Daily Brief
CISA Flags SharePoint Exploits; Kiteworks Issues Emergency Alert
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
The ShinyHunters extortion group is using URL-encoding techniques to bypass Web Application Firewall (WAF) rules designed to mitigate CVE-2026-35273 in Oracle PeopleSoft. This critical remote code execution flaw (CVSS 9.8) allows unauthenticated attackers to deploy web shells on vulnerable servers despite existing WAF protections.
Review WAF logs for unusual URL-encoded strings targeting PeopleSoft endpoints and ensure the primary Oracle security patches are applied rather than relying solely on firewall mitigations.
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA has added CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint, and an undisclosed Mikrotik RouterOS flaw to its Known Exploited Vulnerabilities (KEV) catalog. These additions follow reports of active exploitation in the wild, posing a significant risk for remote code execution.
Prioritise patching SharePoint and MikroTik assets immediately, as these are now confirmed targets for active exploitation by threat actors.
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
A high-severity CSRF vulnerability (CVSS 8.8) in the Elementor Website Builder for WordPress allows unauthenticated attackers to create rogue administrator accounts. Exploitation occurs when a site administrator clicks a specially crafted link while authenticated to the WordPress dashboard.
Update Elementor to the latest version immediately and educate administrative staff on the risks of clicking untrusted links while logged into CMS dashboards.
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack
Secure file-sharing provider Kiteworks urged customers to shut down their systems for a nine-hour window following 'credible threat intelligence' from federal authorities regarding an imminent attack. The preventative measure was intended to protect customer data from a potential zero-day exploit or targeted intrusion campaign.
Verify out-of-band communication channels with critical SaaS providers to ensure your team can receive and act on emergency shutdown advisories outside of standard support tickets.
GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Two third-party GitHub Actions (issues-helper and maintain-one-comment) were re-enabled by maintainers while still containing malicious code from the 'Mini Shai-Hulud' campaign. The actions remained accessible for over a week after being unblocked, demonstrating the risks of automated supply chain dependencies.
Audit GitHub Actions workflows and pin third-party actions to specific commit SHAs rather than using tags like @v1 to prevent automatic updates to compromised versions.