Tuesday, September 29, 2026|Issue 11|6 min read|Join the discussion
Identity is becoming the control plane for both cloud attacks and autonomous defense
Microsoft documents destructive Azure activity through compromised service principals, Apple patches an exploited CoreGraphics zero-day, and enterprise attackers keep targeting identities and orchestration systems that carry outsized authority.
The short version
- Apple fixed CVE-2026-86950, a CoreGraphics out-of-bounds write it says may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS before iOS 27. Update to iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 or Sequoia 15.8.1.
- Microsoft says Storm-3168 (JADEPUFFER) used two compromised Azure service principals to map a tenant, collect credentials, and run a seven-minute destructive sequence against storage, Key Vaults, apps and VMs.
- Mandiant says ShinyHunters resumed mass exploitation of PeopleSoft CVE-2026-35273 by URL-encoding one character to slip past WAF rules on unpatched servers.
- Orkes Conductor CVE-2026-58138, an unauthenticated RCE fixed in 3.30.2, is drawing active exploitation attempts against workflow orchestration servers.
- The pattern: workload and machine identities now carry the authority attackers want. Zero Trust has to cover them, not just people.
Issue at a glance
2 critical2 high
- highVulnerabilityApple patches CoreGraphics zero-day flagged in targeted attacks
- criticalRansomwareStorm-3168 turned two Azure service principals into a destruction tool
- highSecurityShinyHunters bypasses PeopleSoft WAF rules with one encoded character
- criticalAIOrkes Conductor RCE puts workflow orchestration in play
Patch clock
| CVE | Product | What it is | Severity |
|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler ADC and Gateway | Unauthenticated remote command execution via improper input validation; carryover, due September 30 | Critical (CVSS v4 9.5), exploited |
| CVE-2026-88772 | Citrix NetScaler ADC and Gateway | Memory overflow leading to RCE or denial of service when DTLS is enabled; carryover, due September 30 | Critical (CVSS v4 9.5), exploited |
Also on the vulnerability desk
- Not on CISA's KEV list as of this morning: Apple CVE-2026-86950 (CoreGraphics). Apple reports possible targeted exploitation; treat as high priority and update iOS/iPadOS to 26.7.1, macOS Tahoe to 26.7.1 and Sequoia to 15.8.1, starting with high-risk users.
- Not on CISA's KEV list: Orkes Conductor CVE-2026-58138, unauthenticated RCE in versions 3.21.21 before 3.30.2 (CVSS 3.1 9.8). Cloud Security Alliance, citing FortiGuard, reports roughly 7,000 attack attempts September 2–9. Upgrade to 3.30.2 now and keep the API off the internet.
GitHub Advisory (NVD)|Conductor v3.30.2 release|Cloud Security Alliance
Breaking
Apple / zero-day / mobile
Apple patches CoreGraphics zero-day flagged in targeted attacks
Apple fixed CVE-2026-86950, an out-of-bounds write in CoreGraphics that can lead to arbitrary code execution when a device processes a maliciously crafted file. Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Meta Product Security reported it. Fixes: iOS and iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1.
Why it matters. CoreGraphics renders images and PDFs across Apple's systems, so a parsing flaw can be reached by content a phone handles automatically, such as previews. Apple has not said how files were delivered, who was targeted, or whether attacks succeeded, and its exploitation note refers to iPhones only.
What to do. Push the updates through MDM, starting with executives, administrators, travelers and anyone with privileged access. Consider Lockdown Mode for the highest-risk users.
CVE-2026-86950
Azure / cloud identity / ransomware
Storm-3168 turned two Azure service principals into a destruction tool
Microsoft says Storm-3168, its name for the JADEPUFFER actor Sysdig called the first documented agentic ransomware operation, compromised two service principals in one tenant in early June. One spent about 15.5 hours on reconnaissance; the other handled discovery, credential collection and destruction. The destructive stage lasted seven minutes and targeted more than 100 storage accounts plus SQL databases, Key Vaults, Function Apps, VMs, App Services and recovery protection locks.
Why it matters. No human account was needed. The attacker acted entirely through non-human identities and their permissions. Microsoft says Azure resource locks and storage-level protections saved some storage accounts, and it did not observe a ransom note or confirm exfiltration.
What to do. Inventory service principals and their role assignments, cut them to least privilege, rotate and revoke exposed secrets (removing a leaked credential from a repo does not revoke it), and put backups and resource locks under separate authority from production.
Oracle / PeopleSoft / ShinyHunters
ShinyHunters bypasses PeopleSoft WAF rules with one encoded character
Google's Mandiant and Threat Intelligence Group say UNC6240, linked to ShinyHunters, modified its CVE-2026-35273 exploit to request /%50SEMHUB/ instead of /PSEMHUB/. Many WAFs match the literal path before decoding, while PeopleSoft decodes it and routes to the vulnerable servlet. Web shells were placed on dozens of systems across higher education, healthcare, technology, government and other sectors.
Why it matters. The flaw is unauthenticated RCE (CVSS 9.8) that Oracle fixed in June. Organizations that relied on a WAF rule instead of patching are the ones being hit again. A mitigation that matches strings is not a remediation.
What to do. Apply Oracle's June fix or disable the Environment Management Hub. If you must keep a WAF rule, normalize paths before matching, and hunt for web shells on any PeopleSoft server that was exposed.
CVE-2026-35273
orchestration / RCE / AI agents
Orkes Conductor RCE puts workflow orchestration in play
CVE-2026-58138 lets unauthenticated attackers run OS commands on Orkes Conductor 3.21.21 before 3.30.2 by submitting workflow definitions with malicious JavaScript or Python to the workflow API, abusing unsandboxed GraalVM evaluators. Public exploit code exists, and Cloud Security Alliance reports active, spiking attempts.
Why it matters. Conductor coordinates microservices and, increasingly, AI agent workflows. Whoever controls the orchestrator inherits the credentials and tool access it hands to every task.
What to do. Upgrade to 3.30.2, require authentication on the API, restrict network access, and rotate secrets stored in or passed through Conductor if a server was exposed.
CVE-2026-58138
GitHub Advisory (NVD)|Conductor v3.30.2 release|Cloud Security Alliance
Trends
Yesterday the unit of defense wasn't the patch. Today the unit of control is identity
Storm-3168 did its damage through the chain identity, token, permission, API. Cloud control planes don't care whether the caller is a person, a script or an agent; they act on whatever authority the identity holds. That makes cloud ransomware and destruction an identity problem first. Zero Trust has to reach workloads and autonomous agents, granting no actor more authority than it needs.
Workload identities are Tier-0 assets
Service principals, managed identities, API keys, CI/CD identities, OAuth apps and agent identities often hold more standing authority than any administrator, with less monitoring and no MFA. Microsoft's guidance centers on protecting workload identities and secrets and enforcing least privilege. Treat them with the same inventory, ownership and review as privileged human accounts. Orchestrators like Conductor belong in the same category: they hand out that authority.
Recovery needs independence from production authority
Microsoft notes that some storage accounts survived only because resource locks and storage-level protections were in place, and that the attacker went after recovery protection locks too. If the identity that runs production can also delete backups and remove locks, one compromised principal can erase both. Separate the authority that can destroy from the authority that can restore.
Automated attacks compress reaction time
What Microsoft observed: a second principal enumerated two subscriptions in five seconds, and destruction ran for seven minutes. Our read, not Microsoft's claim: as agentic tooling matures, the window between access and impact will keep shrinking, so preventive controls on identity matter more than detection speed alone.
Clearance corner
BOD 26-04 already rewards knowing what an asset can do
CISA's directive sets federal remediation timelines by exposure, KEV status, exploit automation and technical impact, with the most severe cases requiring action in as few as three days plus forensic triage. Today's items fit that model: exploited, automatable, full-control flaws on exposed systems like NetScaler, PeopleSoft and Conductor move to the front.
What we are watching next
NetScaler deadline
Federal agencies must remediate CVE-2026-88771 and CVE-2026-88772 by September 30.
Apple CVE-2026-86950
Watch for technical analysis, delivery method and any attribution of the targeted attacks.
Storm-3168 follow-on
Whether JADEPUFFER repeats service-principal techniques in other tenants or clouds.
ShinyHunters and PeopleSoft
More web-shell findings and any confirmation of the group's claimed new PSEMHUB zero-day.
Machine and agent identity
Vendor and standards moves on securing service principals, workload identities and AI agent credentials.
Sources
Join the discussion
Loading comments…