Notifications
Clear all
Topic starter
06/09/2026 6:20 pm
TL;DR: Oracle E-Business Suite, Redis, and Unity vulnerabilities were actively exploited in the same weekly window, while cloud social engineering and ransomware alliances continued to intensify, showing how fast attackers are chaining access, persistence, and disruption across enterprise environments, according to FireCompass. Standing controls that assume quarterly review cycles are increasingly out of step with active exploitation and token-driven intrusion paths.
NHIMG editorial — based on content published by FireCompass: Weekly Report: New Hacking Techniques and Critical CVEs 30 Sep to 07 Oct, 2025
By the numbers:
- The Oracle E-Business Suite zero-day affected 570+ potentially vulnerable instances identified by Shadowserver Foundation.
- Censys detected 2,000+ internet-exposed Oracle E-Business Suite instances during the same exploitation window.
- The Qilin attack on Asahi Group resulted in 27 gigabytes of sensitive information being stolen.
Questions worth separating out
Q: What breaks when OAuth tokens are treated as permanent access?
A: Permanent OAuth access turns a delegated token into standing privilege, which means a compromise can be reused until someone revokes it.
Q: Why do public exploits and token abuse create such a fast containment problem?
A: Because the attacker’s first useful action often happens before teams finish triage.
Q: How do security teams know if supplier access governance is failing?
A: A governance failure shows up when you cannot answer three questions quickly: who has access, what data they can reach, and when that access expires.
Practitioner guidance
- Inventory internet-facing administrative surfaces Map every externally reachable management interface, especially ERP, Redis, and SaaS admin surfaces, then classify which ones can lead directly to code execution or access expansion.
- Separate token revocation from password response Build a playbook that revokes OAuth grants, refresh tokens, and third-party app consents independently of user credential resets, because the attack path often persists after passwords change.
- Reduce trust in delegated SaaS integrations Review every connected app, voice-phishing approval path, and privileged integration for scope creep, then remove unnecessary consent and enforce re-approval for high-risk access.
What's in the full report
FireCompass's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step exploit breakdowns for Oracle EBS, Redis, and Unity vulnerabilities across the week’s incidents
- Specific indicators of compromise, including suspicious XML Publisher activity, malicious Lua execution, and token abuse patterns
- The article’s own incident-by-incident summaries of ransomware activity, alliance formation, and supply-chain access paths
- FireCompass’s practitioner takeaways on patching, threat hunting, and incident response sequencing
👉 Read FireCompass's weekly report on critical zero-days and attack techniques →
Critical zero-days and criminal alliances: what should teams change now?
Explore further
06/09/2026 6:21 pm
Attackers are now chaining application flaws and identity trust failures in the same intrusion path. This report is not just a vulnerability roundup. It shows that pre-auth RCE, sandbox escape, and OAuth abuse can all serve the same end state: controlled access to enterprise systems. For identity teams, that means privilege governance must extend beyond logins and into administrative workflows, API trust, and delegated SaaS access.
A few things that frame the scale:
- From our research: When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Should organisations prioritise token revocation or password resets after suspected compromise?
A: Token revocation usually comes first when the incident involves OAuth, refresh tokens, API keys, or other delegated access. Password resets help only if the attacker depended on interactive login. When the compromise path includes connected apps, the priority is to cut off every issued credential and consented integration before restoring user access.
👉 Read our full editorial: Critical zero-days and criminal alliances are reshaping attack exposure
