Some threats call for patches. Others call for cutting the cable. |
Today’s news spans over 900 Oracle patches, exposed gateways, evolving infostealers, AI hitting the brakes, and a telecom defense that took “disconnect the threat” quite literally. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Oracle Drops 943 Fixes in Major Security Update |
Oracle patched 943 vulnerabilities, including critical flaws that could let remote attackers compromise enterprise systems without credentials. Fusion Middleware received 262 fixes, including 182 for vulnerabilities that can be exploited remotely. |
The company has not reported exploitation in the wild at the time of publication.
Conduct an assessment to identify patch priorities for your organization and implement compensating controls if you are not able to patch right away. |
NetScaler Flaw Exposes Enterprise Gateways |
A NetScaler vulnerability could let remote attackers bypass authentication and access corporate resources. CVE-2026-19490 carries a CVSS score of 9.3 and affects NetScaler ADC and Gateway deployments.
The company has released patches for both CVE-2026-19490 and CVE-2026-19489, a denial-of-service (DoS) flaw. Patch affected NetScaler appliances, restrict external access, enforce MFA, segment sensitive systems, monitor logs, and test incident response plans. |
OpenAI Pauses AI Training Over Astra Cyber Concerns |
OpenAI slowed frontier AI development after tests showed Astra could reach its highest cybersecurity capability threshold.
The company defines “Critical” capability as the ability to autonomously develop zero-day exploits or execute end-to-end attacks against hardened systems. For security teams, the risk grows as autonomous AI agents gain greater access to credentials, tools, and other sensitive infrastructure.
Treat AI agents as privileged identities by limiting access, auditing permissions, and logging all activity. |
|
|
|
Lean security teams don't need more coverage. They need clarity. In this short video, we break down why "collect everything, alert on anything" SIEMs bury lean teams in noise — and how the smartest ones are flipping the script: starting with risk, not logs, to build detection that scales with confidence, not headcount. |
|
|
|
T-Mobile Literally Cuts Cable to Stop Salt Typhoon Hackers |
T-Mobile reportedly cut a network cable after tracing malicious activity to another telecom provider’s infrastructure. Salt Typhoon compromised at least 200 organizations across 80 countries, primarily targeting telecommunications infrastructure. |
T-Mobile’s cable cutting approach reminds me of my early network engineering days, when sometimes the simplest physical solution, like unplugging workstations one by one to trace unlabeled switch ports, was the only way to get the job done.
Segment critical infrastructure, patch network devices, strengthen privileged access, monitor activity, and conduct continuous third-party risk assessments. |
Microsoft Tracks MacSync Stealer Across 30+ Domains |
Microsoft linked more than 30 domains to MacSync Stealer by tracking its behavior across changing infrastructure. The macOS infostealer targets Keychain data, browser credentials, SSH keys, AWS credentials, and Kubernetes configurations, potentially exposing broader cloud environments. Because its infrastructure can rotate quickly, defenders should prioritize behavioral detection over domain blocklists alone. Correlate suspicious Mac behaviors like shell activity, credential access, and HTTP PUT requests instead of alerting on individual tools. |
|
|
|
Disrupt Infostealer Attacks |
Infostealers operate discreetly on compromised devices, harvesting credentials, browser cookies, session tokens, cryptocurrency wallet data, and other sensitive information. |
How to reduce risk from infostealers: |
- Use phishing-resistant MFA, enterprise password managers, and separate privileged accounts to reduce credential theft and misuse.
-
Leverage EDR or XDR solutions to detect suspicious credential access, shell activity, archive creation, and outbound connections while restricting unnecessary scripting tools.
-
Reset exposed credentials and revoke active sessions and tokens to prevent attackers from maintaining access.
|
Prioritize controls that shorten the window between infostealer execution, credential exposure, and revocation before attackers can turn stolen access into broader compromise. |
|
|
|
Security Tools You Can Use |
|
|
|
AI Speed Check: Are companies racing ahead of their safeguards? |
|
|
|
Yesterday's Pulse Check Results |
How has AI changed your patch management process? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
