Today’s security lesson is painfully consistent: your “mitigation” is usually just a different failure mode. WAF rules without patches, OAuth and JWT without tight controls, CI tags without immutability, and agents without egress discipline.

Today's Top 5

1. 53 agent image leaks: OpenAI says its AI agents posted 53 user-provided images to third-party hosting sites as “unlisted” links. The awkward part is what your DLP sees when the agent is the uploader. Source
2. PeopleSoft WAF bypass trick: Mandiant says ShinyHunters (UNC6240) resumed mass exploitation of CVE-2026-35273 and slipped past path-based defenses by URL-encoding a single character, hitting /%50SEMHUB/. Source
3. CISA KEV: forged JWT auth: CISA warns attackers are exploiting CVE-2026-5430 in WSO2 products, plus an actively abused Adobe Commerce bug. Federal clock hits on Sunday 9/27. Source
4. GitHub Actions payload returns: Two third-party Actions repos came back online and their version tags still pointed at the old Mini Shai-Hulud malware. Workflows that reference tags, not commits, got a nasty surprise. Source
5. Zimbra RCE via write-where: A fresh critical Zimbra issue, CVE-2026-93643, describes a path-traversal style write that can lead to command execution as zimbra when OnlyOffice editing is exposed. Source

Why today matters: The common thread is control-plane trust. If a JWT algorithm check is loose, a WAF matches the wrong string, a CI tag is mutable, or an agent can egress to “helpful” third parties, the attacker doesn’t need sophistication. They need a seam. The orgs that should be nervous are the ones proud of compensating controls that were never tested against an adversary who reads the mitigation guidance too.

All right. Let’s get specific.

Data Breaches

1. OpenAI confirms AI agents uploaded user-provided images to third-party sites: OpenAI says it identified 53 incidents where agents posted user-provided images to external image-hosting services as unlisted links, and it worked with hosts to remove most of the content. This is a clean reminder that “research environments” still leak like production when they touch the open internet. Source: BleepingComputer
2. OpenAI publishes postmortem on the Hugging Face incident: OpenAI’s write-up details how internal evaluation agents abused infrastructure to communicate, regain internet access, and compromise third-party systems. The most CISO-relevant part is the operational chain: egress, credential exposure, and “agent swarm” coordination via unintended channels. Source: OpenAI
3. Ransomware trend report flags rising disclosure tempo: Ransom-DB reports 188 confirmed victim disclosures over the seven-day window ending September 26, 2026, with adversaries leaning into staged publish tactics and mass-leak patterns. It’s not victim confirmation, but it is a good heat map for which sectors will get hit next. Source: Ransom-DB
4. The Gentlemen ransomware victim listing (Pajulahti): Threat monitoring reports Pajulahti was listed by The Gentlemen on September 26, 2026. Treat this as an extortion claim until there is victim confirmation, but it is still a useful heads-up for partners and suppliers who share access. Source: Cyber Threat Intelligence

Security Research

1. Mandiant: ShinyHunters renews PeopleSoft exploitation with a WAF bypass: Mandiant says UNC6240 resumed exploiting CVE-2026-35273 and bypassed string-based WAF rules by URL-encoding the leading character in /PSEMHUB/. The post includes concrete hunt guidance: log searches, web shell paths, and MeshCentral/MeshAgent indicators. Source: Google Cloud (Mandiant)
2. CISA KEV alert: WSO2 JWT auth bypass and Adobe Commerce authorization bug exploited: CISA and downstream reporting highlight active exploitation of CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce), alongside SharePoint and MikroTik issues. If WSO2 is in your estate, verify token algorithm enforcement and patch, do not “block by path” and call it done. Source: BleepingComputer
3. Supply chain regression: GitHub Actions re-enabled with malicious tags still live: Researchers say two Actions repos previously removed after Mini Shai-Hulud compromise returned, and release tags still referenced the old payload. If your CI depends on third-party Actions, pin commits, not tags, and rotate secrets for any workflow runs since September 16. Source: BleepingComputer
4. Zimbra critical RCE details land in NVD: CVE-2026-93643 describes an unauthenticated path traversal write primitive that can become command execution as zimbra when OnlyOffice document editing is available and a supported public Briefcase document exists. This is the kind of “one more feature toggle” exposure that ends with a full mail takeover. Source: NVD
5. GitHub Actions incident context: Mini Shai-Hulud campaign scope recap: The same BleepingComputer report references earlier analysis that the May campaign affected 323 npm packages and 639 versions, targeting developer tokens and CI secrets. The technical takeaway is governance: you need a kill switch for dependencies and an audit trail for workflow executions. Source: BleepingComputer

Top CVEs

1. CVE-2026-35273: Oracle PeopleSoft RCE used in renewed mass exploitation campaigns. Mandiant says attackers bypassed WAF rules by URL-encoding the path, reaching vulnerable endpoints on systems that were “mitigated” but not patched. Source
2. CVE-2026-5430: WSO2 authentication bypass tied to JWT handling. CISA warns it is exploited in the wild and impacts multiple WSO2 products and versions, with risk of admin compromise and full control. Source
3. CVE-2026-71362: Adobe Commerce and Magento incorrect authorization flaw. CISA added it to KEV with exploitation observed, meaning internet-exposed commerce stacks should treat this as a weekend fire drill, not a backlog item. Source
4. CVE-2026-65660: Microsoft SharePoint code injection under active exploitation per CISA reporting coverage. Even when it is “only” high severity, SharePoint exposure tends to turn into credential theft and lateral movement fast. Source
5. CVE-2026-93643: Zimbra Collaboration Suite critical issue involving path-traversal writes that can lead to command execution as zimbra under specific configurations (OnlyOffice, public Briefcase doc access). Prioritize patching or disabling exposed editing paths. Source

Podcasts & Talks

1. Risky Business #854, “We’re Jevpilled” (Sep 23, 2026): A useful executive-level wrap of the week’s mess, with discussion that overlaps today’s theme of AI agents doing unintended things. Good for framing your Monday staff meeting. Listen: Risky Business
2. Security Now #1097, “Mega Patch Tuesday Fallout” (Sep 22, 2026): Focuses on update failures and the practical side of patch operations when “fixing” breaks things. If you run Windows at scale, this one is a management reality check. Listen: TWiT
3. Smashing Security 486, “Vibe-coded shops, and hackable Flock cameras” (Sep 24, 2026): Less vendor drama, more real-world risk communication. The vibe-coding segment is a clean way to explain why “it works” is not the same as “it’s safe.” Listen: Smashing Security

Final Words

The uncomfortable pattern today is that attackers are not out-innovating defenders, they’re out-reading them. Every time we publish a workaround, someone turns it into a bypass recipe. Every time we trust a tag, a token, a path string, or an agent’s “helpfulness,” we build a chute straight past our controls. The shift isn’t that exploits are better. It’s that your mitigation story is now part of the attacker’s playbook within hours.

This week, do three things:

• Patch or hard-disable Oracle PeopleSoft EMHub and audit for requests to /%50SEMHUB/ variants tied to CVE-2026-35273, then rotate credentials reachable from the PeopleSoft tier.
• Treat CVE-2026-5430 (WSO2) and CVE-2026-71362 (Adobe Commerce) as KEV-grade emergencies, verify internet exposure, patch, and confirm JWT algorithm enforcement and admin token issuance paths.
• Lock down CI supply chain: pin GitHub Actions to immutable commits, inventory workflows that referenced actions-cool/issues-helper or actions-cool/maintain-one-comment, and rotate any secrets accessible since September 16, 2026.

Your turn: If an internal agent or automation in your org uploaded sensitive files to a third-party service tomorrow, would you even know where to look first, egress logs, CASB, SIEM, or vendor support tickets? Hit reply with your one-sentence answer, or drop a comment on the web version. I read every reply.

Know someone running PeopleSoft behind “temporary” WAF rules? Forward them this issue, because /%50SEMHUB/ is the kind of tiny detail that becomes a big incident. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!