cybr.cx Daily Digest — September 28, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-67279 | MikroTik RouterOS
CISA KEV listed with a remediation deadline of today. An unauthenticated attacker can open a session channel and send exec requests without any credentials — and this flaw is explicitly designed to chain with CVE-2026-86060 to achieve full unauthenticated exploitation. MikroTik devices are pervasive in SMB and ISP infrastructure; if you operate RouterOS anywhere in your environment, treat this as a drop-everything patch priority.

⚠️ Actively exploited — CVE-2026-65660 | Microsoft SharePoint
Also KEV-listed with a today deadline. An authorised attacker can execute arbitrary code over the network via a code injection vulnerability. "Authorised" here means any user with standard SharePoint access, which in most organisations is a very low bar. On-prem SharePoint deployments should be patched or isolated immediately.

⚠️ Actively exploited — CVE-2026-87902 | WordPress Core
Unauthenticated remote code execution via local file inclusion — an attacker can manipulate page-template resolution to include arbitrary readable .php files outside the active theme directories. WordPress installations are being targeted at scale; hosting providers and managed WordPress operators should be treating this as critical regardless of plugin mix.

⚠️ Actively exploited — CVE-2026-5430 | WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway
Path traversal enabling unrestricted file upload leading to RCE, with a CISA deadline that passed yesterday. WSO2 products are common in enterprise API gateway deployments; any internet-facing instance should be considered compromised until proven otherwise. Check for unexpected files in upload directories.

⚠️ Actively exploited — CVE-2026-71362 | Adobe Commerce / Magento
An incorrect authorisation flaw allowing privilege escalation to sensitive resources with no user interaction required. E-commerce operators running on-premise Magento or Adobe Commerce are at direct risk of payment data exposure. Deadline passed; if you haven't patched, assume active targeting.

⚠️ Actively exploited — CVE-2026-94127 | F5 BIG-IP APM
A heap-based buffer overflow in BIG-IP APM triggers when both an access policy and an OAuth profile are configured on a virtual server, enabling unauthenticated RCE. F5 appliances sitting at network perimeters are high-value targets for initial access brokers. Patch or remove the OAuth profile configuration as an interim mitigation.

⚠️ Actively exploited — CVE-2026-93952 | Arista VeloCloud Orchestrator
An improper input validation flaw in the on-prem VeloCloud Orchestrator gives remote attackers access to privileged internal functionality, with full CIA impact on the orchestrator host. SD-WAN orchestration compromise is a gateway to mass branch-site manipulation. Deadline passed; network operations teams should treat any unexplained VCO behaviour as indicative of compromise.

⚠️ Actively exploited — CVE-2026-93616 & CVE-2026-85102 | Check Point (Multiple Products)
Two separate actively exploited flaws affecting Check Point's security management and gateway products. CVE-2026-93616 is a path traversal in Security Management Server, Multi-Domain Server, Log Server and SmartEvent that allows unauthenticated script upload and execution. CVE-2026-85102 is an improper certificate validation flaw in Security Gateway and Spark Firewall enabling unauthenticated RCE via the VPN surface. Having your security management plane and your VPN gateway both under active exploitation simultaneously is a genuinely bad position — prioritise accordingly.

⚠️ Actively exploited — CVE-2026-7273 | Zyxel GS1900 Series Switches
A stack-based buffer overflow in the CGI program of GS1900 series switches allows a LAN-side unauthenticated attacker to execute OS commands via a crafted HTTP request. "LAN-based" doesn't mean safe — threat actors inside perimeters, or with access via other compromised hosts, will use this for lateral movement through network infrastructure.

CVE-2026-100870 & CVE-2026-100871 | Sylius | CVSS 8.8
Two critical authentication flaws in the Sylius PHP e-commerce framework affect versions before the 1.12.25/1.13.17/1.14.20/2.1.16/2.2.9 patches. CVE-2026-100870 allows host header injection during password reset to redirect admin tokens to attacker-controlled domains. CVE-2026-100871 is arguably worse: a JWT firewall confusion bug lets a shop customer account registered with an admin's email obtain a token that the Admin API treats as fully authoritative — granting complete administrative access with no privilege escalation needed.

CVE-2026-100856 | AzuraCast | CVSS 8.8
In AzuraCast before 0.23.6, the remote relay password field still uses a vulnerable cleanUpString method rather than the safer toRawString, allowing users with RemoteRelays station permission to inject Liquidsoap interpolation syntax. The result is arbitrary code execution inside the Liquidsoap audio streaming process, plus potential disclosure of internal API keys. Niche platform, but community radio and streaming operators should patch immediately.

CVE-2026-100864 | heym | CVSS 8.8
A sandbox escape in the heym workflow expression engine (before 0.0.91) allows authenticated users to access Python dunder attributes through item expressions or the fallback resolver, ultimately reaching os.system for arbitrary command execution as the backend process. If heym is deployed in any multi-tenant or shared workflow environment, this is a direct path to host compromise.

CVE-2026-101060 | python-utcp | CVSS 8.2
An SSRF in python-utcp before 1.1.4 — the HTTP client validates the initial tool URL but blindly follows redirects without re-validating the destination. A malicious tool endpoint can issue a 302 to cloud metadata services (think 169.254.169.254) or internal HTTP infrastructure. Particularly relevant for any AI/MCP toolchain deployments using UTCP as a transport layer.

CVE-2026-100839 | Contrast (Kubernetes confidential computing runtime) | CVSS 8.4
Dubbed "BadAML," this flaw in Contrast before 1.18.0 allows a host-level attacker — explicitly an assumed adversary in the confidential computing threat model — to inject malicious AML bytecode via ACPI tables passed from QEMU through OVMF to the guest Linux kernel's AML interpreter. This undermines the core security guarantee of the confidential computing runtime. If your threat model includes a malicious host, this needs immediate attention.

Headline News

ShinyHunters Bypasses WAF Mitigations to Resume Oracle PeopleSoft Exploitation

The ShinyHunters extortion group has resumed large-scale exploitation of a critical Oracle PeopleSoft vulnerability (CVE-2026-35273) by using a URL-encoding trick to slip past web application firewall rules that organisations deployed as a temporary mitigation. The technique encodes request components in a way that WAF signature matching fails to recognise as malicious, while the backend PeopleSoft application decodes and processes the payload normally — a classic WAF bypass class that defenders should always assume is findable by determined threat actors. This is a significant operational lesson: WAF rules are a stopgap, not a fix, and ShinyHunters have now demonstrated that assumption publicly. Organisations running PeopleSoft HR, finance, or ERP modules internet-facing should treat the WAF bypass as dissolved and apply vendor patches or take the application offline. ShinyHunters has a well-documented history of large-scale data exfiltration followed by ransom demands, and PeopleSoft environments typically hold highly sensitive HR and financial data, making this a particularly damaging target set.

File Notification Side-Channel Attacks Demonstrated Across Linux, Windows, and macOS

Researchers have published tooling and artifacts demonstrating a class of side-channel attacks that abuse filesystem notification APIs — inotify on Linux, FSEvents on macOS, and equivalent mechanisms on Windows — to leak sensitive information without requiring elevated privileges. The attacks show that an unprivileged process monitoring file notification events can infer keystroke timing, reconstruct user activity patterns, and perform website fingerprinting based purely on the pattern and timing of filesystem events generated by a browser or other application. The technique requires no memory corruption, no kernel exploit, and no special permissions — just the ability to register filesystem watches, which is available to any normal user process on all three platforms. For practitioners, this matters most in shared-host environments, containers with host filesystem mounts, and any context where process isolation is assumed to prevent information leakage between tenants or users. Endpoint detection logic that ignores filesystem event API abuse as a low-fidelity signal may need revisiting.

Schrödinger's Feed

The quantum data feed is in a superposition of empty and emptier today — no items resolved on measurement. Rather than collapse the wavefunction into fiction, we're acknowledging the gap: quantum computing news arrives in bursts, not streams, and today the field is apparently between announcements. For practitioners, the standing observation remains: NIST's post-quantum standards (ML-KEM, ML-DSA, SLH-DSA) are finalised, and the gap between "we should migrate" and "we have migrated" is where real risk lives. Check back tomorrow — the quantum world rarely stays quiet for long.

/dev/random

A project called TinyAIArena has launched, and it does exactly what it sounds like: AI agents are pitted against each other in small-scale battles while you watch. The security-adjacent amusement here is that "watch AI agents autonomously interact with systems and each other in a constrained environment" is also a reasonable description of several red team research projects — just with less entertainment framing. It's genuinely unclear whether the appeal is benchmarking model behaviour, AI gladiatorial spectacle, or simply the comfort of seeing something get defeated that isn't your WAF. Either way, it's Friday-adjacent and the arena awaits.