Loki Intelligence — Security Briefs · Published
Daily Security Brief: Oracle EBS Probing, CISA KEV Additions, Device Code Phishing
Exploitation is moving quickly after patches and disclosures, with probing of Oracle E-Business Suite and CISA KEV additions touching VMware ESX, Linux, Magento and Brotli. Teams should patch internet-facing and cataloged software first, limit what service accounts, API keys and agents can reach, and review sign-in flows that attackers can abuse.
Signal 01 · The Hacker News
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Threat intelligence firm Defused Cyber reports that attackers are starting to probe a recently patched critical Oracle E-Business Suite flaw, CVE-2026-101767, an improper authentication issue rated CVSS 9.8.
Why it matters: Probing within days of a patch means organizations running EBS should apply the fix promptly and check whether the application is exposed to the internet.
Source: The Hacker News
Signal 02 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2026-41709 in Broadcom VMware ESX (insufficient logging) and CVE-2026-46300 in the Linux kernel (missing variable initialization).
Why it matters: KEV listings confirm real-world exploitation, so affected hypervisor and Linux hosts belong at the top of the patch queue.
Source: CISA
Signal 03 · BleepingComputer
Even after PHP2Shell, blast radius matters more than a CVSS score
Following the PHP2Shell episode, Token Security argues that attackers can exploit critical flaws before patching is finished, and that restricting service accounts, API keys and AI agents is as important as fixing vulnerabilities.
Why it matters: Scoping credentials and agent permissions to the minimum needed limits the damage when a patch arrives too late.
Source: BleepingComputer
Signal 04 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA's previous-day alert added CVE-2026-48356, an unrestricted dangerous file upload issue in Adobe Commerce and Magento, and CVE-2026-111497, an unchecked return value issue in Google Brotli, to the KEV Catalog.
Why it matters: Web shops on Adobe Commerce or Magento and teams that bundle Brotli should confirm patch status and review upload handling controls.
Source: CISA
Signal 05 · CISA
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
A CISA industrial control systems advisory covers Mitsubishi Electric and Iconics Digital Solutions products, with flaws that could allow arbitrary code execution (CVE-2023-4863), authentication bypass (CVE-2026-16436 and CVE-2026-16437) or arbitrary operations (CVE-2026-16438).
Why it matters: Operators of the listed products should review the advisory and keep these systems segmented from untrusted networks while updates are planned.
Source: CISA
Signal 06 · The Hacker News
American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
ANY.RUN's analysis describes a device code phishing campaign called Skyw4lker that targets American organizations by abusing legitimate cloud services and authentication mechanisms, leaving fewer obvious traces than classic credential theft.
Why it matters: Teams should review whether device code sign-in is needed, restrict it where it is not, and monitor for unexpected authorizations.
Source: The Hacker News
Signal 07 · BleepingComputer
Japan's GMO urges customers to shut down PCs amid ransomware threat
GMO Group asked customers to disconnect systems from the internet and shut down computers after a threat actor that breached its Onamae Desktop Cloud threatened to launch a ransomware attack.
Why it matters: Customers of hosted desktop services need a tested plan for isolating endpoints and a way to follow provider guidance quickly during an incident.
Source: BleepingComputer
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.