SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 101

This Security Affairs feed summarizes multiple high-priority incidents and research: CISA added two actively exploited/known-exploited flaws to its KEV catalog — Oracle PeopleSoft RCE (CVE-2026-35273, CVSS 9.8) and Ivanti Sentry OS command injection/RCE (CVE-2026-10520, CVSS 10.0) — with active exploitation observed (ShinyHunters used the PeopleSoft zero-day). Threat activity also includes the Iran-linked Handala breach of California Water Service (5GB billing data leak), widespread exploitation of internet-exposed Ivanti Sentry gateways shortly after patch release, and large numbers of unauth