Loki Intelligence — Security Briefs · Published
Daily Security Brief: Cisco SD-WAN KeyDrift, GitLab CVE-2026-97229, Oracle EBS
Exploitation of recently patched or edge-facing systems dominates today: Cisco SD-WAN controllers, GitLab and Oracle E-Business Suite are all under attack or probing, and two items are now confirmed in CISA's KEV catalog. Teams should prioritize patching these platforms, review exposure of management interfaces, and treat AI models, agent tooling and fake AI desktop apps as untrusted supply chain inputs.
Signal 01 · BleepingComputer
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly tracked threat group, UAT-11473, was seen exploiting CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework named KeyDrift.
Why it matters: Network control-plane systems are high-value targets, so confirm patch status, restrict management access and review controller logs for unexpected authentication activity.
Source: BleepingComputer
Signal 02 · The Hacker News
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
Alpine Linux reported that an attacker attempted to exploit the critical GitLab flaw CVE-2026-97229 (CVSS 10.0) on the project's own GitLab server, a week after GitLab shipped a fix. The flaw can allow code execution.
Why it matters: Exploitation attempts arrive within days of a fix, so self-hosted GitLab instances need to be updated quickly and not left exposed longer than necessary.
Source: The Hacker News
Signal 03 · The Hacker News
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Threat intelligence firm Defused Cyber says attackers are starting to probe for CVE-2026-101767 (CVSS 9.8), an improper authentication flaw in Oracle E-Business Suite that was patched only recently.
Why it matters: Apply the Oracle patch promptly and limit internet exposure of EBS components, since probing typically precedes wider exploitation.
Source: The Hacker News
Signal 04 · CISA
Siemens Mendix SAML Module
CISA published an advisory on the Siemens Mendix SAML module, which has an authentication bypass that could let an unauthenticated remote attacker gain access by replaying a valid SAML assertion in IdP-initiated flows. Siemens has released new versions for affected products.
Why it matters: Teams using Mendix with SAML single sign-on should update to the fixed versions and review how IdP-initiated login is configured and monitored.
Source: CISA
Signal 05 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation: CVE-2026-97229 in GitLab CE and EE, and CVE-2026-76418 affecting Cisco Secure Firewall ASA software and related Cisco products.
Why it matters: KEV listings confirm real-world exploitation, so these two should move to the front of the patch queue for any organization running the affected products.
Source: CISA
Signal 06 · BleepingComputer
Hugging Face malware campaign returns to hijack GPUs for crypto mining
A crypto-mining campaign abusing Hugging Face models returned days after a takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. A separate fake Solana starter kit on GitHub appears aimed at tricking AI coding agents.
Why it matters: Treat downloaded models and agent-consumed repositories as untrusted code: vet sources, run them in isolated environments and limit what coding agents can install or execute.
Source: BleepingComputer
Signal 07 · The Hacker News
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
A campaign dubbed Yoba delivers malicious loaders and cryptocurrency miners disguised as desktop apps for Anthropic Claude and OpenAI ChatGPT, using fake GitHub projects as the lure.
Why it matters: Restrict software installation to vetted sources and remind staff that AI tools should only be obtained from official vendor channels, since signed executables are not proof of legitimacy.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.