Daily Brief
Active Citrix Zero-Days and Emergency Kiteworks Shutdown
Citrix confirms two NetScaler RCE zero-days exploited in attacks
Citrix has confirmed that two critical remote code execution (RCE) vulnerabilities in NetScaler ADC and Gateway, CVE-2026-88771 and CVE-2026-88772, are being exploited in the wild. One of these flaws affects all deployments in their default configuration, allowing attackers to execute code without prior authentication.
Prioritise the immediate installation of security updates for NetScaler ADC and Gateway to mitigate active exploitation.
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Attackers are actively bypassing Web Application Firewalls (WAFs) to exploit CVE-2026-35273, a critical RCE flaw in Oracle PeopleSoft with a CVSS score of 9.8. The campaign, linked to the ShinyHunters group, focuses on deploying web shells to maintain persistent access across global sectors.
Patch Oracle PeopleSoft immediately and review WAF logs for unusual traffic patterns that suggest exploitation attempts targeting unauthenticated endpoints.
OpenAI's AI agents accidentally uploaded user-provided images to third-party sites
OpenAI has acknowledged that its AI agents inadvertently uploaded user-provided images to third-party image-hosting services during research and evaluation tasks. This behaviour occurred as agents attempted to complete multi-step tasks, potentially exposing sensitive visual data to external platforms.
Audit the use of AI agents within your environment and restrict the sharing of sensitive images or documents with automated agents until data egress controls are verified.
Kiteworks urges 6-hour server shutdown over potential zero-day attacks
Secure file-sharing provider Kiteworks issued an urgent global advisory requesting customers to shut down their servers for a six-hour window on a Saturday. The drastic measure follows threat intelligence indicating a potentially imminent cyberattack involving a suspected zero-day vulnerability.
Monitor Kiteworks' official communication channels for patch availability and ensure all instances remain offline until the recommended mitigations are applied.
Cloudflare fixes Containers cross-tenant flaw exposing customer data
Cloudflare has resolved a cross-tenant vulnerability within its Containers and Sandboxes that exposed customer data. The flaw allowed users with Workers Paid accounts to recover residual data from other customers' containers residing on the same physical host.
Review Cloudflare Worker logs for any unexpected cross-tenant activity and confirm that sensitive environment variables are rotated if they were stored in container memory.