About this episode
This week, SOC Minute follows active exploitation from exposed enterprise systems and persistent web compromise into stolen identities, targeted malware, and the growing role of AI in data exposure, social engineering, and automated attacks.
This episode brings together the week’s most relevant cybersecurity stories and their operational context for defenders.
Play the episode, then review the stories and chapter list for the reporting and topics covered.
Stories covered this week
Attackers Exploit Oracle PeopleSoft Flaw to Deploy Web Shells
Google warns of a global campaign exploiting a critical Oracle PeopleSoft vulnerability, CVE-2026-35273, enabling unauthenticated remote code execution. The threat actor linked to ShinyHunters bypasses WAFs to weaponize this flaw and deploy web shells.
Source: The Hacker News
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC and Gateway
CISA warns of eight new vulnerabilities in Citrix NetScaler ADC and Gateway products, including two critical zero-days actively exploited in the wild enabling remote code execution. Organizations are urged to prioritize mitigation and review indicators of compromise before patching.
Source: CISA
CISA Adds New Fortinet FortiMail Vulnerability to Exploited Catalog
CISA has added CVE-2026-104286, a Fortinet FortiMail path traversal flaw, to its Known Exploited Vulnerabilities Catalog due to active exploitation. This vulnerability poses significant risks, prompting priority remediation under federal directives.
Source: CISA
Cisco Warns of Critical Authentication Bypass in SD-WAN Manager
Cisco has disclosed a critical zero-day vulnerability, CVE-2026-76504, in its Catalyst SD-WAN Manager that allows unauthenticated remote attackers to gain admin access via the API. Fixed releases are available, but no workaround exists.
Source: The Hacker News
Critical Vulnerabilities Found in Armatura One Affecting Access Control Systems
Multiple critical vulnerabilities in Armatura LLC's Armatura One could allow unauthenticated attackers to execute arbitrary code and gain unauthorized access to control systems. The issues include deserialization flaws, hard-coded credentials, and sensitive data leakage, with patches now available in versions 4.7.2 and 4.6.1_USA.
Source: CISA
Critical FortiMail Zero-Day Allows Unauthenticated Arbitrary File Writes
CISA has added a critical Fortinet FortiMail zero-day vulnerability to its KEV catalog after reports of active exploitation. The flaw, CVE-2026-104286, permits unauthenticated attackers to write arbitrary files on targeted systems.
Source: The Hacker News
Dell CSM Flaws Allow Unauthenticated Admin and Root Access on Kubernetes
Dell has patched critical vulnerabilities in its Container Storage Modules allowing unauthenticated access to admin and root privileges on Kubernetes nodes. The most severe flaw carries a CVSS score of 10.0, enabling attackers to bypass authentication on key services.
Source: The Hacker News
Star Blizzard advances phishing and malware with RedFlick technique
Since early 2026, Microsoft has tracked Russian state actor Star Blizzard using enhanced phishing and a new malware delivery method called RedFlick, improving their evasion capabilities. This evolution represents a sophisticated threat in ongoing cyber campaigns.
Source: Microsoft
China-linked UAT-11587 targets Asian governments with Antino backdoor
Cisco Talos uncovered UAT-11587, a China-linked threat actor targeting government and policy organizations across Asia using a new Antino backdoor. The campaign affects Taiwan, India, the Philippines, and Cambodia.
Source: Talos Intelligence
Lunex Stealer Uses AMD Driver to Evade Security and Steal Credentials
The Lunex malware-as-a-service platform employs a new Psychedelic Stealer variant that abuses an AMD driver to disable security monitoring and steal browser credentials, targeting Ukrainian-speaking users via compromised sites. The attack chain starts with a fake CAPTCHA page to bypass defenses.
Source: The Hacker News
NeedyMantis: Modular Malware Threat in Targeted Intrusions
Microsoft Threat Intelligence uncovered NeedyMantis, a sophisticated post-compromise malware framework that uses custom loaders and encrypted archives for long-term access in targeted operations. This modular design allows for flexible and persistent attacker activity.
Source: Microsoft
WordPress Backdoor Rebuilds Itself Using Files, Database, and Shared Memory
Researchers uncovered a WordPress backdoor named SC that uses multiple persistence methods to rebuild itself after cleanup. The malware is described as a 'self-healing mesh,' making it hard to fully remove.
Source: The Hacker News
Warlock ransomware exploits SharePoint in water and telecom attacks
The China-linked ransomware group Warlock targeted a water utility, telecom provider, regional government, and university by exploiting SharePoint vulnerabilities for initial access. The attacks highlight ongoing risks to critical infrastructure and public sector organizations.
Source: BleepingComputer
French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Weeks
Attackers used stolen passwords to access tax data of hundreds of thousands in France, remaining undetected for seven weeks. The breach was due to weak detection despite no sophisticated techniques.
Source: The Hacker News
OpenAI agents accidentally uploaded user images to third-party sites
OpenAI's AI agents unintentionally uploaded user-provided images to third-party image hosting services during testing and evaluation. The issue raises privacy and data handling concerns tied to AI research practices.
Source: BleepingComputer
80,000+ Organizations Exposed by Stolen AI Logins and LLMjacking
Infostealer logs have exposed AI credentials and sessions linked to over 80,000 corporate domains, increasing risks of stolen data and LLMjacking attacks. SOCRadar highlights the growing underground market for stolen AI logins and offers guidance to assess exposure.
Source: BleepingComputer
Automated AI Agent Used to Breach Cybersecurity Nonprofit DIVD
The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a disruptive cyberattack carried out by an automated AI agent. The incident was described as loud and very messy, highlighting emerging AI-driven threats.
Source: BleepingComputer
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Threat actors are exploiting ChatGPT Custom GPTs to impersonate legitimate products and lead victims to malicious sites using ClickFix lures that deliver remote access trojans. Huntress observed this novel abuse of AI platform features in late September 2026.
Source: The Hacker News
Chapters
- Opening
- Attackers Exploit Oracle PeopleSoft Flaw to Deploy Web Shells
- WordPress Backdoor Rebuilds Itself Using Files, Database, and Shared Memory
- Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC and Gateway
- Cisco Warns of Critical Authentication Bypass in SD-WAN Manager
- CISA Adds New Fortinet FortiMail Vulnerability to Exploited Catalog
- Critical FortiMail Zero-Day Allows Unauthenticated Arbitrary File Writes
- Dell CSM Flaws Allow Unauthenticated Admin and Root Access on Kubernetes
- Critical Vulnerabilities Found in Armatura One Affecting Access Control Systems
- Warlock Ransomware Exploits SharePoint in Water and Telecom Attacks
- French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Weeks
- Star Blizzard Advances Phishing and Malware with RedFlick Technique
- Lunex Stealer Uses AMD Driver to Evade Security and Steal Credentials
- NeedyMantis: Modular Malware Threat in Targeted Intrusions
- China-Linked UAT-11587 Targets Asian Governments with Antino Backdoor
- OpenAI Agents Accidentally Uploaded User Images to Third-Party Sites
- 80,000+ Organizations Exposed by Stolen AI Logins and LLMjacking
- Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
- Automated AI Agent Used to Breach Cybersecurity Nonprofit DIVD
- Closing