Loki Intelligence — Security Briefs · Published
Daily Security Brief: Citrix Zero-Days, PeopleSoft Attacks, and Router Takeovers
Today's risk is concentrated at the network edge, with two Citrix NetScaler zero-days exploited before fixes existed, plus active attacks on PeopleSoft, SharePoint and MikroTik routers. Teams should patch edge appliances immediately, check for compromise before and after upgrading, and harden endpoints against vulnerable-driver abuse used to disable security tools.
Signal 01 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two Citrix NetScaler ADC and Gateway vulnerabilities to the KEV catalog: CVE-2026-88771, an improper input validation flaw that could let unauthenticated attackers execute commands, and CVE-2026-88772, a memory buffer issue that could enable remote code execution or denial of service.
Why it matters: NetScaler appliances sit at the network edge, so apply Citrix's fixed builds immediately and assess for compromise, since exploitation began before patches were public.
Source: CISA
Signal 02 · The Hacker News
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Mandiant says UNC6240, linked to ShinyHunters, renewed attacks on Oracle PeopleSoft through CVE-2026-35273 by evading WAF path rules with an encoded character. Post-exploitation included JSP web shells, the SIDEEYE backdoor, tunneling tools and legitimate remote management software, with about a quarter of commands running as root or SYSTEM.
Why it matters: Search WebLogic logs for PSEMHUB requests including encoded variants, inspect for web shells, review bulk HR and student-record database exports, and prepare for possible extortion contact.
Source: The Hacker News
Signal 03 · CISA
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
CISA amplified Citrix's disclosure of eight NetScaler ADC and Gateway vulnerabilities, two of which, CVE-2026-88771 and CVE-2026-88772, are critical zero-days that can each enable remote code execution and are being exploited globally. CISA urges organizations to check for compromise before patching and to preserve forensic evidence first.
Why it matters: Because updating can erase forensic visibility, capture evidence and check for compromise before upgrading, then patch every affected appliance without delay.
Source: CISA
Signal 04 · The Hacker News
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
A CSRF weakness in Elementor 4.3.0 and 4.3.1 skips request-forgery protection for cookie-authenticated REST calls based on text the attacker controls in the request URI, so one crafted link can drive any REST action available to a logged-in victim. Patchstack rates it 8.8, and Elementor fixed it in 4.3.2.
Why it matters: Patch to 4.3.2, audit for newly created administrator accounts, and keep privileged WordPress sessions short-lived to reduce exposure to link-based attacks.
Source: The Hacker News
Signal 05 · The Hacker News
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
Citrix confirmed on September 27 that two critical NetScaler ADC and Gateway flaws, CVE-2026-88771 and CVE-2026-88772, were exploited before fixes existed, and released updates covering them plus six other bugs. One affects all deployments; the other affects appliances with DTLS enabled, the default for VPN virtual servers.
Why it matters: Upgrade to 14.1-73.37, 13.1-64.23 or the listed FIPS builds, including appliances patched in August, and follow Citrix's compromise guidance, since patching does not reveal earlier intrusion.
Source: The Hacker News
Signal 06 · The Hacker News
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Ontinue linked a Psychedelic Stealer campaign against Ukrainian-speaking users to Lunex, a malware-as-a-service platform. The chain starts with ClickFix fake CAPTCHA pages on compromised sites, abuses a vulnerable AMD driver (CVE-2023-20598) to blind security tools, then steals browser credentials and crypto wallet data and persists through a browser native messaging host.
Why it matters: Block known vulnerable drivers beyond default blocklists, train users to distrust copy-and-run verification prompts, and monitor for unexpected browser native messaging hosts or extensions.
Source: The Hacker News
Signal 07 · The Hacker News
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA flagged a SharePoint flaw, CVE-2026-65660, which Microsoft revised from spoofing to remote code execution, and a RouterOS bug, CVE-2026-67279, as exploited. CERT Polska says the RouterOS flaw, chained with CVE-2026-86060 in an exploit called MikroTrick, gives unauthenticated attackers full administrative control of exposed routers.
Why it matters: Update SharePoint Server and RouterOS, remove router administration from internet exposure, and review both platforms for unfamiliar admin accounts or configuration changes.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.