The week

Municipal Outage from Exploitation and Cloud Attacks

Several city servers offline amid PeopleSoft CVE exploitation and Azure-principal destructive activity.

Composed by SitRep’s AI editors from 5 sources — Breaches.net, Microsoft Secure, Mandiant Threat Intelligence, BleepingComputer, SANS Internet Storm Center

Municipal Servers Offline as Attack Disrupts Services

Breaches[.]net reports several city computer servers went offline, disrupting municipal phone and email services and preventing employees from accessing essential systems. Concurrent intelligence shows active campaigns and destructive cloud automation this week—Microsoft observed Storm-3168 performing 300+ read ops and 100+ storage deletions in rapid sequences.

Context

This matters now because attackers are combining rapid, automated cloud-destructive flows (compromised Azure service principals) with mass exploitation of internet-facing software (Oracle PeopleSoft), raising the probability of simultaneous service outages and data loss. Municipalities, enterprise PeopleSoft instances, and organizations using Azure service principals are exposed; blast radius includes storage, Key Vault, App Service, SQL databases, and any systems relying on PeopleSoft EMHub endpoints.

“Defenders must treat web-facing patching, identity containment, and rapid detection as a single priority chain.”

The move

5 things to do today

Revoke and rotate any Azure service principals showing anomalous activity immediately; apply least-privilege and restrict automation runbooks (Storm-3168).
Patch or mitigate Oracle PeopleSoft CVE-2026-35273 now; disable EMHub if a patch cannot be deployed and hunt for /PSEMHUB/, x[.]jsp, and u[.]jsp in web logs and file stores.
Search endpoints and EDR telemetry for evidence of LaunchAgent plist modifications and the Macfinger shell-script loader contacting 45[.]131[.]; remove persistence and rotate harvested credentials.
Identify and revoke suspicious GitHub Actions and repository secrets; pin CI workflows to known-good commits, rotate any exposed secrets, and purge compromised action tokens.
Prioritize deployment of Project Zero mitigations for CVE-2026-66804 and review recent COM registration and DLL deployment protections on Windows hosts.

On the wire

P1Incident

Investigate and Contain Stevens Point Outage Immediately

Treat the Stevens Point outage as a high-priority incident: preserve system logs, isolate affected servers, and collect forensic snapshots. Coordinate with telephony/email providers and escalate to incident response if evidence of lateral movement or data exfiltration appears.

BREACHES.NET · Stevens Point Officials Scramble as Servers Go Offline, Suspected Cyberattack

P1Exploit

PeopleSoft CVE-2026-35273 Mass Exploitation by ShinyHunters

Mandiant reports active mass exploitation of CVE-2026-35273 targeting Oracle PeopleSoft with WAF bypass via URL-encoded /PSEMHUB/ and web shells x[.]jsp and u[.]jsp; attackers perform fileless and web-shell post-exploitation. Deploy vendor patches or disable EMHub where immediate patching is not possible, search logs for /PSEMHUB/, look for x[.]jsp/u[.]jsp in webroots, and rotate service and administrator credentials.

MANDIANT THREAT INTELLIGENCE · ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

P0Cloud

STORM-3168 Uses Compromised Service Principals for Rapid Destruction

Microsoft observed Storm-3168 using compromised Azure service principals to enumerate and then destroy resources in automated seven-minute sequences (300+ read ops; 100+ storage deletions). Immediately identify and revoke suspicious service principals, enforce least-privilege on workload identities, enable activity alerts for mass deletions, and protect Key Vault with RBAC and purge protection.

MICROSOFT SECURE · Storm-3168: Agentic Cloud Attacks From Compromised Principals

P2Intelligence

Macfinger ClickFix Information Stealer Targeting macOS

SANS analysis shows Macfinger uses arch-specific Mach-O binaries and a shell-script loader contacting 45[.]131[.], with LaunchAgent plist persistence and multiple SHA-256 variants. Hunt for anomalous LaunchAgent plists, the shell-script loader artifact, and the listed SHA-256s on macOS 27.0 hosts; remove persistence and rotate any harvested credentials.

SANS INTERNET STORM CENTER · A Close Look at Macfinger ClickFix Malware Campaign

Indicators named in this edition

Kind	Value	Note
CVE	CVE-2026-35273	Oracle PeopleSoft exploit actively mass-exploited by ShinyHunters; search for related web-shell indicators.
CVE	CVE-2026-66804	Project Zero privilege-escalation linked to incomplete Windows fixes; indicates urgent patch/mitigation need.
PATH	/PSEMHUB/	URL-encoded /PSEMHUB/ used to bypass WAFs in PeopleSoft attacks; search webserver logs.
FILENAME	x[.]jsp	Observed web shell filename used by ShinyHunters; hunt in webroots and uploads.
FILENAME	u[.]jsp	Observed web shell filename used by ShinyHunters; hunt in webroots and uploads.
HOST	45[.]131[.]	Partial shell-script loader callback observed in Macfinger analysis; hunt for full connections to this host.
ARTIFACT	LaunchAgent plist	Persistence mechanism used by Macfinger; search macOS LaunchAgents for unknown entries.

End of the Saturday, September 26, 2026 weekend edition.