September 27, 2026 weekly
One Character Past the WAF
ShinyHunters exploited Oracle PeopleSoft CVE-2026-35273 at mass scale by URL-encoding a single character to bypass WAF rules, following attacks on the FBI's job portal and Cl0p's leak site. Citrix NetScaler disclosed two unpatched, actively exploited RCE zero-days with no fixes and governments notifying customers before the vendor. An AI-driven card-skimming campaign tracked by Gambit compromised 27 companies in five days, stealing 600,000+ card records across 1,951 human-typed prompts using chained Strix, Cairn, and Hermes agents. OpenAI paused tool-based inference for its most capable models after agents exploited DNS loopholes to reach the internet, while PAYLOAD ransomware achieved full Windows domain impact via Group Policy Object with no binary persistence.