Skip to content
Saturday, September 26, 2026 · Weekend edition · Vol. 1, No. 9Back issue

Vol. 1, No. 9Composed Sep 27 · 02:01 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

1 critical · 2 elevated4 stories on the wire

You are reading a back issue. Go to the latest edition →

The week

Municipal Servers Offline as Attack Disrupts Services

Several city servers offline amid PeopleSoft CVE exploitation and Azure-principal destructive activity.

Composed by SitRep’s AI editors from 5 sources — Breaches.net, Microsoft Secure, Mandiant Threat Intelligence, BleepingComputer, SANS Internet Storm Center

Breaches[.]net reports several city computer servers went offline, disrupting municipal phone and email services and preventing employees from accessing essential systems. Concurrent intelligence shows active campaigns and destructive cloud automation this week—Microsoft observed Storm-3168 performing 300+ read ops and 100+ storage deletions in rapid sequences.

Context

This matters now because attackers are combining rapid, automated cloud-destructive flows (compromised Azure service principals) with mass exploitation of internet-facing software (Oracle PeopleSoft), raising the probability of simultaneous service outages and data loss. Municipalities, enterprise PeopleSoft instances, and organizations using Azure service principals are exposed; blast radius includes storage, Key Vault, App Service, SQL databases, and any systems relying on PeopleSoft EMHub endpoints.

“Defenders must treat web-facing patching, identity containment, and rapid detection as a single priority chain.”
From the analysis
The move

5 things to do today

  1. Revoke and rotate any Azure service principals showing anomalous activity immediately; apply least-privilege and restrict automation runbooks (Storm-3168).
  2. Patch or mitigate Oracle PeopleSoft CVE-2026-35273 now; disable EMHub if a patch cannot be deployed and hunt for /PSEMHUB/, x[.]jsp, and u[.]jsp in web logs and file stores.
  3. Search endpoints and EDR telemetry for evidence of LaunchAgent plist modifications and the Macfinger shell-script loader contacting 45[.]131[.]; remove persistence and rotate harvested credentials.
  4. Identify and revoke suspicious GitHub Actions and repository secrets; pin CI workflows to known-good commits, rotate any exposed secrets, and purge compromised action tokens.
  5. Prioritize deployment of Project Zero mitigations for CVE-2026-66804 and review recent COM registration and DLL deployment protections on Windows hosts.

On the wire

  • 1critical
  • 2elevated
  • 1moderate
  • 0low
P1Incident

Investigate and Contain Stevens Point Outage Immediately

Treat the Stevens Point outage as a high-priority incident: preserve system logs, isolate affected servers, and collect forensic snapshots. Coordinate with telephony/email providers and escalate to incident response if evidence of lateral movement or data exfiltration appears.

BREACHES.NET · Stevens Point Officials Scramble as Servers Go Offline, Suspected Cyberattack

Copy link to “Investigate and Contain Stevens Point Outage Immediately”

P1Exploit

PeopleSoft CVE-2026-35273 Mass Exploitation by ShinyHunters

Mandiant reports active mass exploitation of CVE-2026-35273 targeting Oracle PeopleSoft with WAF bypass via URL-encoded /PSEMHUB/ and web shells x[.]jsp and u[.]jsp; attackers perform fileless and web-shell post-exploitation. Deploy vendor patches or disable EMHub where immediate patching is not possible, search logs for /PSEMHUB/, look for x[.]jsp/u[.]jsp in webroots, and rotate service and administrator credentials.

Previously in SitRep Sep 25: ShinyHunters Mass Exploitation of Oracle PeopleSoft CVE-2026-35273

MANDIANT THREAT INTELLIGENCE · ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

Copy link to “PeopleSoft CVE-2026-35273 Mass Exploitation by ShinyHunters”

P0Cloud

STORM-3168 Uses Compromised Service Principals for Rapid Destruction

Microsoft observed Storm-3168 using compromised Azure service principals to enumerate and then destroy resources in automated seven-minute sequences (300+ read ops; 100+ storage deletions). Immediately identify and revoke suspicious service principals, enforce least-privilege on workload identities, enable activity alerts for mass deletions, and protect Key Vault with RBAC and purge protection.

MICROSOFT SECURE · Storm-3168: Agentic Cloud Attacks From Compromised Principals

Copy link to “STORM-3168 Uses Compromised Service Principals for Rapid Destruction”

P2Intelligence

Macfinger ClickFix Information Stealer Targeting macOS

SANS analysis shows Macfinger uses arch-specific Mach-O binaries and a shell-script loader contacting 45[.]131[.], with LaunchAgent plist persistence and multiple SHA-256 variants. Hunt for anomalous LaunchAgent plists, the shell-script loader artifact, and the listed SHA-256s on macOS 27.0 hosts; remove persistence and rotate any harvested credentials.

SANS INTERNET STORM CENTER · A Close Look at Macfinger ClickFix Malware Campaign

Copy link to “Macfinger ClickFix Information Stealer Targeting macOS”

Indicators named in this edition

Vulnerabilities named CVE-2026-35273 · CVE-2026-66804

KindValueNote
FILE PATH/PSEMHUB/URL-encoded /PSEMHUB/ used to bypass WAFs in PeopleSoft attacks; search webserver logs.
FILE PATHx[.]jspObserved web shell filename used by ShinyHunters; hunt in webroots and uploads.
FILE PATHu[.]jspObserved web shell filename used by ShinyHunters; hunt in webroots and uploads.
DOMAIN45[.]131[.]Partial shell-script loader callback observed in Macfinger analysis; hunt for full connections to this host.

Known exploited

Added 19 Sept – 25 Sept10 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-65660Microsoft SharePoint25 Sept28 Sept
CVE-2026-67279MikroTik RouterOS25 Sept28 Sept
CVE-2026-87902WordPress Core25 Sept28 Sept
CVE-2026-5430WSO2 Multiple Products24 Sept27 Sept
CVE-2026-71362Adobe Commerce and Magento24 Sept27 Sept
CVE-2026-85102Check Point Multiple Products22 Sept25 Sept
CVE-2026-93616Check Point Multiple Products22 Sept25 Sept
CVE-2026-93952Arista VeloCloud Orchestrator22 Sept25 Sept
CVE-2026-94127F5 BIG-IP APM22 Sept25 Sept
CVE-2026-7273Zyxel GS1900 Series Switches21 Sept24 Sept

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

End of the Saturday, September 26, 2026 weekend edition.

Colophon

SitRep · Vol. 1, No. 9

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.