A security incident can interrupt customer service, expose confidential information and pull management away from running the business. Recent advisories highlight three priorities for Malaysian SMEs: protect internet-facing systems, investigate possible compromise even after patching, and control the access granted to AI tools.
The examples below concern international activity. They do not establish that AXO or any Malaysian customer has been affected.
1. Internet-facing gateways need urgent attention
On 27 September, CISA confirmed active global exploitation of two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772. Both can independently enable remote code execution. This is confirmed exploitation activity, rather than evidence of a named company's data breach. Source: CISA advisory.
For businesses using affected products, the immediate question is whether the deployed version and configuration are vulnerable. Check current vendor guidance and arrange remediation with your IT provider. The Canadian Centre for Cyber Security also advises prioritising internet-facing deployments and investigating suspicious activity. Where feasible, preserve evidence before changing a potentially compromised appliance. Source: Canadian Cyber Centre.
2. Recent compromises show why temporary protection needs follow-through
In its 25 September report, Mandiant and Google Threat Intelligence Group described renewed ShinyHunters exploitation of Oracle PeopleSoft vulnerability CVE-2026-35273. They observed web shells on dozens of systems across several sectors. Attackers adapted their approach to bypass certain web application firewall rules on systems that remained unpatched. Source: Mandiant and GTIG.
The practical lesson extends beyond this product: temporary perimeter rules require an owner and a deadline for permanent remediation. For affected PeopleSoft deployments, follow Oracle's patch guidance and the investigation steps in Mandiant's report. Applying a fix closes the vulnerability; it does not demonstrate that an earlier intrusion has been removed.
3. AI introduces another layer of identity and supply chain risk
GTIG's 8 September threat report describes adversaries using AI-enabled automation and targeting developer credentials, AI assets and software dependencies. These findings are based on observed campaigns; they do not mean every AI tool or organisation faces the same exposure. Source: GTIG AI Threat Tracker.
Our recommendation for SMEs is to inventory AI tools and integrations, restrict their permissions to the work required, and review new plugins and dependencies before deployment. Keep credentials out of shared content and require accountable human review for sensitive business actions.
A practical management checklist for this week
The following are AXO's suggested operational priorities, adapted for businesses with limited internal IT capacity:
- Know your exposure: list internet-facing gateways and applications, their versions, support status and responsible owners.
- Close the loop on patches: record completion evidence and follow up on temporary workarounds.
- Test detection: confirm who receives security alerts, who investigates them and who can authorise containment.
- Prove recovery: restore a representative business workload and record the result.
- Control privileged access: review administrative accounts, service credentials and permissions granted to integrations.
A useful management report should show unresolved exposure, assigned owners and evidence that corrective work is complete. Buying a security product is only one part of that process.
Discuss your security priorities with AXO
AXO provides cybersecurity and security posture assessment services. If you need help identifying gaps and prioritising improvements, contact AXO Technologies to discuss your environment.
