Cyber Security News

Hacking Editorial Brief — September 29, 2026

Attackers Exploit Citrix NetScaler Zero-Days and Oracle PeopleSoft via WAF Bypass

Citrix confirmed active exploitation of two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, with at least one flaw affecting every deployment running vulnerable versions. The in-the-wild exploitation adds urgency to patching efforts for enterprise gateway systems. Separately, threat actors linked to ShinyHunters are exploiting CVE-2026-35273 in Oracle PeopleSoft by bypassing web application firewall protections using a single URL-encoded character, allowing deployment of web shells across multiple sectors. Mandiant warned that attackers are specifically targeting organizations that applied vendor-recommended workarounds instead of installing the full patch, indicating reconnaissance of defensive posture before compromise. The PeopleSoft campaign demonstrates continued evolution of techniques against the HR platform following initial compromises reported earlier this month.

NeedyMantis Malware Framework Maintains Covert Access; Carbonato Botnet Deploys AI Agents

Microsoft disclosed NeedyMantis, a modular post-compromise malware framework designed to preserve long-term covert access inside already-breached networks across telecommunications, education, and government sectors. The toolset focuses on persistence rather than initial access, indicating mature threat actor operations. In a separate development, security researchers identified the Carbonato botnet deploying AI agents on compromised Docker hosts using the open-source Hermes Agent framework to execute commands. The botnet represents an emerging trend of threat actors integrating autonomous AI capabilities into traditional malware infrastructure. Meanwhile, cryptocurrency exchange Bitget disclosed that suspected North Korean hackers stole $351.6 million from hot and warm wallets in a coordinated backend attack, with attribution pointing to DPRK-linked groups following the massive crypto theft campaign reported this month.

Sources: The Cyber Express · The Hacker News · Hendry Adrian · Cybersecurity News · Dark Reading · Bleeping Computer