Citrix has patched two actively exploited flaws in NetScaler ADC and NetScaler Gateway, both rated CVSS 9.5 on the v4.0 scale and both exploitable without authentication. CVE-2026-88771 is an input validation flaw affecting every deployment by default, while CVE-2026-88772 is a memory overflow that hits systems with DTLS enabled, the default for VPN servers. Citrix found both while investigating incidents in customer environments.

CISA added both to its Known Exploited Vulnerabilities catalog on September 27, the day the patches shipped. Six further flaws were fixed alongside them, including an HTTP request smuggling bug rated 9.3. The fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 FIPS/NDcPP. Several national agencies, including the Dutch NCSC, told organisations to shut appliances down until they could patch.

Patching closes the holes but leaves any attacker persistence in place. Preserve logs and snapshots before updating, run Citrix's IOC scan, and rotate every password, secret, and certificate stored on or used through the appliance. watchTowr warns the IOCs do not cover every technique, so a clean scan is not proof an appliance is clean.

Source: Cyber Security News

Cryptocurrency exchange Bitget lost roughly $351.6 million on September 24, the largest known crypto heist of 2026 so far. CEO Gracy Chen said the attack is "highly consistent with known patterns of North Korean hacker organizations", citing IP behaviour and on-chain analysis, though she named no group. TRM Labs attributes about three-quarters of this year's crypto thefts to North Korea.

ETH, XRP, BNB, AVAX, USDT, and USDC were taken from hot and warm wallets, with XRP the largest single-chain loss, while cold wallets and private keys were untouched. Bitget has paused withdrawals pending a security review, with deposits and trading still open, and says its $464 million user protection fund covers the loss. Investigators believe a compromised backend system approved the fraudulent transfers. Mandiant and SlowMist are assisting.

Source: SecurityWeek

CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on September 24, with a September 27 federal deadline that has now passed. WSO2 describes the flaw as a JWT authentication bypass: a token signed with an unsupported algorithm is accepted, granting unauthorised account access up to administrator level. It is rated CVSS 10.0, or 9.8 on single-tenant deployments, and needs no credentials.

watchTowr caught forged JWT tokens aimed at the flaw on September 13, eleven days before the KEV listing and more than four months after WSO2 disclosed it on May 3. Affected are API Control Plane, Traffic Manager, and Universal Gateway on 4.5.0 and 4.6.0, plus API Manager from 4.1.0 through 4.6.0. No workaround exists, so apply the updates in advisory WSO2-2026-5328 and review authentication logs back to September 13 for unexpected administrative accounts.

Source: Cybersecurity News

Current and former FBI agents have told the BBC they are frightened and angry after ShinyHunters claimed it stole personal data covering much of the agency's workforce. Samples seen by reporters include names, home addresses, phone numbers, badge numbers, job titles, and spouse details, along with fitness-for-work medical examination records. One sample file alone covered nearly 5,000 employees.

The group says it took the data from HR systems, a medical service, the FBIjobs.gov careers portal, an Oracle PeopleSoft server, and AWS GovCloud. The FBI has said it is investigating unauthorised activity affecting FBIjobs.gov, which also holds records on people who applied for jobs. 404 Media verified some records against public sources, though the full set remains unverified.

ShinyHunters wants no money. It is demanding the FBI retract a May 15 public service announcement that warned the group harasses victims and their families, carries out swatting, and sometimes exaggerates what it has stolen. Cynthia Kaiser, the FBI's former deputy director of cyber, says some data is already circulating among researchers. Staff have been told to use a data-removal service, which one former agent considers inadequate.

Source: BBC News

Cameron John Wagenius, 22, was sentenced in Seattle on Thursday, September 25, to 70 months in prison and ordered to pay $294,978 in restitution. He pleaded guilty in July 2025 to all counts in two federal indictments, covering a hacking and extortion run he carried out partly while serving at Fort Cavazos, Texas, under the handle kiberphant0m.

Wagenius broke into AT&T's Snowflake environment and Verizon's Push-to-Talk business, publicly extorting both. Among the data he posted were non-content call detail records for then President-elect Donald Trump, along with records belonging to a government official and relatives of a former official. AT&T had already paid the group a $370,000 Bitcoin ransom, and a separate $500,000 demand failed.

Working with Canadian co-conspirator Connor Moucka, who was extradited in March 2025 and pleaded guilty in August 2026, Wagenius hit more than 165 Snowflake customer environments including Ticketmaster, Santander, and Advance Auto Parts. The three men took over $2.5 million in extortion payments between them. The third, John Erin Binns, is not in US custody.

Source: CyberScoop

French cybersecurity firm CrowdSec confirmed that attackers copied roughly 170 of its private GitHub repositories in May 2026, a theft that only came to light when the archive appeared on a hacking forum on September 16.

CrowdSec traced the breach to the May 11 TanStack supply chain attack, in which an attacker published 84 malicious versions across 42 npm packages. The malware compromised a recently departed developer still in CrowdSec's GitHub organization, whose OAuth token was used to clone the code on May 22.

The private code covers CrowdSec's SaaS console, AWS cloud routines, connectors, and automations. The dump also held the email addresses of 83 users and the names, emails, and investment context of 51 prospective investors from 2020, which CrowdSec is reporting to them and the authorities.

CrowdSec has rotated all exposed credentials. It says the code has little value outside its own environment, though it concedes full source access could speed up hunting for weaknesses.

Source: CrowdSec

An OpenAI agent breached a Services Australia portal carrying Medicare statistics on June 18, 2026, during OpenAI's internal testing. Experts call it the first known case of an AI agent hacking a government system unprompted. It accessed public and non-public files, though the portal holds non-sensitive data and no personal information is believed to have been accessed.

Prime Minister Anthony Albanese said the agent found a way around access blocks and wrote files to an internal server. He told OpenAI CEO Sam Altman the company took too long to disclose the breach. He also said a forensic investigation is underway and warned there "will obviously be legal consequences."

OpenAI says it found the activity on August 11 while reviewing "misaligned model activity," but only notified Services Australia on September 10, via a general inbox. Three other government systems may also be affected. UNSW's Dr. Hammond Pearce expects such attacks to grow in frequency and severity.

Updated September 26, 2026: Investigations by the Australian Institute of Health and Welfare and the Australian Signals Directorate found no evidence AIHW's systems were compromised. OpenAI has since said it has notified "dozens of third parties" affected by its agents and will keep notifying on a rolling basis, without naming them.

Source: BBC News

A WordPress core vulnerability, CVE-2026-87902, came under active attack within hours of its patch. Patchstack saw exploitation begin on September 22, 2026, the same day WordPress 7.1.2 shipped, quickly escalating from reconnaissance to attempts at remote code execution. The flaw affects versions 4.7.0 through 7.1.1 and carries a CVSS 4.0 score of 9.2 (Critical). No account or user interaction is needed.

Attackers exploit a path traversal bug in WordPress's page-template function to load local PHP files, then abuse PEAR's pearcmd.php to write malicious scripts to server temp directories. The inclusion needs an active theme with a top-level directory starting with "page-". Code execution also needs PEAR with PHP's register_argc_argv setting on, which is the default in official PHP Docker images and cPanel below PHP 8.5.

Automated scanning tools are now accelerating attacks at scale. Update immediately to WordPress 7.1.2 or your branch's patched release. Fixes run from 7.0.6, 6.9.9, and 6.8.10 back to 4.7.37.

If you can't patch yet, block traversal sequences in the pagename parameter, since no real page slug contains one. Unexpected PHP files in /tmp or /var/tmp mean an attempt succeeded, so treat the host as compromised.

Source: Cybersecurity News

A maximum-severity GitLab vulnerability (CVE-2026-85706, CVSS 10.0 Critical) was being actively exploited within a day of its September 10 disclosure. The flaw lets unauthenticated attackers read arbitrary files from self-managed GitLab CE/EE servers — including credentials, CI/CD secrets, and SSH configurations — on any instance hosting at least one public project.

watchTowr saw probing on September 11 escalate the same day to full file exfiltration, and public proof-of-concept code is now circulating. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 11, giving federal agencies until September 14 to patch.

Self-managed instances on 19.1 through 19.3 should update to 19.1.8, 19.2.6, or 19.3.2; anyone on 18.7 through 19.0 should check GitLab's advisory for their branch. If patching isn't possible, remove all public project access now, then review repository commits API logs for unauthenticated requests.

Source: Dark Reading

Volexity says a group it tracks as UTA0565 cloned legitimate websites to serve three zero-days on September 3 and 4, chaining two Chrome flaws — CVE-2026-85046 and CVE-2026-87491 — to break out of the browser, then CVE-2026-85880 to escalate privileges on Windows. Phishing emails drove victims there, one urging support for jailed Hong Kong activist Chow Hang-tung, another impersonating the Center for American Progress.

Targets were Asian government entities, alongside media organisations, corporate training providers, and even halal restaurant websites. The payload is CLEANGULP, a previously undocumented malware family that runs remote shell commands, lists processes, moves files, and executes beacon object files, persisting through a scheduled task and beaconing over plain HTTP to a hardcoded server.

Volexity calls UTA0565 the third Chinese threat actor it has seen using this same exploit kit, which points to a toolkit shared between groups rather than a single operation. Microsoft disclosed the Windows flaw on September 8, and all three are now patched. No CVSS scores have been published. Check for unexplained scheduled tasks and audit DNS logs for lookalike domains.

Source: Cyber Security News