Daily Security Intelligence Briefing — September 26, 2026
Tier 1 — Priority Targets (Must-Read)
1. Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Source & Article Link: The Hacker News
Technical Severity / Domain: Enterprise Software / CVE-2026-35273 (Mass Exploitation)
Why You Must Read This: Google issued an urgent warning regarding renewed, widespread exploitation of an unauthenticated remote code execution vulnerability in Oracle PeopleSoft across multiple sectors globally. Threat actors linked to ShinyHunters are deploying Web Application Firewall bypass techniques to drop web shells on compromised servers. Because PeopleSoft houses mission-critical HR and financial data across thousands of organizations, unauthenticated remote access creates immense systemic risk.
Recommended Immediate Action: Audit web server logs for WAF bypass anomalies and web shell drops, and apply Oracle's official security patch for CVE-2026-35273 immediately.
2. Kiteworks urges 6-hour server shutdown over potential zero-day attacks
Source & Article Link: BleepingComputer
Technical Severity / Domain: Secure File Transfer / Zero-Day Threat
Why You Must Read This: Secure file-transfer provider Kiteworks (formerly Accellion) instructed its enterprise customer base globally to shut down servers temporarily after federal intelligence authorities warned of an imminent attack campaign. The precautionary measure aims to shield organizations from potential zero-day exploitation targeting high-value sensitive files. Managed file transfer systems remain top-tier targets for ransomware syndicates and extortion actors seeking bulk data access.
Recommended Immediate Action: Follow Kiteworks emergency guidance to isolate or shut down managed file transfer appliances until software mitigations or patches are released.
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
Domain: Enterprise Vulnerabilities
Subject / Topic Summary: CISA added Microsoft SharePoint Server (CVE-2026-65660) and MikroTik RouterOS flaws to its Known Exploited Vulnerabilities catalog. Microsoft confirmed reliable evidence of real-world attacks exploiting the SharePoint code injection vulnerability to achieve remote code execution.
Key Technical & Strategic Takeaways: CISA added CVE-2026-65660 (SharePoint RCE) to the KEV catalog following active in-the-wild exploitation.; On-premise SharePoint servers must be updated immediately to prevent unauthorized command execution.
Essential Direct Quote: As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability.
Source: The Hacker News
2. Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk
Domain: AI & Cloud Security
Subject / Topic Summary: Security researchers uncovered 'SalesBleed', a set of zero-click vulnerabilities in Salesforce Agentforce AI agents. The flaws allow remote prompt injection and unauthorized exfiltration of sensitive CRM database records via DNS queries without user interaction.
Key Technical & Strategic Takeaways: Zero-click prompt injection enables untrusted inputs to instruct AI agents to exfiltrate enterprise data.; Agentic workflows operating with elevated database privileges introduce unmonitored execution vectors into production CRMs.
Essential Direct Quote: The 'SalesBleed' set of weaknesses in Salesforce's Agentforce agents exposed CRM data to attackers via prompt injection and DNS exfiltration.
Source: Infosecurity Magazine
3. ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
Domain: Threat Intelligence
Subject / Topic Summary: The Clop ransomware group was forced to relocate its data leak site to a new Tor location after threat actor group ShinyHunters hacked and defaced the server. The breach exploited an unauthenticated path traversal flaw in the Grav CMS software hosting the portal.
Key Technical & Strategic Takeaways: Ransomware infrastructure remains susceptible to exploitation through standard public CMS vulnerabilities.; Conflict between rival cybercrime groups continues to expose backend threat actor operational assets.
Essential Direct Quote: The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced...
Source: BleepingComputer
4. PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
Domain: Endpoint Security
Subject / Topic Summary: Threat researchers identified an updated variant of PamStealer malware targeting macOS users. The new version utilizes JavaScript for Automation (JXA) droppers combined with server-side decryption keys, preventing static payload analysis until live C2 communication occurs.
Key Technical & Strategic Takeaways: PamStealer requires live C2 server key exchange to reconstruct its primary payload dynamically.; Attackers continue leveraging macOS JXA scripting features to bypass conventional endpoint detection controls.
Essential Direct Quote: Where earlier variants embedded their payload key material, the latest artifacts ensure that the main payload can only be recovered using a server-side decryption chain.
Source: The Hacker News
5. Threat detection dashboards are masking security coverage gaps
Domain: Security Operations
Subject / Topic Summary: An analysis of nearly 15,000 active detection rules across SIEM, EDR, and cloud tools revealed that 47% fail to fire during simulated adversary testing. Security teams relying strictly on dashboard indicators face significant blind spots in active threat detection.
Key Technical & Strategic Takeaways: 47% of deployed detection rules fail to trigger when subjected to real-world attack techniques.; Organizations must complement metric dashboards with automated breach and attack simulation to validate detection posture.
Essential Direct Quote: A detection rule can show up as deployed on a coverage dashboard and still never fire when an attacker uses the technique it was built to catch.
Source: Help Net Security