# Weekly Situation Report — 10/5/26 2026-10-08 · Threat Brief Canonical: https://www.osec.com/resources/threat-briefs/weekly-situation-report-10-5-26 --- - Two Citrix NetScaler zero-day vulnerabilities are being actively exploited in attacks against vulnerable appliances. - ShinyHunters is using a web application firewall bypass technique to target Oracle PeopleSoft environments in intrusion campaigns. - Attackers are abusing ChatGPT custom pages to deliver ClickFix campaigns and trick users into executing malicious commands. - The Cisco SD-WAN zero-day CVE-2026-76504 is being actively exploited in attacks against affected devices. ## 1. Two Citrix NetScaler zero-days exploited in the wild **Summary** Citrix released patches for two exploited zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and Gateway. Multiple cybersecurity organizations recommend taking vulnerable systems offline until the patches can be applied. **Category:** Known Exploited Vulnerabilities **Industry:** Multiple **Analyst comments** Citrix released patches for two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) affecting NetScaler ADC and Gateway. The first allows unauthenticated remote code execution, while the second leads to a memory overflow exploitable for RCE or DoS attacks on appliances with DTLS enabled. The vulnerabilities have been exploited in the wild. Following a private pre-notification from NCSC-NL, IT suppliers and CERT teams advised organizations to take affected systems offline until patches can be applied. CISA added these CVEs to its Known Exploited Vulnerability (KEV) catalog and issued an alert about their active global exploitation, urging organizations to check for IoCs before patching. Between September 25th and 26th, reports on social media advised users to take their Citrix NetScaler devices offline. Citrix confirmed the vulnerabilities on September 27th and released patches, while exploitation remains ongoing. External researchers have published exploitation details and forensic artifact indicators. According to credible social media reports, webshells unique to each intrusion are being loaded onto vulnerable devices. Malicious cron jobs are being established for both persistence and anti-forensics, including deletion of malicious artifacts and log entries. Public research and PoCs are now available, with several social media reports indicating that widespread exploitation is ongoing. This is verified via public honeypot traffic peaking on September 29th, with ongoing reduced traffic through October 2nd. **Actionable guidance** Apply the vendor-released patches to remediate this issue. If compromise is suspected, organizations should do the following: - Look for rogue scheduled cron jobs, especially those that delete log entries or files in suspicious locations. - Investigate SIEM logs for Base64-encoded traffic in user-agent fields, or log lines containing `pitboss` followed by `IFS`. ``` # strings to look for in SIEM pitboss*IFS pitboss*base64decode # Additional potential log lines based on PoC disclosure xxxxxx 0-PPE-0 : default SSLVPN Message 675 0 : "AAAD API: sending login req to aaad for /var/tmp/evilpayload`;# X>, factor , auth type 4129, trans id 1350" xxxxxx nsaaad[15791]: (0-57) process_kernel_socket: call to authenticate user :pitboss PPE unexpectedly died NSPPE;:`id>/var/tmp/evilpayload`;# X, vsid :11813, userlen 70 xxxxx 0-PPE-0 : default AAATM Message 678 0 : "AAAD RESP: received resp, user: /var/tmp/evilpayload`;# X>, factor: , trans id 1350, pcb trans id 1350, q_flags 1879080964 aaad-resp 15 aaad-flags 0" ``` The following versions of Citrix NetScaler are fixed: - Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases - Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1 - Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS - Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.279 and later releases of 13.1-FIPS and 13.1-NDcPP If a compromise is confirmed, organizations should invalidate all sessions and consider reimaging the device if suspicious activity persists after patching. ## 2. ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks **Summary** The ShinyHunters extortion group is exploiting a URL-encoding technique to circumvent web application firewall rules and re-exploit the Oracle PeopleSoft CVE-2026-35273 flaw. This allows them to deploy web shells and additional malware on vulnerable servers across various sectors. **Category:** Threat Actor Activities **Industry:** Multiple **Analyst comments** ShinyHunters is exploiting a URL-encoding technique to circumvent web application firewall (WAF) rules designed to protect Oracle PeopleSoft servers from CVE-2026-35273, which allows unauthenticated remote code execution. This method involves encoding parts of URLs, such as changing `/PSEMHUB/` to `/%50SEMHUB/`, enabling attackers to bypass WAFs that do not decode URLs before checking against rules. Researchers warn this technique has enabled the group to deploy web shells and other malicious software on compromised systems across multiple sectors, including higher education and government organizations. ShinyHunters uses these exploits for data theft and lateral movement, deploying SIDEEYE malware on Windows servers for credential theft and backdoor access and employing MeshAgent on Linux systems for persistence. The use of MeshCentral is consistent with older reporting on this vulnerability's exploitation, with files typically dropped in `C:\Windows\Temp`. This is not a patch bypass; it primarily affects organizations that have applied WAF mitigations as a stopgap instead of patching. No public PoC currently exists; GitHub entries claiming to contain one have been verified as fake. ShinyHunters is currently dealing with fallout from law enforcement activity, with at least one arrest reported in Amsterdam as part of an ongoing investigation. Additionally, a prominent member was also arrested in Jordan on September 29th. ShinyHunters' darkweb breach site is currently offline over the weekend. However, the file servers seem to remain online, which may indicate continued operations while maintaining a low profile for remaining members of the group. The brand is likely to be re-used by other threat actors, as is the case with a separate group operating over Telegram, typically referred to as ShinyMontana by some threat intelligence firms. **Actionable guidance** Apply the Oracle patch that addresses CVE-2026-35273. If compromise is suspected: - Look for suspicious traffic to `/PSEMHUB/` or requests to the same endpoint with URL-encoded characters (e.g., `/%50SEMHUB/`). - Look for `cmd`/`sh` commands in URL strings and rogue files named `x.jsp`, `j.jsp`, or similar. - Invalidate and rotate all credentials and sessions. - Remove the PSEMHUB application entirely or disable the EMHub service in multi-service deployments per the original Oracle advisory. - Look for unexpected MeshCentral agents or software not included in approved software or asset inventory lists. ## 3. ChatGPT Custom Pages used for ClickFix campaign **Summary** Threat actors used fake ChatGPT Custom GPTs and ClickFix to deceive users into executing a multi-stage attack. The activity ultimately deployed a remote access trojan and used legitimate signed applications for evasion. **Category:** Threat Actor Activities **Industry:** Technology **Analyst comments** Threat actors used fake ChatGPT Custom GPTs and ClickFix to launch a multi-stage RAT attack. The scheme involves tricking users into visiting what appears to be an official ChatGPT site. Victims are then directed to a Google Sites page hosting a fake Cloudflare CAPTCHA, which triggers execution of PowerShell commands that download and install malicious MSIs. The campaign uses decimal IP addresses for obfuscation and DLL sideloading through legitimate Canon-signed executables, which load modified logging libraries containing hidden malware. The final RAT provides extensive control over infected systems and can bypass local DNS logs using DNS-over-HTTPS. This campaign exploits ChatGPT Custom GPTs functionality. Similar abuse has been observed using Claude Artifacts, as threat actors increasingly use LLM and AI platforms to support phishing and social engineering campaigns. The use of decimal notation in place of IP addresses is a notable aspect of the infection chain; PowerShell interprets decimal strings as IP addresses automatically. This can be demonstrated by running `ping 2130706433 -n 3` in a PowerShell terminal, which resolves to 127.0.0.1. Persistence artifacts are written to Windows Run keys in the registry and a scheduled task. Several other groups are currently exploiting AI/LLM platforms for ClickFix attacks, using Claude, ChatGPT, and DeepSeek lures. Additional groups identified through recent analysis include Storm-1575 and Silverfox (medium confidence), with the latter linked with ValleyRAT malware and DeepSeek lures, alongside the ChatGPT-related intrusions noted above. **Actionable guidance** Organizations should treat external links directing users to ChatGPT Spaces, Custom GPT pages, Claude Artifacts, or similar AI/LLM hosting platforms with caution, particularly those that subsequently redirect to sites.google[.]com pages. Because ClickFix attacks use the Windows Run dialog (Win + R), restricting this via Group Policy for most non-technical users is a low-disruption defensive measure. Restricting PowerShell execution will also disrupt the initial access vector. If compromise is suspected, look for Windows Run keys (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run|RunOnce`), scheduled tasks named `Canon Configuration Reader`, and unrecognized files at the following paths: ``` %LOCALAPPDATA%\Programs\Stardock Smart DeElevation Tool\ %LOCALAPPDATA%\Programs\Advanced Printer Configuration Reader\ ``` ## 4. Cisco SD-WAN zero-day CVE-2026-76504 exploited in attacks **Summary** Cisco addressed a critical zero-day vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager that allows attackers to gain administrative access due to improper URI encoding handling. Cisco recommends that all affected deployments be upgraded immediately. **Category:** Zero-day **Industry:** Multiple **Analyst comments** Cisco addressed a critical zero-day vulnerability (CVE-2026-76504) in the Catalyst SD-WAN Manager, affecting its API session-based authentication management and allowing unauthenticated access with admin privileges due to improper URI encoding handling. This vulnerability affects all system configurations and is actively exploited. Cisco recommends upgrading to fixed releases for remediation. To detect potential compromises, security teams should monitor specific log files for suspicious entries involving the `j_security_check` method from unknown IPs. CVE-2026-76504 marks the fifth SD-WAN zero-day vulnerability exploited in 2026, following several other critical flaws patched earlier this year. We are not currently aware of a public PoC. Several GitHub repositories claim to contain exploit code, but no supporting code or research has been disclosed publicly. Per the vendor advisory, an IoC is the use of hardcoded service accounts prefixed with `viptela-reserved-*`. Multiple service accounts exist in SD-WAN devices and may be used in conjunction with this vulnerability: ``` viptela-reserved-dca DCA Service Account viptela-reserved-tac TAC Service Account viptela-reserved-cloud Cloud OnRamp/cloud service acct viptela-reserved-cloudops Cloud Operations service account ``` The vendor advisory did not name specific threat actors, but it did provide log examples that may help identify forensic artifacts associated with exploitation. ``` # serviceproxy-access.log [2026-09-29T23:11:13.948-05:00] "POST /%6a_security_check HTTP/1.1" 200 - 48 0 4 - "10.10.10.47,192.168.1.174" "Mozilla/5.0" "92980fc6-bb3c-4b67-8a6d-af5ceb236d4c" "vmanage-9999.example.com" "127.0.0.1:8080" # vmanage-server.log 29-Sep-2026 23:11:13,952 CDT [] [vManage-new] [UserUtils] (default task-127462) |default| Request Stored in Map is (/%6a_security_check) for user (viptela-reserved-..) ``` Public honeypot logs indicate this vulnerability is already under exploitation, increasing risk for unpatched deployments. **Actionable guidance** Apply the vendor-released patches to remediate this vulnerability. If compromise is suspected, look for requests to API endpoints such as `j_security_check` with URL-encoded characters (e.g., `%6a_security_check`) in Cisco SD-WAN log files. Unattributed authentication attempts using usernames prefixed with `viptela-reserved-*` are a high-fidelity indicator of exploitation. The following versions of Cisco SD-WAN are vulnerable: ``` Cisco Catalyst SD-WAN Software Release First Fixed Release Earlier than 20.9 Migrate to a fixed release. 20.9 20.9.10.1 20.12 20.12.8.2 20.15 20.15.6.1 20.18 20.18.4.1 26.1 26.1.2.1 26.2 26.2.1 ```