Active Exploits, Urgent Advisories, and New Ransomware Claims

Critical Vulnerabilities Under Active Exploitation:

• ShinyHunters Bypasses WAFs in Renewed Oracle PeopleSoft Attacks: The threat actor group ShinyHunters is actively exploiting a critical Oracle PeopleSoft vulnerability (CVE-2026-35273) using a URL-encoding trick to bypass Web Application Firewalls. This campaign has led to the deployment of a new backdoor, SIDEEYE, and the use of MeshCentral for persistence, with over 100 organizations notified of their risk.
• CISA Adds SharePoint, MikroTik Bugs to Known Exploited List: CISA has added CVE-2026-65660, a remote code execution flaw in Microsoft SharePoint, and CVE-2026-67279, a workflow bypass in MikroTik RouterOS, to its KEV catalog due to active exploitation. Federal agencies are mandated to patch these vulnerabilities by September 28, 2026.

New Threats and Advisories:

• Kiteworks Urges Shutdown After Warning of Imminent Cyberattack: Secure file-transfer vendor Kiteworks has issued an unprecedented advisory urging customers to shut down systems for a 6-9 hour window over the weekend, citing credible threat intelligence about a potential imminent attack. The move is preventative, with no known compromises at this time.
• Microsoft Details Destructive Cloud Tactics of JADEPUFFER: Microsoft has detailed a destructive campaign by Storm-3168 (JADEPUFFER) in Microsoft Azure, where compromised service principals were used for automated attacks. This 'agentic ransomware' group executed rapid, destructive actions within minutes, aiming to cripple victims and prevent recovery.

Ransomware Activity and Claims:

• Qilin Ransomware Claims Attack on U.S. Manufacturer All Tech: The Qilin ransomware group has claimed an attack on U.S.-based precision machining company All Tech Machine & Engineering, Inc., alleging the theft of internal data as part of a double-extortion strategy.
• ZaWoo Ransomware Claims Attack on French Accounting Firm: The ZaWoo ransomware group has listed Agiliance, a French accounting and business advisory firm, on its data leak site, claiming a compromise on August 18 and potentially exposing sensitive financial and client data.
• KRYBIT Ransomware Claims Attack on National Airline of Tanzania: The KRYBIT ransomware group has claimed an attack on Air Tanzania Company Limited (ATCL), the national airline of Tanzania, alleging data theft and threatening to release it, highlighting risks to critical transportation infrastructure.
• Charles & Keith Confirms Cyberattack After Ransomware Listing: Singaporean fashion brand Charles & Keith Group has confirmed a cybersecurity incident affecting some servers, following its listing on the data leak site of the ransomware group 'TheGentlemen'. The company is investigating the extent of the data impact while operations continue normally.