Welcome to Threat Thursday, Galactic’s weekly threat intelligence roundup.
Every Thursday, we cover the cybersecurity stories that matter most for protecting organizations from emerging threats, and we break each one down into what happened, what it could mean for your organization, and what to do about it.
Each of the stories this week trace back to software organizations trust to run their business. A code repository platform, a WordPress login plugin, a video conferencing server, and security software itself all turned up as entry points.
This Week's Cycle
1. Oracle WebLogic Exploited Since January, Added to KEV in August: CVE-2026-21962
Oracle's January 2026 Critical Patch Update included a fix for CVE-2026-21962, a flaw in the WebLogic Server Proxy Plug-in that lets an unauthenticated attacker take control of it over HTTP. It carries a CVSS score of 10.0, which is as severe as the scale goes. The plug-in sits at the front of Oracle's application stack, routing web requests into the applications behind it, so a compromise there extends to whatever it fronts. Proof-of-concept attack code became public the same day as the patch, exploitation started immediately, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 24. SOCRadar documented a China-linked campaign, tracked as UNC5174 and UNC6586, using the flaw against government targets between April and June 2026.
Potential impact: Seven months separated the fix from the official confirmation that attacks were happening. Organizations waiting for a formal alert to drive urgency were working from information that was already old. Oracle ships security updates on a quarterly schedule, which means there are predictable periods where known vulnerabilities sit unpatched. When exploitation starts on day one, a quarterly cadence leaves a long window before formal signals catch up to real-world attack campaigns.
What to do: Apply Oracle’s January 2026 Critical Patch Update if it has not been installed. The flaw affects Oracle HTTP Server and the WebLogic Proxy Plug-in across several versions; Oracle’s January advisory lists the specific affected builds. Any deployment that was internet-accessible since January without this patch should be treated as an incident-response matter rather than a routine update: review access logs at the web and application layer for signs of unauthorized access.
Source: SecurityWeek
2. CISA Added Gitea to KEV With a Two-Day Federal Deadline: CVE-2026-60004
Gitea is a self-hosted platform for managing code repositories. CVE-2026-60004, rated 9.8, lets an attacker with ordinary repository write access send a malicious patch to the diffpatch API endpoint, plant an executable Git hook, and run shell commands as the Gitea service account. The condition that makes this straightforward to reach is a default setting: Gitea ships with open registration, so anyone on the internet can create an account and a repository, which supplies the write access the flaw needs. CISA confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities catalog on August 25, with a federal remediation deadline of August 28. Gitea patched it in version 1.27.1, released in late July.
Potential impact: Code repositories frequently hold more than code. Credentials left in configuration files, keys that unlock cloud accounts, and the detailed architecture of the systems built from that code are common finds. An attacker with access to the repository server can reach all of that. The open-registration default makes the flaw trivially reachable for any Gitea instance accepting connections from the internet, including many that were set up quickly and whose defaults were never revisited.
What to do: Upgrade self-hosted Gitea to version 1.27.1 immediately. Until the update is applied, disable public registration to close the no-credentials route to the flaw, and restrict the service from external network access. After patching, review repository hook configurations for any entries your team did not add.
Source: SecurityAffairs
3. Six Paid WordPress Plugin Editions Were Silently Patched With No Advisory: CVE-2026-15981
The miniOrange SAML SSO plugin connects WordPress sites to centralized login systems, the kind where one account signs you into multiple platforms. Two flaws in how the plugin verifies those login credentials let an attacker skip verification entirely and land in the WordPress administrator account without a password. Attackers are using both in active attacks. The disclosure handling is where the situation becomes complicated: the vendor patched the free edition in July and filed a public advisory covering it, but patched six paid editions with no public notice and no entry in any vulnerability database. Every scanner reported sites running paid editions as unaffected. DigitalOcean detected an actual attack on August 16; Patchstack confirmed the paid editions were the untracked target.
Potential impact: Administrator access to a WordPress site is complete control of it: content, data, every registered account, and often credentials stored in its database. The scanner-report problem extends beyond this one plugin. When a vendor patches a product without filing the standard vulnerability database entries, the automated tools organizations rely on to surface what needs attention cannot see it. A clean scanner report is only as accurate as what the vendor chose to disclose.
What to do: If the miniOrange SAML SSO plugin is installed, identify the specific edition and check the version directly against the fixed releases. Standard edition: version 17.0.5 closes CVE-2026-61979 and 17.0.6 closes CVE-2026-15981. Paid edition version 16.x does not prompt for an automatic update and requires a manual file upload to fix. Scanner output is unreliable here; verify the version manually. Review WordPress administrator session logs for access from unexpected IP addresses or unusual times.
Source: BleepingComputer
4. Head Mare Exploited TrueConf Server to Replace the Installer With Malware: CVE-2026-72529
The Head Mare hacktivist group exploited two flaws in TrueConf Server, an on-premises video conferencing platform, to compromise server installations and replace the installer file employees download when setting up the application on their computers. The replacement bundled PhantomCore and PhantomGraph, two backdoors that give attackers persistent access to the machine that runs them. CVE-2026-72529 (CVSS 9.8) lets an unauthenticated attacker call an undocumented function over TCP port 4307 and execute arbitrary scripts. CVE-2026-72530 (CVSS 9.5) extends that to full code execution on the host. CISA added both to its Known Exploited Vulnerabilities catalog on August 20. Fixed server versions are 5.3.9, 5.4.9, and 5.5.5.
Potential impact: The attack exploits the trust relationship between an organization’s own infrastructure and the people who use it. Employees downloaded what appeared to be a routine update from their organization’s own server. The distribution channel was the attack surface, and the endpoint was compromised before anyone noticed. Endpoint defenses look at what arrived on the machine, not at whether the server that delivered it had been tampered with.
What to do: Update TrueConf Server to the fixed build for your branch: 5.3.9, 5.4.9, or 5.5.5. Then work backward through the distribution: any machine that installed a TrueConf update since July should be treated as potentially compromised. Rotate credentials used from those machines, scan for PhantomCore and PhantomGraph indicators, and check the server’s distribution folder for file modifications and unrecognized sessions on port 4307.
Source: BleepingComputer
5. Microsoft Defender Has an Unpatched Zero-Day That Turns Any Foothold Into SYSTEM Access: CVE-2026-69414
A researcher publishing as Nightmare Eclipse released proof-of-concept code on August 12 for a Microsoft Defender flaw that bypasses a fix Microsoft shipped in mid-July for a related vulnerability. CVE-2026-69414, named ShieldBreak, targets how Defender processes files through Windows’ Cloud Filter API. An attacker with any low-privilege foothold on a Windows machine can interfere with the file data Defender receives during that process, redirecting Defender into processing attacker-controlled content under its own elevated privileges and converting that into SYSTEM-level access. Microsoft confirmed the vulnerability on August 14, assigned it CVSS 7.8, rated it ‘Exploitation More Likely,’ and is developing a fix. No patch has shipped. The researcher reports a 100 percent success rate in testing. Defender must be active for the attack to work.
Potential impact: SYSTEM is the highest privilege level on a Windows machine. An attacker who uses this flaw after gaining an initial foothold ends up with unrestricted access to everything on it: credentials, data, and the ability to disable or modify whatever runs there. The patch-bypass history is worth keeping in mind. Microsoft thought it had fully closed the predecessor flaw, RoguePlanet, with a dedicated fix. The patch-bypass history is worth keeping in mind. Microsoft thought it had fully closed the predecessor flaw, RoguePlanet, with a dedicated fix in July. ShieldBreak demonstrated within weeks that the fix was incomplete. That interval, between a vendor's confidence that something is closed and a researcher demonstrating otherwise, is where these situations live until the next patch arrives. That interval, between a vendor’s confidence that something is closed and a researcher demonstrating otherwise, is where these situations live until the next patch arrives.
What to do: There is no patch to apply yet. Until one ships, prioritize detection coverage beyond what Defender alone surfaces: any detection layer that depends on Defender’s alerting has reduced signal if Defender itself is the attack surface. Monitor for unexpected SYSTEM-level process activity on Windows endpoints, watch for changes to Defender’s signature update status, and treat any unexplained elevation to SYSTEM as a priority investigation. Deploy Microsoft’s fix immediately on release: working proof-of-concept code is already public and exploitation has been rated as more likely than not.
Source: The Hacker News
6. ShinyHunters Phished a Security Firm’s Employee. Device Trust Is What Contained the Damage.
ShinyHunters, responsible for some of the largest credential theft campaigns in recent years, targeted a ReliaQuest employee with a phone call, impersonating a legitimate contact and directing them to a fake login page. The attackers obtained temporary, view-only access to an Okta dashboard before device trust enforcement blocked further movement. No data was affected. ReliaQuest confirmed the incident. A phone call bypasses spam filters, email security gateways, and most technical defenses at the initial layer. What stopped the damage from compounding was device trust on the identity platform: a policy that checks whether the device making a request is one the organization recognizes and manages, regardless of whether the credentials are valid.
Potential impact: Many organizations have device trust available on their identity platform and have not enforced it, or have not confirmed it is working correctly. Device trust means that even a valid username and password used from an unfamiliar machine produces no access. It works before an attack begins rather than responding to one already in progress, which is what makes it different from the detection and alerting controls that a phone call bypasses entirely. The configuration decision has to come first.
What to do: Review whether device trust is enforced on your Okta, Entra ID, or equivalent identity platform. Confirm that administrative systems are inaccessible from devices the organization does not recognize and manage, even with valid credentials. Keep authentication session lifetimes short so a stolen login expires rather than remaining usable. Make sure your team has a clear, low-friction way to report unexpected calls from someone claiming to be IT support or a service provider.
Source: Cybersecurity Today
The Big Picture
The tools organizations depend on most, remote access software, file transfer platforms, browser extensions, and security software itself, are now the most reliable entry point for attackers. That's not a coincidence. Widely trusted tools mean wide deployment, and wide deployment means a single flaw reaches everywhere at once.
CISA added the Oracle flaw to its Known Exploited Vulnerabilities catalog seven months after it was first exploited. Organizations that waited for that signal got seven months of exposure in the meantime. Severity scores measure theoretical damage. The KEV catalog measures confirmed use in real attacks, and cross-referencing your inventory against it is what separates reactive patching from actual prioritization. The ShieldBreak story makes the second half of that point. A working proof-of-concept is public, Microsoft rates exploitation as likely, and the fix hasn't arrived. When a patch doesn't exist yet, the only move is confirming the compensating controls already in place are working before they're tested in anger.
The work that matters this week comes down to knowing what you run, knowing what's under attack, and knowing which of your controls will hold when the patch hasn't arrived yet.
Check back next week for another Threat Thursday. See you then!
