Oracle Patch Tuesday Surge and Yonyou Active Exploitation Drive ATTENTION-Level Alert

September 15, 2026 brings a high-volume critical vulnerability day, with 1,390 new CVEs published and 169 rated critical — anchored by a wave of perfect-score CVSS 10.0 Oracle flaws and three vulnerabilities already flagged by VulnCheck as actively exploited before any official CISA confirmation. The Yonyou ERP ecosystem and Issabel PBX are under active scrutiny with proof-of-concept code circulating, while Oracle's Fusion Middleware stack faces unauthenticated remote exploitation risks at maximum severity. Defenders should treat this as an urgent patching window, not a routine update cycle.

The thegentlemen group is the most active ransomware actor targeting Brazil in the past 30 days, recently claiming Multipla Contabilidade Empresarial (Professional Services), Humboldt, and Biotipo Jeans (Retail) among its victims. Qilin claimed Alicotrans in the transportation sector, while nightspire, lockbit5, Vexy Ransomware, and Dark Project have also struck Brazilian organizations across manufacturing, healthcare, and technology verticals. With nine confirmed Brazilian victims attributed to thegentlemen alone in the past 30 days, the group represents a sustained and targeted threat to the country's business ecosystem.

Several threat actor groups are currently flagged as active or updated, including mosesstaff (Iran-linked), siegedsec (Russia-linked), sinobi, spacebears, thegentlemen, and funksec — though no specific new victims have been attributed to these actors in the current reporting window. The Iranian-linked mosesstaff and Russian-affiliated siegedsec are geopolitically motivated actors whose activity patterns often target critical infrastructure and government entities, warranting elevated monitoring even when direct victim counts are low. Their continued operational status alongside ransomware crews underscores a multi-front threat landscape.

Brazil continues to face disproportionately intense ransomware pressure, with recent victims spanning professional services (Multipla Contabilidade Empresarial), transportation (Alicotrans), manufacturing (Tuboaços da Amazônia, Alurwalls), technology (Logar Network Solutions), healthcare (amorsaude.com.br), and retail (Biotipo Jeans) — a breadth of sectors that signals opportunistic, indiscriminate targeting rather than sector-specific campaigns. The dominance of thegentlemen with nine Brazilian victims in 30 days, combined with activity from krybit, Vexy Ransomware, dragonforce, and others, indicates that Brazilian organizations of all sizes and sectors remain high-value targets. Defenders in Brazil should urgently review exposure of internet-facing systems, particularly those running ERP, PBX, and Oracle middleware products highlighted in today's bulletin.