Inferlume

[+] Citrix NetScaler Appliance Infiltration: Threat actors have weaponized three separate vulnerabilities within NetScaler ADC and Gateway systems. Intruders send crafted DTLS network packets to trigger memory corruption under CVE-2026-88771 and CVE-2026-88772, achieving unauthenticated command execution. Following access, adversaries modify the core web server configuration file httpd.conf to instruct the Apache daemon to execute non script files, such as static style sheets, as PHP scripts. Intruders then upload WHIPSHOT, a stealthy PHP web shell disguised within style sheets that parses Base64 commands concealed inside native HTTP headers. To expand operational reach, attackers deploy SLAPSHOT, a Python tunneling utility that forwards arbitrary TCP traffic directly into private internal subnets. Concurrently, attackers trigger CVE-2026-88779 against NetScaler instances configured as SAML service providers, crashing authentication handlers to induce denial of service conditions that facilitate exploitation of adjacent flaws.

[+] Oracle PeopleSoft Mass Intrusion Campaign: Financially motivated group UNC6240, operating under the ShinyHunters collective, has escalated exploitation against Oracle PeopleSoft Enterprise PeopleTools under CVE-2026-35273. While defenders implemented web application firewall rules to block the administrative path /PSEMHUB/, attackers completely bypassed inspect filters by URL encoding the leading character as /%50SEMHUB/hub. Because reverse proxy firewalls frequently evaluate literal string paths without preliminary normalization, the request traverses the filter unaltered, where the back end WebLogic server normalizes the character to P and serves the vulnerable Environment Management servlet. Intruders transmit serialized Java payloads to achieve unauthenticated code execution, followed by the deployment of JSP web shells designated x.jsp and u.jsp. To maintain persistent administrative access, the group stages Neo-reGeorg HTTP tunneling servlets and installs MeshAgent remote management services communicating with winmanage-me[.]network. Attackers deploy SIDEEYE, an advanced backdoor distributed through a trojanized installer named Ple64.exe signed with an enterprise code signing certificate, which maintains raw TCP command channels over ports 3333 and 3334 to orchestrate corporate data extortion.

[+] Cisco Catalyst SD-WAN Manager Authentication Bypass: Attackers are actively targeting CVE-2026-76504 within Cisco Catalyst SD-WAN Manager. The flaw stems from an encoding normalization inconsistency in the handling of the j_security_check authentication endpoint. Intruders issue HTTP POST requests directed toward /%6a_security_check, substituting the literal letter j with its hex encoded representation %6a. The routing layer fails to match the encoded string against restricted authentication rules, yet passes the request to the underlying servlet, granting the attacker unauthenticated administrative API control without credentials.

[+] Fortinet FortiMail Arbitrary File Write: Exploitation of CVE-2026-104286 across Fortinet FortiMail email security gateways combines path traversal with null byte injection. Unauthenticated threat actors craft specialized HTTP requests incorporating directory traversal sequences alongside %00 null byte terminators, allowing them to circumvent file system write restrictions. This capability facilitates the creation of persistent web shells directly inside web accessible directories, exposing protected email infrastructures to complete host takeover.

[+] Zammad Helpdesk Chained Intrusion: Attackers executed an advanced zero day intrusion against the security foundation DIVD by chaining two flaws in Zammad Helpdesk. Threat actors exploit session fixation flaw CVE-2026-102489 to pre assign a session identifier prior to victim authentication. Once an authenticated user accesses the platform, the attacker hijacks the session, elevates role privileges within the administrative interface, and executes CVE-2026-102490 to escalate local permissions from the zammad system user directly to root, establishing complete server compromise.

[+] Rejetto HTTP File Server Session Forgery: Security researchers have identified active reconnaissance probes originating from telecommunications infrastructure targeting CVE-2026-61500 in Rejetto HTTP File Server. The platform calculates session cookie signatures using a non cryptographic pseudo random number generator, Math.random, which leaks internal states during standard login exchanges. Attackers collect successive session tokens to reconstruct the generator state, forge administrative session cookies, and achieve remote code execution by submitting malicious JavaScript strings into the server_code configuration interface.

[+] Atlassian Data Center Path Traversal: Following the publication of technical proof of concept materials, attackers initiated exploitation attempts against CVE-2026-21589 across Atlassian Data Center products including Jira, Confluence, and Bitbucket. The vulnerability utilizes path traversal sequences constructed with double colon delimiters, allowing adversaries to bypass standard path sanitization filters and read internal files within the web root. In environments integrated with Atlassian Crowd, adversaries attempt to read WEB-INF/web.xml to extract database secrets and administrative credentials.

[+] Artificial Intelligence Infrastructure Weaponization: The Canto Incognito botnet campaign is propagating PoeLLM across more than 3400 exposed artificial intelligence hosts running Ollama, LiteLLM, Gotenberg, and Gitea. Exploiting unauthenticated model APIs and container interfaces, attackers deploy XMRig and Iron cryptocurrency miners configured to route earnings to the Kryptex mining pool. The malware retrieves dynamic operational instructions from a Base64 encoded payload hosted inside a GitHub repository text file, converting enterprise compute infrastructure into persistent scanning and mining nodes.

[+] Adversary Identity Harvesting via Hospitality Networks: Russian state aligned group Storm-2945 has resumed operations with its CaptiveCrunch attack framework. The group manipulates local DNS and HTTP routing within hospitality and hotel wireless networks, redirecting travelers attempting network authentication to fraudulent captive portals. Victims are presented with Microsoft 365 device code login lures, allowing the adversary to intercept OAuth tokens and deploy the Rust based CornFlake remote access trojan to maintain deep corporate network access.