# IT Daily Roundup – September 28, 2026

> Sep 28, 2026 · #security #cloud #oracle

Citrix NetScaler has two actively exploited unauthenticated RCE zero-days, Cloudflare patched a cross-tenant data leak in Containers, and ShinyHunters is attacking Oracle PeopleSoft via a WAF bypass trick.

## 1. Citrix NetScaler: Two Actively Exploited Unauthenticated RCE Zero-Days

Citrix confirmed and patched two critical remote code execution (RCE) vulnerabilities in NetScaler ADC and NetScaler Gateway: CVE-2026-88771 and CVE-2026-88772, both rated CVSS 9.5. CVE-2026-88771 allows an unauthenticated attacker to execute arbitrary commands through improper input validation. CVE-2026-88772 causes a memory overflow leading to RCE or denial of service — particularly on devices with DTLS enabled, which is the default configuration for VPN servers. Security firm watchTowr found that both vulnerabilities were actively exploited before patches were available. Affected versions include NetScaler 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and their FIPS variants. Patches are now available; organizations unable to patch immediately should isolate or shut down their appliances and minimize internet exposure.

> **Why this matters:** NetScaler ADC and Gateway are popular enterprise VPN and secure remote access platforms deployed at the network perimeter — exactly where an unauthenticated attack directly threatens the entire internal infrastructure. If your company or IT partner runs NetScaler, patching must happen without delay. Request written confirmation from your IT partner that the patch has been deployed and when. Citrix NetScaler has historically been a preferred target for APT groups — previous zero-days (e.g., "CitrixBleed" in 2023) led to widespread network compromises across multiple countries including European ones.

## 2. Cloudflare Patched a Cross-Tenant Data Leak in Containers: Deleted Disks Weren't Zeroed

Researchers discovered a significant architectural flaw in Cloudflare Containers and Sandboxes — a service running on shared physical infrastructure. When a container was deleted, its disk blocks were returned to a shared pool without being zeroed, potentially allowing residual data from one tenant to be read by another. During testing, researchers found directory listings, SQLite databases, Chromium profiles, .env files, and credential files belonging to other customers — on 75% of tested container placements across 91% of tested nodes. Cloudflare fixed the issue by removing the setting that skipped block zeroing and wiped all existing container disks and cached snapshots by September 19. No real customer data was confirmed exploited; no customer action is required.

> **Why this matters:** This flaw illustrates a concrete security risk of shared cloud infrastructure that companies often overlook when selecting cloud services: multi-tenant environments — where multiple customers share physical hardware — can under certain conditions expose one customer's data to another, without any external attack. For companies using cloud container services (Cloudflare Workers, but also AWS Lambda, Azure Container Instances, or Google Cloud Run), this is a practical reminder: sensitive credentials should not be stored directly in the container environment, but retrieved securely at runtime via dedicated secrets managers (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault). Cloudflare responded transparently and quickly — which is the standard to demand from cloud vendors.

## 3. ShinyHunters Attacks Oracle PeopleSoft via WAF Bypass: URL-Encoding Trick Evades Firewalls

The ShinyHunters group is actively attacking Oracle PeopleSoft systems through CVE-2026-35273, a vulnerability enabling unauthenticated remote code execution originally discovered in June 2026. The new attack wave uses a sophisticated WAF bypass trick: instead of requesting the path `/PSEMHUB/` directly, attackers use URL-encoded variants like `/%50SEMHUB/` (where `%50` represents the letter 'P'). Most WAF solutions and reverse proxies compare the request path before decoding it — so they fail to recognize the attack. Oracle WebLogic, on which PeopleSoft runs, decodes and processes the URL normally. After gaining access, attackers deploy JSP web shells and a backdoor called SIDEEYE disguised as a media player installer, steal credentials, and move laterally through the network. Approximately 100 organizations across education, technology, healthcare, and government sectors have been targeted; ShinyHunters claimed to have compromised FBI systems via this vulnerability and stolen 2-3 TB of data.

> **Why this matters:** For SMEs, this story carries two key takeaways. First — Oracle PeopleSoft is an HR and ERP platform deployed in medium-sized companies too; if you run it, the CVE-2026-35273 patch must be applied immediately (available since June 2026). Second — WAF bypass via URL-encoding is a technique that can work against any web application protected by WAF rules relying on literal path comparison. A firewall or WAF alone is never enough — it must always be combined with up-to-date patches on the application itself. If an external IT partner handles your security, ask how they test WAF configurations against URL-encoding and other obfuscation techniques.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-09-28-it-daily-roundup.html