THE CYBER BRIEF - ISSUE 50

T H I S I S S U E - S P O T L I G H T

Vendor Urges Customers to Stop Using Platform after Warning from Federal Intelligence Agencies

• Kiteworks emailed customers recommending they shut down their systems during a six-hour window, after federal intelligence authorities warned that a threat actor may target some customer Kiteworks.
  

• Although the vulnerabilities are remediated in the most current product release, the advisory highlights the velocity of AI driven discovery and exploitation, and the challenge to traditional patch deployment in addressing.
  

• Kiteworks was formerly Accellion, whose file transfer tool was exploited in December 2020 by the Clop group through a zero-day; victims included Kroger, Bombardier, Flagstar Bank, and the University of Colorado.
  

https://therecord.media/kiteworks-urges-customers-to-stop-using-systems-incident

JadePuffer Agentic AI Attacks Target Azure

• Attacks targeting Azure tenants conduct reconnaissance, steal credentials, attempt to destroy core components, and alter configurations including backup and recovery protections.
  

• The attacks emerged in July, with researchers at cloud security company Sysdig highlighting that it uses AI agents to automate the entire attack chain, from reconnaissance, credential theft, and lateral movement to persistence and data encryption.
  

• The attacks highlight the use of AI agents to coordinate initial access, lateral movement and attack a wide range of exploitation points within tenants.
  

https://www.bleepingcomputer.com/news/security/jadepuffer-agentic-ai-attacks-target-azure-destroy-cloud-resources/

ShinyHunters Uses WAF Bypass Trick in Oracle PeopleSoft Attacks

• In June, Oracle issued a security advisory alert communicating details of the Oracle PeopleSoft CVE-2026-35273 flaw and recommended actions including the availability of patches.
  

• An alternative solution for organizations unable to immediately patch their install centered around blocking the malicious endpoint request via WAF rules.
  

• ShinyHunters subsequently modified its exploit to bypass WAF rules, allowing the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure.
  

• Google reports the new wave of attacks has deployed web shells on dozens of systems worldwide within higher education, technology, IT services, healthcare, agriculture, transportation, and government organizations.
  

https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/

GLM-5.3 and the Spread of Advanced Cyber Capabilities

• As predicted when Mythos was first unveiled, competing models (specifically Zhipu AI GLM 5.3) now possess strong capabilities for autonomously building end-to-end cyber exploits.
  

• Anthorpic highlights in their testing that these capabilities are readily accessible due to easily bypassed guardrails, effectively increasing the cyber capabilities available to malicious actors.
  

• GLM-5.3-Flash chained exploits for Chrome CVE-2026-11645 and a second known flaw into a reliable ARM64 attack that bypassed PAC hardening, using 8 hours of model time, 20 minutes of human attention, and $20.40 at Zhipu’s API prices.

https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities

This newsletter is intended for informational purposes only. The content reflects publicly available information and general industry trends as of the date of publication and may not reflect the most current regulatory developments. Newsletter may contain links to vendor supported content which does not represent endorsement or promotion of products or services. Nothing herein constitutes legal, compliance, or professional advice, and should not be relied upon as such.