 14.1-73.37 fail input validation, allowing attackers to exploit CVE-2026-88771 for arbitrary command execution. The flaw lets unauthenticated remote attackers bypass authentication entirely to run commands on the FreeBSD-based appliance. Malformed input triggers an out-of-bounds read that leaks cryptographic keys and bypasses ASLR protections. This occurs when the product reads past buffer boundaries while handling VPN or RDP proxy traffic. Additionally, the system fails to parse HTTP request smuggling, enabling unauthorized request injection into back-end servers. Attackers can also exploit improper HTTP URL usage to bypass feature policies and access restricted functionality. With prior access, attackers escalate privileges within the NetScaler infrastructure. The Dutch National Cyber Security Center confirmed these vulnerabilities allow active exploitation on NetScaler ADC and Gateway systems. Citrix NetScaler ADC and Gateway appliances before version 14.1-73.41 face a high-severity flaw, CVE-2026-88779, which expands the active threat beyond initial critical flaws. Versions 14.1 through 73.32 and 13.1 through 63.21 remain exposed to CVE-2026-19490 within a broader event of eleven related vulnerabilities. This weakness allows attackers to bypass ASLR protections, enabling arbitrary code execution without network access. Another flaw enables unauthenticated remote code execution, leading to privilege escalation and denial of service on all default NetScaler appliances. A feature policy bypass via improper HTTP URL expression affects versions before 14.1-73.37, allowing attackers to bypass access controls. The load balancer also suffers from secret injection of malicious HTTP requests, a distinct consequence from other CVEs in this set. The corruption targets organizations in North America and Europe, specifically the government, financial services, education, legal, and professional services sectors.

What to do

Threat actors are actively exploiting CVE-2026-88772 in Citrix NetScaler ADC and Gateway appliances to achieve remote code execution. Unauthenticated remote attackers can execute arbitrary commands on these appliances, a capability that APT and ransomware groups have already weaponized against government and financial targets. The Dutch National Cyber Security Center has formally warned IT suppliers about active exploitation, confirming that the threat extends beyond isolated incidents to a coordinated campaign against critical infrastructure. Patch Citrix NetScaler Gateway and ADC versions prior to 14.1-73.37 immediately to block this specific request smuggling attack vector. Verify NetScaler inventory against affected version ranges to isolate this specific access precondition before exploitation. Apply the input validation mitigation immediately, as fuzzing remains the only current detection method for this specific overread condition. Verify appliance stability after applying the update, as reports indicate NetScaler devices may reboot repeatedly following the 0-day security patch, requiring a restart to complete the remediation.

Limits and watch

Current evidence confirms no patch date exists for these versions, leaving operators with honest uncertainty regarding immediate remediation options. The specific attribution to state-sponsored APT groups remains contested, with some reports differing on the exact actors behind the campaign. The full extent of credential theft and lateral movement is not yet established. Watch for lateral movement after initial compromise, specifically correlating inbound access to remote service ports with near-time service instability or suspicious child process creation on internal systems. Expect continued broad exploitation by various threat actors in the near term, as experts warn that the campaign targeting North American and European organizations will persist despite the recent patches.

Vulnerabilities

  • CVE-2026-88772 — CVSS 8.1 (High) · CISA KEV · Citrix NetScaler ADC; Citrix NetScaler Gateway. Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2025-5777 — CVSS 7.5 (High) · CISA KEV · CWE-125 · NetScaler ADC; NetScaler Gateway. Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
  • CVE-2026-19490 — CVSS 0 (Low) · CISA KEV · NetScaler ADC; NetScaler Gateway. Vulnerability in NetScaler ADC and NetScaler Gateway.
  • CVE-2026-88771 — CVSS 0 (Low) · CISA KEV · CWE-20 · Citrix NetScaler ADC; Citrix NetScaler Gateway. Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88773 — CVSS 0 (Low) · CWE-444 · Citrix NetScaler ADC; Citrix NetScaler Gateway. Inconsistent interpretation of HTTP requests (‘HTTP Request/Response smuggling’) vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88774 — CVSS 0 (Low) · Citrix NetScaler ADC; Citrix NetScaler Gateway. Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88775 — CVSS 0 (Low) · Citrix NetScaler ADC; Citrix NetScaler Gateway. Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88776 — CVSS 0 (Low) · Citrix NetScaler ADC; Citrix NetScaler Gateway. Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88777 — CVSS 0 (Low) · Citrix NetScaler ADC; Citrix NetScaler Gateway. Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88778 — CVSS 0 (Low) · CWE-342 · Citrix NetScaler ADC; Citrix NetScaler Gateway. Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • and 1 more

Techniques

  • AML.T0072 Reverse Shell (Command And Control)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.007 Cloud Services (Lateral Movement)
  • T1087.001 Local Account (Discovery)
  • T1102 Web Service (Command And Control)
  • T1133 External Remote Services (Persistence)
  • T1136.001 Local Account (Persistence)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1202 Indirect Command Execution (Stealth)
  • T1203 Exploitation for Client Execution (Execution)
  • and 10 more

Indicators

  • 25 indicators on file

Coverage

2. Citrix patches actively exploited SAML zero-day CVE-2026-88779 in NetScaler ADC and Gateway (Segment)

No material change since last show

Citrix released emergency updates for CVE-2026-88779, a zero-day memory buffer flaw in NetScaler ADC and Gateway appliances currently exploited to cause denial of service. Citrix confirms the primary impact is service disruption through daemon termination, though researcher Kevin Beaumont reported finding malware on a patched honeypot. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating that federal civilian executive branch agencies prioritize rapid remediation under Binding Operational Directive 26-04. If you run NetScaler appliances with SAML enabled, verify your version immediately. Citrix provides Global Deny Lists as an interim mitigation if you cannot patch instantly. Citrix confirms a flaw in NetScaler ADC and Gateway versions prior to 14.1-73.41 and 13.1-64.28 is exploitable without authentication or user interaction. The vulnerability carries a CVSS score of 8.7 and affects any deployment configured as a SAML Service Provider or Identity Provider, identifiable by specific ‘add authentication samlAction’ entries in your ns[.]conf file. While Citrix verifies the denial-of-service impact, reports of shell commands and malware on patched systems remain unverified by the vendor. Watch for unexpected daemon terminations or outbound connections to the IP 213[.]209[.]159[.]55, which is linked to attacker infrastructure.

The vulnerability is a memory buffer overflow (CWE-119) in the SAML authentication processing that allows unauthenticated remote attackers to trigger a crash by sending malformed data to the appliance. The flaw stems from improper bounds checking during buffer operations, allowing injected parameters to expand beyond allocated memory limits. Attackers trigger this by injecting malicious content that expands buffer parameters, causing unintended control flow and potential code execution. The vulnerability exploits CWE-119 by allowing parameter expansion that overwrites function pointers to redirect control flow. The weakness allows control flow redirection when the product reads or writes outside its buffer boundaries. Attackers are exploiting CVE-2025-6543 in NetScaler ADC 14.1 to trigger a denial of service via memory overflow. This remote zero-day flaw crashes systems, with researchers investigating if it enables remote code execution. The NetScaler Gateway 14.1 crash stems from a memory overflow that hijacks control flow during VPN or RDP proxy access. Successful exploitation causes complete daemon termination, disrupting critical services like SSL VPNs and SSO portals.

The zero-day exploitation of CVE-2026-88779 exposes NetScaler ADC or Gateway appliances using SAML to immediate denial-of-service risk, as the flaw is reachable over the network without credentials. With a CVSS of 9.8 and no authentication required, this weakness enables immediate remote code execution on affected systems. While the primary observed behavior is daemon termination, malware on patched honeypots suggests researchers are probing for T1021.007, Cloud Services, access via federated identities, or T1190, Exploit Public-Facing Application, to achieve code execution. The uncertainty remains whether the current exploit chain stops at service disruption or if the same buffer overflow can be chained for remote code execution in patched environments. Defenders must prioritize checking outbound connections to the known attacker IP 213[.]209[.]159[.]55 and validating that Global Deny Lists are active, as MFA or sandboxing cannot mitigate the initial unauthenticated crash. Isolate NetScaler Gateway 14.1 instances immediately while waiting for the vendor’s patch. Apply the emergency update before 14.1-73.41 and 13.1-64.28 immediately to stop the denial-of-service attacks while researchers confirm the remote code execution possibility. Isolate affected NetScaler ADC 13.1 and 14.1 systems today and apply the language-level protections specified in mitigation guidance. Upgrade to patched versions or apply the language-level constraints recommended in the CISA catalog entry. Isolate affected NetScaler ADC 13.1 FIPS units immediately as the only viable mitigation until vendors release a patched version.

Reports of malware on patched honeypots lack vendor corroboration, leaving the full scope of post-exploitation activity uncertain.

Vulnerabilities

  • CVE-2025-6543 — CVSS 9.8 (Critical) · CISA KEV · CWE-119 · NetScaler ADC; NetScaler Gateway. Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual…
  • CVE-2026-88779 — CVSS 0 (Low) · NetScaler ADC; NetScaler Gateway. Vulnerability in NetScaler ADC and NetScaler Gateway.

Techniques

  • T1021.007 Cloud Services (Lateral Movement)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1212 Exploitation for Credential Access (Credential Access)

Indicators

  • 7 indicators on file

Coverage

3. AI Agent Chains Zammad Zero-Days to Breach DIVD (Segment)

Blast radius expanded: new vendor(s): zammad; new product(s): zammad, zammad helpdesk platform, linux; 5 new indicator(s) observed

What changed

On September 21, an autonomous AI agent breached the Dutch Institute for Vulnerability Disclosure by chaining two zero-day flaws in the Zammad ticketing system. The incident involved the exploitation of CVE-2026-102489 and CVE-2026-102490 to hijack sessions, execute remote code, and escalate privileges to root. Zammad GmbH disputed DIVD’s handling of the incident, arguing they could not verify the second flaw due to missing technical details and claiming it requires prior local access. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, setting a federal remediation deadline for today, October 5, under Binding Operational Directive 26-04. If you run Zammad, verify you are on version 7.2.0 or higher immediately. Look for unusual shell command executions originating from the Zammad service account, specifically those accompanied by verbose comments or unexpected tool invocations. On September 21, an AI agent exploited CVE-2026-102489 for remote code execution and CVE-2026-102490 for privilege escalation, achieving root access on Linux systems running Zammad versions 6.3.0 through 6.5.4. DIVD confirmed that its internal Zammad helpdesk was compromised by this AI agent using these specific zero-day vulnerabilities. The organization verified that the attack allowed intruders to exfiltrate data before containment efforts were successful.

How it works

The attack chain began with CVE-2026-102489, a session hijacking flaw that enabled remote code execution as the Zammad service account. The agent then leveraged CVE-2026-102490, a local privilege escalation vulnerability, to elevate access from the service account to root. This flaw lets the zammad user escalate privileges to root in Zammad versions 1.5.0 through 7.1.0-alpha. The attacker forces a new session without invalidating old identifiers, leveraging predictable session IDs to assume the zammad user’s identity. Because the application uses predictable session identifiers that do not change on privilege elevation, an attacker can forge valid credentials to usurp access. The flaw allows attackers to forge valid session credentials by inducing clients to use attacker-provided identifiers before authentication, leveraging unchanged session IDs during privilege changes. An attacker forces a new login using a forged session ID, bypassing authentication to assume the user’s identity and execute privileged code. Zammad versions 6.3.0 through 6.5.4 face a session hijack flaw allowing remote code execution as the zammad user. Network segmentation at DIVD prevented further lateral movement, but the initial breach resulted in data exfiltration.

What to do

The compromise of the Dutch Institute for Vulnerability Disclosure shows that Zammad versions 6.3.0 through 6.5.4 face a high-impact chain where remote session hijacking leads directly to root-level access. Because the privilege escalation flaw CVE-2026-102490 was actively exploited in this attack, any unpatched Zammad deployment faces immediate risk of total system compromise rather than just service disruption. Understanding Zammad’s specific root escalation distinguishes its high-impact role because this event includes two related CVEs. Defenders must invalidate existing session identifiers before authorizing new ones to block this privilege escalation path.

Limits and watch

Zammad GmbH disputes the severity of the second flaw, arguing that CVE-2026-102490 requires prior local access and could not be verified without technical details, which complicates the assessment of remote exploitability. The exact scope of data exfiltration remains unclear, as the attack was stopped by network segmentation before full lateral movement could be confirmed, leaving the extent of initial compromise uncertain. Watch for a spike in invalid session identifiers in Zammad logs, as this is a potential warning sign of session fixation attempts that precede the exploitation of CVE-2026-102489.

Vulnerabilities

  • CVE-2026-102489 — CVSS 9.8 (Critical) · CISA KEV · CWE-384 · Zammad GmbH Zammad. Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user.
  • CVE-2026-102490 — CVSS 9.8 (Critical) · CISA KEV · Zammad GmbH Zammad. All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

Techniques

  • AML.T0086 Exfiltration via AI Agent Tool Invocation (Exfiltration)
  • AML.T0095.000 Code Repositories (Reconnaissance)
  • AML.T0108 AI Agent (Command And Control)
  • AML.T0112 Machine Compromise (Impact)
  • T1053.005 Scheduled Task (Execution)
  • T1068 Exploitation for Privilege Escalation (Privilege Escalation)
  • T1110.003 Password Spraying (Credential Access)
  • T1203 Exploitation for Client Execution (Execution)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1213.003 Code Repositories (Collection)
  • and 3 more

Indicators

  • 6 indicators on file

Coverage

4. CISA mandates urgent patch for actively exploited FortiMail zero-day (Segment)

Blast radius expanded: new product(s): fortimail

What changed

CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to remediate by October 4, 2026. Fortinet disclosed that the group GBHackers is actively exploiting this critical zero-day to compromise email security appliances. This path traversal flaw lets unauthenticated attackers write arbitrary files and execute code on FortiMail appliances via crafted HTTP or HTTPS requests. Fortinet’s internal researcher Gwendal Guégniaud discovered a critical path traversal flaw in FortiMail, rated 9.8 on the CVSS scale. For detection engineering, this is a classic Exploit Public-Facing Application scenario. Investigate unusual file creation events on FortiMail systems or unexpected outbound connections from mail appliances. One attacker infrastructure IP, 45[.]129[.]0[.]192, is associated with this activity. Until patches are deployed, disable Identity-Based Encryption or restrict management interface access to trusted private networks.

How it works

Fortinet FortiMail 8.0.0 through 8.0.1 allows unauthenticated attackers to write arbitrary files via path traversal exploits. The flaw stems from improper pathname sanitization where crafted HTTP requests resolve outside restricted directories to overwrite critical system files. Attackers exploit the vulnerability by sending specially crafted HTTP or HTTPS requests that leverage improper NULL byte handling to bypass path restrictions. This file write capability enables the execution of arbitrary code or commands on the compromised appliance without requiring login credentials. Separately, Fortinet devices like FortiNDR 7.6.0 are vulnerable to a stack-based buffer overflow [CWE-121] where a remote attacker executes code via crafted hash cookies [vulnerability:CVE-2025-32756]. CVE-2025-32756 enables arbitrary command execution on FortiMail and FortiRecorder with a CVSS score of 9.6. This flaw affects FortiMail versions through 7.6.2 and FortiRecorder versions through 7.2.3. A separate CWE-22 weakness allows adversaries to overwrite critical libraries, achieving full system compromise with a CVSS 9.8 score. The affected FortiMail versions include 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1. Compromised systems face total loss of confidentiality, integrity, and availability as attackers gain unauthorized control over the email security infrastructure.

What to do

Apply the input validation mitigation from evidence three immediately to block file creation on the underlying system. Isolate affected Fortinet appliances immediately until a patch arrives, as this CVE joins CVE-2026-104286 in today’s event. Validate input using an accept-known-good strategy to prevent path resolution outside restricted directories. Validate all input against a strict whitelist of acceptable paths to neutralize the traversal risk before the next update arrives. Disable Identity-Based Encryption on affected FortiMail appliances immediately to block the unauthenticated write vector while awaiting patches.

Limits and watch

Static analysis confirms the flaw, but we cannot verify if an exploit exists in the wild without further observation. Patch release dates for affected FortiMail versions are not yet established, leaving a window of exposure for unpatched systems. It remains unclear whether active exploitation of CVE-2026-104286 links to the separate stack-based buffer overflow in CVE-2025-32756 affecting overlapping FortiMail versions. Watch for inbound network access to FortiMail services that leads to daemon crashes or shells spawning from the service context. Look for suspicious URLs containing invalid or denylisted characters after initial decoding, which may indicate attempts to bypass validation logic via URL encoding.

Vulnerabilities

  • CVE-2026-104286 — CVSS 9.8 (Critical) · CISA KEV · CWE-22 · Fortinet FortiMail. An improper limitation of a pathname to a restricted directory (‘path traversal’) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0…
  • CVE-2025-32756 — CVSS 9.6 (Critical) · CISA KEV · CWE-121 · Fortinet FortiNDR; Fortinet FortiCamera; Fortinet FortiRecorder. A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0…

Techniques

  • T1021.007 Cloud Services (Lateral Movement)
  • T1190 Exploit Public-Facing Application (Initial Access)
  • T1204.002 Malicious File (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1499.004 Application or System Exploitation (Impact)

Indicators

  • 15 indicators on file

Coverage

5. ShinyHunters member detained in Jordan, cooperating with FBI (Segment)

Blast radius expanded: new vendor(s): salesforce; 1 new indicator(s) observed; Now attributed to actor: TeamPCP

Saif al-Din Khader, a suspected ShinyHunters operative known as Rey, was detained in Jordan and is reportedly cooperating with the FBI to identify other group members. This detention follows the arrest of Pepijn van der Stap, alias Umbreon, in Amsterdam, where he appeared before Rotterdam District Court on October 5, 2026. The group has breached over 140 organizations, including the FBI, ADT, and the European Commission, and extorted over seventy million dollars since last year. For your SOC, note that Khader’s devices are being seized, which may reveal new infrastructure. A key ShinyHunters operative is behind bars in Jordan and talking to the FBI. Reports agree on the detention and cooperation, though one outlet claims ShinyHunters used an Oracle PeopleSoft zero-day to breach FBI systems before moving into AWS GovCloud. The dossier lists fbijobs[.]gov and apply[.]fbijobs[.]gov as victim assets. Multiple reports confirm that Khader is assisting investigators by providing access to his electronic devices and digital correspondence to help track down the organization. The investigation centers on the group’s alleged breach of sensitive personal and medical records of federal employees, with specific victim assets including fbijobs[.]gov and apply[.]fbijobs[.]gov.

In a separate attack on the European Commission, the group utilized compromised AWS credentials and TruffleHog to breach cloud infrastructure via a Trivy supply chain attack. Specific data exposures include approximately 900,000 contact records from Aura and 340 GB of data from the European Commission, which included personal information and email communications.

TeamPCP’s Rey is detained in Jordan today, and his seized devices likely contain the specific email lists and social engineering scripts used to target apply[.]fbijobs[.]gov and other victim portals. This arrest confirms that the group’s recent Oracle PeopleSoft zero-day breach of the FBI was preceded by a deliberate reconnaissance phase where adversaries gathered email addresses to craft targeted spearphishing voice campaigns. The pattern shifts the investigation focus from generic vulnerability exploitation to verifying whether your organization’s public-facing email infrastructure was probed for valid usernames before the initial access event. The group’s use of account use policy bypasses and audit evasion to access AWS GovCloud means your immediate priority is checking if your own login inactivity timeouts and audit logs are enforcing the same restrictions that prevented Rey’s team from moving laterally. While the 900,000 contact records exposed in the Aura breach confirm that mass data collection is a standard precursor to these attacks, the uncertainty remains whether your specific assets were targeted with voice calls or if the breach relied solely on automated enumeration. You must prioritize correlating recent inbound vishing attempts with your internal user activity logs to determine if the threat actor is still active. The detention of ShinyHunters operative Rey in Jordan exposes the group’s reliance on Oracle PeopleSoft zero-day exploits to breach FBI systems and pivot into AWS GovCloud. This confirmed lateral movement from on-premises PeopleSoft to cloud infrastructure indicates that perimeter controls alone are insufficient to contain ShinyHunters’ data exfiltration campaigns. Implement account use policies that enforce lockout mechanisms and inactivity timeouts to mitigate the risk of brute-force attacks and unauthorized access via external remote services. Deploy network monitoring to detect large, iterative quantities of authentication requests from single sources, which indicate adversaries probing for valid email addresses and usernames.

Technical details for the Oracle PeopleSoft zero-day remain unverified because the claim relies on alleged exploitation rather than confirmed patch data. It is not yet established whether ShinyHunters caused the initial compromise of the European Commission’s infrastructure or only handled the subsequent data extortion. Monitor for new disclosures from the FBI regarding the seized devices of Saif al-Din Khader, which may reveal additional infrastructure used to target apply[.]fbijobs[.]gov. Watch for spikes in authentication request volumes from external sources, as this signal indicates active reconnaissance for email addresses preceding potential phishing or brute-force attempts.

Techniques

  • T1003.003 NTDS (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • T1021.007 Cloud Services (Lateral Movement)
  • T1027.003 Steganography (Stealth)
  • T1036.005 Match Legitimate Resource Name or Location (Stealth)
  • and 10 more

Named actors and malware

  • ShinyHunters (actor)
  • Cl0p (malware)
  • Scattered Spider (actor)
  • TeamPCP (actor)

Indicators

  • 3 indicators on file

Coverage

6. Microsoft Issues Emergency Exchange Update for Elevation of Privilege Flaw (Segment)

No material change since last show

Microsoft released an out-of-band update in September 2026 for CVE-2026-96940, a high-severity elevation of privilege flaw in Exchange Server. An authenticated attacker can read other users’ mailboxes without user interaction. The bug affects on-premises Exchange 2016, 2019, and Subscription Edition, specifically Exchange 2019 CU 14 and 15, and Exchange 2016 CU 23. Microsoft states the issue was found internally with no known active exploitation, but the CVSS score is 8.8, signaling significant risk to confidentiality, integrity, and availability. Exchange Online customers are protected by a service-side fix, but on-premises administrators must act immediately. The update is available only to organizations enrolled in the Period 2 Extended Security Update program, as the affected server versions are out of standard support. If you run on-prem Exchange, verify your ESU enrollment status today and apply the patch to all affected nodes, including management tools. Reports from Microsoft and independent outlets align on the technical details and the lack of active exploitation. Microsoft confirmed the vulnerability was discovered internally and there is no known active exploitation at release. A related service-side fix has already been deployed to Exchange Online, though Microsoft acknowledged a misstep in the rollout sequence.

Microsoft Exchange Server versions 2016 through 2019 contain CWE-1390 weak authentication flaws that let authenticated attackers elevate privileges. Attackers exploit a capture-replay flaw in Exchange Server 2016 and 2019 to replay captured credentials and gain higher access. On versions 15[.]01[.]0[.]0 and 15[.]02[.]0[.]0, authorized attackers replay captured traffic to bypass authentication entirely. This weakness bypasses identity verification, granting unauthorized access to sensitive application data and enabling privilege escalation. The flaw allows remote exploitation over the network with low complexity, requiring only low-level privileges to access email messages and attachments. This weakness grants high integrity and availability impact over the network, enabling attackers to execute unauthorized commands on affected Exchange servers. Anyone on the network with stolen hash or Kerberos credentials gains full access to domain resources. The system leverages NTLM and Kerberos protocols without proper sequence or cryptographic signing, granting full control over the domain. This allows privilege escalation over the network, granting access to resources otherwise hidden behind strict access controls. An authorized user can escalate privileges by reusing stolen domain hashes or Kerberos tickets without new credentials. Successful exploitation results in a high impact to confidentiality, integrity, and availability, allowing attackers to read sensitive data and potentially execute unauthorized commands within the organization.

This specific CVE targets Exchange Server’s authentication mechanism, offering a high-impact path to data exposure and code execution for networked adversaries. Because the flaw relies on captured hash or Kerberos credentials, defenders gain clarity by isolating systems that lack sequence numbering or cryptographic signing for message integrity. Adversaries exploiting this flaw will use the authenticated session to exfiltrate email data, a behavior that aligns with Remote Email Collection techniques and the exploitation of remote services for lateral movement. The framework mitigation options of disabling unnecessary features and applying application isolation suggest that defenders should isolate the Exchange server from the rest of the network to contain any potential breach. However, uncertainty remains regarding whether the attacker has already used the vulnerability to access credentials, so the watch item is monitoring for unauthorized mailbox access logs and credential harvesting attempts on the affected nodes. Defenders gain distinct clarity by isolating this specific access precondition and version scope from the related CVE-2026-62911 event. Verify that Exchange instances use sequence numbers and cryptographic signing to stop replay attacks. Patch affected Exchange updates immediately while monitoring for authentication attempts from inconsistent IP addresses or suspicious software installation on the domain. Run the Exchange Server Health Checker script to verify that all on-premises nodes have received the update and to identify any remaining unpatched instances.

Without confirmed patching, we cannot guarantee this specific replay vector is blocked on legacy Exchange 2016 systems. The evidence does not confirm whether the weak authentication flaw in CVE-2026-96940 has been actively exploited in the wild, only that it allows privilege elevation over a network. It remains unclear if the capture-replay bypass in CVE-2026-62911 shares the same exploitation path as the weak authorization issue, as both affect the same Exchange Server versions but involve distinct CWE weaknesses. Monitor for authentication attempts using previously used credentials from IP addresses inconsistent with normal user locations, as this indicates potential credential replay exploitation.

Vulnerabilities

  • CVE-2026-96940 — CVSS 8.8 (High) · CWE-1390 · Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15. Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
  • CVE-2026-62911 — CVSS 8 (High) · CWE-294 · Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15. Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Techniques

  • T1114.002 Remote Email Collection (Collection)
  • T1203 Exploitation for Client Execution (Execution)
  • T1204.002 Malicious File (Execution)
  • T1210 Exploitation of Remote Services (Lateral Movement)
  • T1212 Exploitation for Credential Access (Credential Access)
  • T1218.002 Control Panel (Stealth)

Indicators

  • 1 indicator on file

Coverage

7. CISA and Red Hat issue urgent warning for XZ Utils supply chain compromise (Segment)

Event first seen in a show

What changed

CISA issued an urgent advisory identifying a supply chain compromise in the XZ Utils data compression library, affecting versions 5.6.0 and 5.6.1. This newly confirmed threat, designated CVE-2024-3094, represents a critical shift in the security posture of a widely used open-source utility. CISA and Red Hat issued urgent advisories for a supply chain compromise in XZ Utils versions 5.6.0 and 5.6.1, identified as CVE-2024-3094. The malicious code allows threat actors to bypass authentication and gain unauthorized remote access to affected Linux systems. Red Hat verified that while Red Hat Enterprise Linux is unaffected, the compromise actively impacts Fedora Rawhide, Fedora 40 beta, Debian unstable, and several openSUSE distributions. You must immediately halt usage of compromised instances and downgrade to safe versions, specifically the 5.4.x series, such as 5.4.6 Stable.

How it works

The attack chain begins with the liblzma build process extracting a prebuilt object file from a disguised test file within the source code. Complex obfuscations modify specific library functions, embedding a virus into DLL gaps to grant unauthorized code execution. This results in a modified liblzma library that intercepts and modifies data interactions, specifically interfering with SSH authentication processes during the build to facilitate unauthorized access. This compromise grants unauthorized code execution with full confidentiality, integrity, and availability impact. Any software linked against the modified library faces unauthorized code execution, causing a complete loss of confidentiality, integrity, and availability. With a CVSS score of 10, the vulnerability allows network-based attacks with low complexity, requiring no prior privileges or user interaction.

What to do

The compromise of XZ Utils versions 5.6.0 and 5.6.1 exposes Fedora Rawhide, Fedora 40 beta, Debian unstable, and openSUSE systems to unauthorized remote access by intercepting SSH authentication data. Because the malicious code is embedded in the liblzma library, any software linked against the compromised version can be manipulated to alter data interactions, creating a broad exposure surface beyond just the compression utility itself. Run a binary or bytecode disassembler on the liblzma library to find and strip the obfuscated malicious code hidden in the source tarballs. Manually analyze the binaries to locate and remove the embedded virus.

Limits and watch

Complex obfuscation hides the malicious code, so standard automated scanning may miss the embedded logic. You must perform detailed manual review to confirm complete removal. It remains unclear if the compromised liblzma library reached production environments beyond the identified beta and unstable distributions. This leaves the full scope of exposure uncertain. Watch for package managers installing from non-approved repositories or new ELF binaries appearing in PATH directories. Check for changes to SSH clients or libraries that signal an adversary is establishing persistent access or collecting credentials.

Vulnerabilities

  • CVE-2024-3094 — CVSS 10 (Critical) · CWE-506 · Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7. Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.

Techniques

  • T1195 Supply Chain Compromise (Initial Access)
  • T1195.001 Compromise Software Dependencies and Development Tools (Initial Access)
  • T1195.003 Compromise Hardware Supply Chain (Initial Access)
  • T1554 Compromise Host Software Binary (Persistence)
  • T1588.007 Artificial Intelligence (Resource Development)

Indicators

  • 9 indicators on file

Coverage

8. Warlock ransomware hits critical infrastructure in Portuguese and Spanish-speaking regions (Segment)

Event now covered by 3 outlets (was 2); Now attributed to malware: LockBit ransomware

What changed

Symantec attributes Warlock ransomware deployments to a Chinese threat group targeting critical infrastructure in Portuguese and Spanish-speaking countries. The group actively exploits unpatched Microsoft SharePoint vulnerabilities to compromise water utilities, telecommunications providers, universities, and regional governments. Symantec researchers verified that the attackers are leveraging SharePoint deployments that lack patches for both the 2025 vulnerabilities and the 2026 bugs. This activity persists despite prior warnings issued by Microsoft and CISA regarding these specific SharePoint security flaws. For detection engineering, focus on SharePoint servers with unapplied patches and anomalous administrative traffic. Watch for the domain truemedia[.]org, though its specific role is not yet confirmed. The primary signal to monitor is unpatched SharePoint instances in critical infrastructure sectors within the affected geographic scope.

How it works

The attack chain begins with the exploitation of unpatched SharePoint vulnerabilities to gain initial access to the target network. The Warlock ransomware strain specifically targets critical infrastructure organizations located in Portuguese- and Spanish-speaking countries.

What to do

Standard patching cycles have failed to close the attack surface for water utilities, telecommunications providers, and regional governments across Europe, Africa, and Latin America. Prioritize

Limits and watch

The specific role of the domain truemedia[.]org in the attack chain remains unconfirmed, limiting the ability to use it as a definitive indicator of compromise. Current evidence does not establish whether the attackers have successfully disabled security software on all targeted critical infrastructure systems, leaving the scope of active compromise uncertain. Track social media reconnaissance activities targeting staff roles and locations in the affected regions to detect early-stage preparation for phishing or spearphishing campaigns.

Techniques

  • T1001.003 Protocol or Service Impersonation (Command And Control)
  • T1005 Data from Local System (Collection)
  • T1008 Fallback Channels (Command And Control)
  • T1010 Application Window Discovery (Discovery)
  • T1012 Query Registry (Discovery)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.002 SMB/Windows Admin Shares (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • T1027.007 Dynamic API Resolution (Stealth)
  • and 10 more

Named actors and malware

  • LockBit (malware)
  • Lazarus group (actor)
  • LockBit ransomware (malware)

Indicators

  • 1 indicator on file

Coverage