Loki Intelligence — Security Briefs · Published
Daily Security Brief: PeopleSoft, WordPress, and CI/CD Supply Chain Risks
Today's risks span mass exploitation of enterprise web applications, exploited webmail and WordPress flaws, and a supply-chain incident in which compromised GitHub Actions quietly resumed running malicious code. Teams should prioritize patching exposed web platforms, confirming that WAF rules handle encoded requests, and pinning CI dependencies to known-good commits while rotating exposed secrets.
Signal 01 · The Hacker News
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Google reports renewed mass exploitation of CVE-2026-35273, a critical Oracle PeopleSoft remote code execution flaw, by the ShinyHunters-linked cluster UNC6240. The actor evaded string-based WAF rules by URL-encoding a single character in the vulnerable PSEMHUB path, then deployed web shells and a backdoor across sectors including education, healthcare and government.
Why it matters: Patch PeopleSoft, disable or remove the EMHub component where possible, make WAF rules match decoded paths, and rotate credentials readable by the application service account.
Source: The Hacker News
Signal 02 · The Hacker News
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Roundcube Webmail's pre-authentication SQL injection, CVE-2026-48842, is now confirmed as exploited, according to Canada's Cyber Centre. The bug sits in the virtuser_query plugin and was fixed in May in releases 1.6.16 and 1.7.1, while Shadowserver counts more than 523,000 Roundcube instances exposed online.
Why it matters: Webmail holds credentials and sensitive correspondence, so upgrade promptly, disable unused plugins, and monitor database activity and logins for signs of data harvesting.
Source: The Hacker News
Signal 03 · Cloudflare Security
Agents can now set up your website’s security with Turnstile Spin
Cloudflare's Turnstile Spin lets coding agents set up its free bot challenge, covering both widget embedding and backend token verification, with the developer approving each plan. Cloudflare flags widgets that receive traffic without server-side validation and offers Spin as the fix path, and says application code is not sent to Cloudflare.
Why it matters: AI-built apps often ship half-finished security controls, so audit bot and abuse protections end to end, especially server-side validation, before relying on them for login or signup flows.
Source: Cloudflare Security
Signal 04 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA's KEV catalog gained two actively exploited entries: a Microsoft SharePoint code injection vulnerability, CVE-2026-65660, and a MikroTik RouterOS workflow enforcement flaw, CVE-2026-67279. The catalog notes the RouterOS issue can be chained with an earlier RouterOS bug to achieve unauthenticated exploitation.
Why it matters: Prioritize SharePoint and RouterOS updates, restrict router management to trusted networks, and audit both platforms for unexplained configuration changes or new administrative sessions.
Source: CISA
Signal 05 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added the WordPress Core remote file inclusion flaw CVE-2026-87902 to the KEV catalog, confirming exploitation in the wild. The catalog entry describes an unauthenticated path to include a readable local PHP file outside the theme directories, potentially resulting in remote code execution.
Why it matters: Inventory every WordPress install, including marketing microsites and agency-hosted pages, and confirm each runs a patched core release rather than assuming auto-updates succeeded.
Source: CISA
Signal 06 · The Hacker News
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Patchstack disclosed a high-severity CSRF flaw in Elementor Website Builder 4.3.0 and 4.3.1, fixed in 4.3.2, that lets a crafted link make a logged-in user perform any REST API action their role permits. On a default site, an administrator clicking the link can unknowingly create a new admin account for the attacker.
Why it matters: Update Elementor to 4.3.2, review WordPress user lists for unexpected administrators, and remind site admins that links opened while logged in can trigger privileged actions.
Source: The Hacker News
Signal 07 · The Hacker News
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two actions-cool GitHub Actions compromised in the May 2026 Mini Shai-Hulud campaign, issues-helper and maintain-one-comment, became accessible again on September 16 with release tags still pointing to malicious code, Socket reported. Workflows referencing them by tag resumed running a credential-stealing payload until GitHub disabled them again.
Why it matters: Pin third-party actions to verified commit SHAs, search workflows for the affected actions, rotate any secrets they could reach, and review run history after September 16.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.