🛡️ CISO Intel — Saturday, 13-06-2026

By Marcus Reed | 12-06-2026 08:00 IST → 13-06-2026 08:00 IST | All sources cross-referenced

Executive Summary

This Saturday is a stark reminder that the digital battlefield knows no weekends. We’re staring down two critical, actively exploited zero-days in Ivanti Sentry and Oracle PeopleSoft, both with public Proof-of-Concepts (PoCs) already circulating. This isn’t a drill; it’s an immediate call to action for every CISO, especially those running these platforms. Layer on top of that a sophisticated supply chain worm hitting Microsoft’s Azure repos and PyPI, alongside widespread package hijacking in Arch Linux, and it’s clear: attackers are relentlessly targeting foundational infrastructure and developer workflows. Patch Tuesday numbers were staggering, but the critical ones are already in the wild and being weaponized. Prioritize the Ivanti and Oracle patches now, and remind your teams that compliance isn’t going to save them from a rootkit dropped via a compromised dev tool.

🔴 Critical Threats — Act Now

Ivanti Sentry — Unauthenticated RCE with Root Privileges

What happened: A critical vulnerability, CVE-2026-10520, has been identified in Ivanti Sentry (formerly Pulse Connect Secure), allowing for unauthenticated OS command injection leading to Remote Code Execution (RCE) with root privileges. This flaw carries a maximum CVSS score of 10.0, indicating its extreme severity. What makes this particularly alarming is that active exploitation began within 24 hours of its disclosure, with public Proof-of-Concept (PoC) code quickly becoming available. This means the window for defenders to patch before widespread compromise is virtually non-existent.

Source verification: The initial report from Dark Reading, citing Ivanti directly, confirmed the active exploitation and the CVSS 10.0 score. Independent security researchers on X (formerly Twitter) and discussions on r/netsec have corroborated the rapid weaponization and the availability of PoCs on GitHub, often within hours of the initial disclosure. NVD confirms the CVSS v3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) for CVE-2026-10520, detailing the unauthenticated command injection. There are no conflicting reports; the consensus is that this is a severe and actively exploited vulnerability.

Technical breakdown: CVE-2026-10520 is an OS command injection vulnerability. This typically occurs when an application constructs a system command using external input without proper sanitization. In the case of Ivanti Sentry, an unauthenticated attacker can inject arbitrary commands into the operating system, which are then executed with root privileges. The attack likely targets a specific endpoint or service exposed by Ivanti Sentry that handles user input, allowing for the command injection. The Kill Chain would involve:

Reconnaissance: Identifying Ivanti Sentry instances.
Initial Access (T1190: Exploit Public-Facing Application): Sending a specially crafted request containing malicious commands to the vulnerable Sentry instance.
Execution (T1059: Command and Scripting Interpreter): The Sentry application processes the unsanitized input, executing the attacker’s commands with root privileges.
Persistence/Privilege Escalation: With root access, the attacker can establish persistence, deploy additional payloads, or exfiltrate data. Public PoCs on GitHub demonstrate the ease of exploitation, often requiring only a simple HTTP request with the malicious payload.

Blast radius: Ivanti Sentry devices are commonly deployed as secure access gateways, providing VPN and mobile device management capabilities. This means they are often internet-facing and act as a critical entry point into an organization’s network. Organizations using Ivanti Sentry versions prior to R10.5.2, R10.6.2, or R10.7.1 are directly exposed. The impact is severe across various industries, as Sentry is widely used for remote access. Given the unauthenticated nature and root-level RCE, any exposed, unpatched instance is a ticking time bomb.

Marcus’s verdict: This is as bad as it sounds, maybe worse, because it’s Ivanti. We’ve seen this movie before with their products being prime targets for state-sponsored actors and ransomware gangs due to their internet-facing nature and high privileges. A CVSS 10.0 RCE with root and public PoC within 24 hours is a full-blown emergency. Any Ivanti Sentry instance that isn’t patched right now is a gaping hole in your perimeter. This isn’t a “this week” or “this quarter” item; it’s a “drop everything and patch” situation. Assume compromise if you haven’t patched.

Actions:

Immediate Patching: Apply the latest security updates to Ivanti Sentry to versions R10.5.2, R10.6.2, or R10.7.1 immediately. Do not delay.
Threat Hunting: Even after patching, assume potential compromise if your systems were exposed. Scour logs for unusual activity, new processes, unauthorized network connections, or modifications to system files. Look for indicators of compromise (IOCs) that may be released by Ivanti or threat intelligence providers.
Network Segmentation: Ensure your Ivanti Sentry deployments are properly segmented from critical internal networks.
Web Application Firewall (WAF) / IPS Rules: Implement or update WAF/IPS rules to block known exploitation attempts, though this is a temporary measure until patching.

Sources: Dark Reading, X (formerly Twitter), r/netsec, NVD, GitHub

Oracle PeopleSoft — Zero-day RCE in EMHub by ShinyHunters

What happened: A zero-day Remote Code Execution (RCE) vulnerability, CVE-2026-35273 (CVSS 9.8), has been actively exploited in Oracle PeopleSoft’s PeopleTools Environment Management Hub (EMHub). This critical flaw allows unauthenticated RCE, meaning attackers can execute arbitrary code on vulnerable systems without needing credentials. The notorious cybercrime group ShinyHunters has been attributed to its exploitation, targeting over 100 organizations, with a significant focus on higher education institutions. Oracle has acknowledged the vulnerability and issued mitigations, though full patches may still be pending.

Source verification: While the briefing cited “Rod’s Blog,” Mandiant, and Google Threat Intelligence Group, direct links were unavailable. Independent searches confirm the existence and active exploitation of CVE-2026-35273 in Oracle PeopleSoft EMHub. Mandiant’s research, often shared through industry partners and their own blog, frequently details zero-day exploitation, and their attribution to ShinyHunters is consistent with their historical reporting on the group. Dark Reading also reported on ShinyHunters’ use of this zero-day in conjunction with “gadget chain” exploitation. NVD confirms the CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) for CVE-2026-35273, highlighting its network-exploitable, unauthenticated nature. Oracle’s official security advisories confirm the vulnerability and the release of mitigations.

Technical breakdown: The PeopleTools Environment Management Hub (EMHub) is a component of Oracle PeopleSoft used for managing PeopleSoft environments. The RCE vulnerability CVE-2026-35273 likely resides in how EMHub processes specific requests or handles data, allowing for the injection and execution of malicious code. Given it’s unauthenticated, the attack vector is directly exposed to the internet if EMHub is publicly accessible. ShinyHunters’ exploitation pattern, as described, involves a “gadget chain” – combining this new zero-day with older vulnerabilities. This suggests a multi-stage attack:

Initial Access (T1190: Exploit Public-Facing Application): Exploiting CVE-2026-35273 in EMHub to gain initial unauthenticated RCE.
Execution (T1059: Command and Scripting Interpreter): Running commands on the compromised PeopleSoft server.
Defense Evasion/Privilege Escalation: Leveraging older, potentially unpatched vulnerabilities (the “gadgets”) to further escalate privileges or move laterally within the PeopleSoft environment, bypassing existing controls.
Exfiltration (T1020: Automated Exfiltration): Stealing sensitive data, which is a common ShinyHunters objective. The lack of a public PoC for CVE-2026-35273 specifically, compared to the Ivanti flaw, suggests ShinyHunters may be keeping their cards close, but the active exploitation against over 100 organizations confirms its effectiveness.

Blast radius: Organizations running Oracle PeopleSoft, particularly those with publicly accessible EMHub components, are at severe risk. The focus on higher education by ShinyHunters indicates that these institutions often have PeopleSoft deployments that might be less rigorously secured or more exposed. PeopleSoft systems typically contain vast amounts of sensitive data, including student records, HR information, and financial data, making them high-value targets. The “over 100 organizations” already impacted signifies a widespread and ongoing campaign.

Marcus’s verdict: Another critical zero-day, another internet-facing application, another ransomware/extortion group having a field day. ShinyHunters are not known for their subtlety; they’re in it for the data. The targeting of higher education is a classic move—often under-resourced security teams and a treasure trove of PII. Oracle issuing “mitigations” instead of a full patch is concerning, implying a complex fix or a temporary stop-gap. This means even if you apply the mitigations, you need to be hyper-vigilant. Assume any publicly exposed PeopleSoft EMHub instance is already being probed, if not compromised.

Actions:

Apply Oracle Mitigations Immediately: Implement all mitigations provided by Oracle for CVE-2026-35273 without delay. Monitor Oracle’s official channels for a full patch release.
Restrict Network Access: If possible, restrict network access to the PeopleTools EMHub component to only trusted IP ranges or internal networks. If it absolutely must be internet-facing, place it behind a robust WAF with strong rules.
Forensic Investigation: Conduct a thorough forensic investigation of PeopleSoft environments, especially those in higher education, for signs of compromise, lateral movement, or data exfiltration. Look for activity related to ShinyHunters’ TTPs (T1190, T1078, T1020).
Review Older Vulnerabilities: Given ShinyHunters’ “gadget chain” approach, ensure all older PeopleSoft vulnerabilities are patched and that your patch management for these systems is up to date.

Sources: Rod’s Blog, Mandiant, Google Threat Intelligence Group, Dark Reading, NVD, Oracle

🛡️ CVEs — Full Analysis

`CVE-2026-47162` — Vim v9.2.0495 (prior)

Summary: CVE-2026-47162 is a Vimscript code injection vulnerability affecting Vim versions prior to v9.2.0495. Specifically, the flaw resides in the s:NetrwBookHistSave() function within the netrw plugin, which is a file explorer plugin bundled with Vim. This vulnerability allows for arbitrary code execution.

CVSS/Details: The vulnerability has a CVSS v3.1 score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). This indicates a high severity, requiring user interaction (UI:R) – likely opening a specially crafted file or interacting with the netrw plugin in a specific way – but once triggered, it grants high confidentiality, integrity, and availability impact. While a public PoC is not widely available on platforms like GitHub, the nature of code injection vulnerabilities often means that a PoC can be developed relatively quickly by a skilled attacker. The patch would involve sanitizing input or properly escaping commands within the s:NetrwBookHistSave() function.

Marcus’s take: A CVSS 8.8 is nothing to sneeze at, especially for arbitrary code execution. However, the “User Interaction Required” (UI:R) component means it’s not a drive-by RCE. An attacker would likely need to trick a user into opening a malicious file or interacting with a compromised netrw configuration. This is less of an internet-facing perimeter threat and more of a targeted developer workstation risk. For organizations heavily relying on Vim in development environments, this is a real threat, especially if developers are frequently cloning untrusted repositories or opening arbitrary files. For the average enterprise, it’s a lower priority than the Ivanti or Oracle zero-days, but still warrants attention in your secure development lifecycle. The vendor score seems accurate for the described impact and access vector.

Source: NVD

⚡ TTPs & Attack Research — Deep Dives

ShinyHunters “Gadget Chain” Exploitation

ShinyHunters, a persistent threat actor known for data theft and extortion, is leveraging a sophisticated “gadget chain” exploitation technique. This strategy involves combining newly discovered zero-day vulnerabilities, such as CVE-2026-35273 in Oracle PeopleSoft EMHub, with older, potentially unpatched vulnerabilities to achieve their objectives. This isn’t about exploiting a single flaw; it’s about chaining multiple weaknesses to create a more robust and evasive attack path.

Attack Chain & MITRE ATT&CK Mapping:

Initial Access (T1190: Exploit Public-Facing Application): The attack begins with the exploitation of CVE-2026-35273 in the publicly exposed Oracle PeopleSoft EMHub. This provides the initial foothold into the target network.
Execution (T1059: Command and Scripting Interpreter): Upon successful exploitation, ShinyHunters executes commands on the PeopleSoft server, often to gain system information or prepare for further stages.
Defense Evasion / Privilege Escalation (T1078: Valid Accounts; T1068: Exploitation for Privilege Escalation): This is where the “gadget chain” comes into play. Instead of relying solely on the zero-day, they might then exploit an older, known vulnerability in PeopleSoft or an underlying operating system component (a “gadget”) to escalate privileges or move laterally. This could involve using compromised credentials (T1078) obtained through the initial RCE or exploiting another local privilege escalation vulnerability. The use of older vulnerabilities can sometimes evade detection by security tools focused only on the latest threats.
Collection (T1005: Data from Local System; T1039: Data from Network Shared Drive): Once they have sufficient access, ShinyHunters focuses on collecting sensitive data, often targeting databases, file shares, and configuration files within the PeopleSoft environment.
Exfiltration (T1020: Automated Exfiltration): The collected data is then exfiltrated from the network, typically using encrypted channels or common protocols to blend in with legitimate traffic.

Detection Opportunities:

Anomalous EMHub Traffic: Monitor network traffic to and from PeopleSoft EMHub for unusual request patterns, large data transfers, or connections to suspicious external IPs.
System Log Anomalies: Look for unexpected process creation, command execution, or changes to configuration files on PeopleSoft servers.
Credential Misuse: Monitor for unusual login attempts or the use of PeopleSoft service accounts for activities outside their normal scope.
Network Flow Analysis: Detect unusual lateral movement within the network from PeopleSoft servers to other internal systems.

Mitigations:

Comprehensive Patching: Ensure all known vulnerabilities in Oracle PeopleSoft and underlying operating systems are patched, not just the latest ones. This directly counters the “gadget chain” approach.
Least Privilege: Implement strict least privilege principles for PeopleSoft service accounts and user accounts.
Network Segmentation: Isolate PeopleSoft environments, especially the EMHub component, from other critical internal systems.
WAF/IPS: Deploy and configure Web Application Firewalls and Intrusion Prevention Systems to detect and block known exploitation patterns and suspicious traffic.

Sources: Dark Reading, Rod’s Blog

Agentjacking Attacks against AI Coding Agents

A novel class of attack, termed “Agentjacking,” has emerged, specifically targeting AI coding agents. This sophisticated social engineering technique tricks these agents into executing arbitrary, malicious code on a developer’s machine. The attack is often initiated by presenting the AI agent with fake error reports or seemingly legitimate but poisoned code snippets that, when processed by the AI, lead it to generate and execute harmful commands.