TL;DR
Oracle PeopleSoft CVE-2026-35273 is under active mass exploitation via WAF-bypass techniques; ShinyHunters is deploying web shells across multiple sectors. Microsoft issued its largest patch batch ever (974 CVEs). Lunex stealer malware abuses AMD drivers to disable security and steal credentials.
Executive Summary
- Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) is undergoing mass exploitation using URL-encoding tricks to bypass WAF protections; ShinyHunters threat actors are deploying web shells globally.
- Microsoft released 974 security patches in its largest single batch ever, addressing CVE-2026-69730, CVE-2026-69829, CVE-2026-81963, and CVE-2026-85880 among others.
- Lunex stealer malware, distributed via compromised Ukrainian websites, leverages AMD driver vulnerabilities to disable security monitoring and harvest browser credentials.
- CISA added MikroTik RouterOS and Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation.
- Elementor WordPress plugin CSRF flaw allows unauthenticated attackers to create rogue administrator accounts and seize site control.
Top Threats Today
1. Oracle PeopleSoft Mass Exploitation via WAF Bypass
Severity: HIGH Affected: Finance, Technology
The ShinyHunters extortion gang is conducting widespread exploitation of Oracle PeopleSoft vulnerability CVE-2026-35273 (CVSS 9.8) by using URL-encoding tricks to circumvent web application firewall (WAF) defenses that would otherwise mitigate the flaw [1][2]. Google has warned of renewed mass exploitation targeting multiple sectors globally as part of this campaign [1]. The ShinyHunters-linked activity involves weaponization of the flaw to enable web shell deployment and potential remote code execution [1]. The technique bypasses traditional WAF rules, allowing threat actors to resume exploitation of vulnerable servers despite existing mitigations [2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Review PeopleSoft deployments for indicators of compromise; examine web server logs for URL-encoded payloads and anomalous shell file creation
- Apply WAF rules that detect both standard and URL-encoded variants of known exploit patterns
- Prioritize patching of CVE-2026-35273 or implement network segmentation if patching is not immediately feasible
2. Microsoft's 974-CVE Patch Batch Released
Severity: HIGH Affected: Technology, Government
Microsoft issued updates to address at least 974 security holes in Windows operating systems and other software in its largest single patch batch to date [1]. The patch set includes CVE-2026-69730, CVE-2026-69829, CVE-2026-81963, and CVE-2026-85880 [1]. Security experts caution that while artificial intelligence is aiding Microsoft’s vulnerability discovery, many of the newly discovered flaws may not yet have public exploits or widespread exploitation reports [1].
Sources:[1] Krebs on Security
Recommended Action
- Prioritize testing and deployment of Microsoft patches in a staged environment before production rollout
- Monitor security bulletins for any patches that are actively exploited or flagged as critical priority by CISA
- Document patch deployment timeline and track compliance across all affected Windows and Office installations
3. Lunex Stealer Malware Abuses AMD Driver for Security Bypass
Severity: HIGH Affected: Technology
Lunex stealer malware, distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks, is part of a wider malware-as-a-service (MaaS) platform [1]. The malware employs a four-stage attack chain that abuses an AMD driver to disable security monitoring and subsequently harvest browser credentials [1]. This technique represents a sophisticated approach to evading endpoint detection and response (EDR) solutions while extracting sensitive authentication data.
Sources:[1] The Hacker News
Recommended Action
- Audit systems for unexpected AMD driver loads or unsigned driver installations; investigate any EDR/security tool disablement events
- Review browser credential storage and implement credential guard or hardware-backed secret storage where available
- Block or monitor access to known compromised Ukrainian domains and validate domain reputation before user access
4. CISA Adds MikroTik and SharePoint Flaws to Known Exploited Vulnerabilities Catalog
Severity: HIGH Affected: Government, Technology
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added MikroTik RouterOS and Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on September 25, citing evidence of active exploitation in the wild [1]. MikroTik RouterOS contains an improper enforcement of behavioral workflow vulnerability that allows unauthenticated clients to open session channels and send exec requests; this can be chained with CVE-2026-86060 to achieve unauthenticated exploitation [2]. Microsoft SharePoint contains a code injection vulnerability that allows authorized attackers to execute code over a network ⚠[3]. Federal agencies are required to remediate these vulnerabilities by September 28, 2026 [2][3].
Sources:[1] The Hacker News[2] CISA KEV[3] CISA KEV
Recommended Action
- Verify inventory of all MikroTik RouterOS and Microsoft SharePoint installations; assess network exposure of affected systems
- Apply available patches or implement network access controls to restrict unauthenticated connections to RouterOS SSH/exec interfaces
- Monitor for evidence of session establishment or code injection attempts in SharePoint audit logs
5. Elementor WordPress Plugin CSRF Flaw Enables Site Takeover
Severity: HIGH Affected: Technology
A high-severity cross-site request forgery (CSRF) vulnerability has been disclosed in the Elementor Website Builder WordPress plugin that allows unauthenticated attackers to create rogue administrator accounts and assume full control of a vulnerable website [1]. The flaw requires only that a site administrator click a crafted malicious link while logged in, placing any site using the plugin at risk of account hijacking and persistent backdoor access [1].
Sources:[1] The Hacker News
Recommended Action
- Immediately disable or remove Elementor if a patch is not yet available; use an alternative page builder temporarily
- If patched version is available, update Elementor and review user accounts for unauthorized administrator additions created during the vulnerability window
- Implement strict cookie SameSite policies and enforce CSRF token validation on all site-altering actions
Today’s Action Checklist
- ☐ URGENT: Patch or segment Oracle PeopleSoft systems; monitor web server logs for URL-encoded payloads and shell file creation
- ☐ URGENT: Review all Elementor-powered WordPress sites for unauthorized admin accounts; update or remove plugin if unpatched
- ☐ HIGH: Inventory MikroTik RouterOS and Microsoft SharePoint installations; apply patches or restrict network access by Sept 28
- ☐ HIGH: Stage and test Microsoft’s 974-CVE patch batch in non-production environments; prioritize critical and actively exploited CVEs
- ☐ MEDIUM: Scan endpoints for AMD driver abuse, EDR disablement, and Lunex indicators; review browser credential storage mechanisms