This was the week the software nobody watches turned out to be the target. Oracle's PeopleSoft and E-Business Suite exploitation cycle widened from an insurance-regulator support body to Nissan to a reported 100-organization campaign, all riding the same back-office vulnerability. Jaguar Land Rover's cyber-incident toll was pegged near $2.5 billion, with reporting pointing to Russian-linked actors. And healthcare kept bleeding: Aflac Life Insurance Japan disclosed 4.38 million records exposed after a ten-day portal intrusion, while Medtronic and AdaptHealth added their own patient-data disclosures to the pile.

AI agents kept surfacing as attack surface, too — this time from four different angles. Microsoft warned that poisoned Model Context Protocol tool descriptions can quietly redirect what an AI agent does; "BioShocking" research showed AI browsers could be tricked into leaking user credentials; Adversa AI's "GuardFall" technique bypassed 10 of 11 open-source AI coding agents tested; and a separate disclosure flagged a cloud-credential flaw in Amazon Q Developer's VS Code extension. None of these are perimeter devices — they're productivity tools teams installed on purpose.

Defenders landed real blows, too. The FBI and Google dismantled NetNut, a residential-proxy network spanning roughly two million devices, while Google's Threat Intelligence Group detailed a continued disruption effort against malicious proxy infrastructure more broadly — the second and third such takedown in as many weeks. Meanwhile CISA's Known Exploited Vulnerabilities list kept growing, with Cisco Unified CM, SimpleHelp, and PTC Windchill all added amid confirmed in-the-wild exploitation.

Let's get into it.

Vulnerabilities & Breaches

Oracle's PeopleSoft and E-Business Suite exploitation cycle kept widening this week. NAIC — the body that supports US state insurance regulators — confirmed attackers reached its environment through CVE-2026-35273, exposing statutory financial and credit-rating data. Nissan disclosed that current and former employees' data was exposed through the same flaw, and separate reporting pegged the broader PeopleSoft campaign at 100 organizations, with only one victim confirmed by name and a reported 99 more not yet identified. By midweek, a second Oracle product line was under fire: CVE-2026-46817, a flaw in E-Business Suite Payments, was confirmed under active exploitation.

Why it matters: One vulnerability class in software most security teams don't treat as internet-facing — HR, finance, and insurance-regulator back-office systems — has now touched an insurance-industry standards body, a global automaker, and a reported 100-company campaign in the same week. If you run PeopleSoft or E-Business Suite anywhere in your environment, patch verification for CVE-2026-35273 and CVE-2026-46817 should be this week's top priority, not a background task.

→ Read the NAIC story · Nissan employee breach · 100-organization campaign · Oracle EBS Payments exploitation

Breaches

Fresh UK and insurer reporting pegs the total cost of the Jaguar Land Rover cyber incident near $2.5 billion, with the reporting pointing to Russian-linked actors. It's a scale-significant disclosure for automotive manufacturing — though as with any third-party cost estimate, both the figure's sourcing and the attribution deserve careful reading before being treated as final.

Why it matters: A $2.5 billion estimate — even a provisional one — reframes what a single manufacturing-sector intrusion can cost in production downtime, recovery, and reputational damage, at a scale few security budgets are built to absorb. If your organization runs industrial or manufacturing operations, this is a useful number to bring into the next board conversation about cyber-incident cost modeling.

→ Read the full story

Breaches

Three separate healthcare and health-adjacent breaches landed in the same week. Aflac Life Insurance Japan disclosed that intruders sat inside its policyholder portal for ten days, exfiltrating personal data on roughly 4.38 million customers and agents. Medtronic warned pacemaker patients that health data may have been exposed in a cyber incident, triggering patient-notification obligations. And AdaptHealth disclosed a cloud-systems compromise that exposed patient data, with social engineering reported as the initial-access route.

Why it matters: Three different entry points — a ten-day portal dwell time, a device-manufacturer disclosure, and a socially-engineered cloud compromise — produced the same outcome: patient and policyholder data in attacker hands. Healthcare and health-adjacent organizations should treat portal session monitoring, cloud-access reviews, and help-desk social-engineering resistance as equally urgent this week, not just perimeter defenses.

→ Read the Aflac Japan story · Medtronic pacemaker disclosure · AdaptHealth cloud compromise

Takedowns

Law enforcement kept dismantling the infrastructure that launders attacker traffic through ordinary consumer devices. The FBI and Google disrupted NetNut, a residential-proxy network spanning roughly two million devices, and Google's Threat Intelligence Group detailed a continued disruption effort against malicious residential-proxy networks more broadly. Both actions follow the same logic as the prior week's Dutch takedown of Asocks: remove the shared anonymity layer, and many actors lose cover at once.

Why it matters: Two proxy-network disruptions in two weeks is a trend, not an incident — and it should push every fraud and access-control team to stop treating a "clean" residential IP as a trust signal. Layer in device and behavioral signals now, because the industry's IP-reputation assumptions are eroding faster than most detection stacks have adjusted for.

→ Read the Google Threat Intel story · FBI/Google NetNut takedown

AI Security

AI agents kept surfacing as attack surface across four separate disclosures. Microsoft warned that poisoned tool descriptions in the Model Context Protocol can quietly redirect what an AI agent does, turning it into a data-leak channel. A body of research dubbed "BioShocking" showed AI browsers could be tricked into leaking user credentials. Adversa AI's "GuardFall" research found a shell-injection technique that bypassed 10 of 11 open-source AI coding agents tested. And a separate disclosure detailed a flaw in Amazon Q Developer's VS Code extension with cloud-credential implications.

Why it matters: Four different AI-agent categories — an interoperability protocol, browsers, coding agents, and a cloud-IDE assistant — all failed the same basic test: an agent trusted untrusted input and acted on it. Any AI agent your organization has given real permissions to — to browse, to write code, to touch cloud credentials — needs the same scrutiny you'd give a new privileged service account, not the benefit of the doubt you'd give a read-only tool.

→ Read the Microsoft MCP story · BioShocking AI browsers · GuardFall coding agents · Amazon Q Developer flaw

Vulnerabilities

CISA's Known Exploited Vulnerabilities catalog kept growing. A proof-of-concept for Cisco Unified CM's CVE-2026-20230 was weaponized in under 24 hours, dropping webshells on internet-exposed call-control servers. SimpleHelp's CVE-2026-48558, a critical remote-monitoring-and-management flaw, is being actively exploited to deliver the TaskWeaver and Djinn Stealer infostealers, which hunt cloud and AI development credentials. CISA added PTC Windchill's CVE-2026-12569 to the KEV list amid continuing webshell activity and a tight federal remediation deadline. Citrix and Progress also shipped patches worth prioritizing: six NetScaler flaws including CVE-2026-8451, which echoes CitrixBleed, and a pre-authenticated critical flaw in Progress's Kemp LoadMaster, CVE-2026-8037.

Why it matters: Three of this week's flaws are already on CISA's KEV list, and a fourth carries CitrixBleed's fingerprints — a bug class that fueled some of the worst breaches of the past two years. Prioritize KEV-listed patches this week over routine cycles, and treat RMM tools like SimpleHelp as high-value targets, since attackers are using them precisely because they're trusted and privileged by design.

→ Read the Cisco Unified CM story · SimpleHelp exploitation · PTC Windchill KEV addition · Citrix NetScaler patches · Kemp LoadMaster advisory

If there's a single thread through this week's stories, it isn't a new exploit technique — it's where the exploiting happened. Almost none of this week's biggest disclosures involved an obviously internet-facing target getting breached from the outside. They involved software an organization had already installed, licensed, and quietly trusted to run in the background.

Oracle's PeopleSoft and E-Business Suite are the clearest example. These aren't edge appliances bristling with attention from red teams; they're HR, finance, and insurance back-office systems that most security programs treat as internal plumbing. CVE-2026-35273 turned that plumbing into the entry point for an insurance-regulator support body and a global automaker in the same week, with a reported 100-organization campaign behind it. The vulnerability didn't need to punch through a perimeter — it just needed defenders to have deprioritized a system nobody thought of as attack surface.

AI agents told the same story from a different angle. Microsoft's MCP tool-poisoning research, the BioShocking AI-browser work, and Adversa's GuardFall coding-agent bypass all exploited the same gap: software given real permissions — to browse, to write code, to call tools — that trusted the content it was reading more than it should have. These agents aren't perimeter devices either. They're productivity tools installed by well-meaning teams, which is exactly why they were able to reach cloud credentials and user data without tripping the alarms built for external attackers.

The week's law-enforcement wins point to the same insight in reverse. The FBI/Google NetNut takedown and Google's continued residential-proxy disruptions worked because they targeted infrastructure the wider attacker ecosystem had learned to trust by default — a residential IP address that looked like nobody in particular. Removing that shared trust degraded many campaigns at once, the same way patching PeopleSoft or auditing an AI agent's permissions would.

The question worth asking before next week's briefing: which piece of software in your environment is currently exempt from scrutiny simply because it's supposed to be boring — and would it survive being treated as attacker-controlled today?

Until next time,

Stay sharp. Stay ahead.

📩 Share this briefing with a colleague who needs to stay ahead.

📰 Full coverage at thecybersignal.com

☀️ Daily briefing at daily.thecybersignal.com