A fresh zero-day vulnerability is hitting Citrix NetScaler appliances — even ones administrators had just patched days earlier. Tracked as CVE-2026-88779, the high-severity memory overflow flaw affects NetScaler ADC and Gateway instances configured as SAML SP or IdP, causing Denial of Service through repeated crashes. Those earlier patches covered CVE-2026-88771 and CVE-2026-88772, fixed the week before.
Security researcher Kevin Beaumont, who named this one PitScaler 2, confirmed seeing exploitation attempts against patched honeypots, and reported one honeypot running a downloaded malware binary. Admins reported reboots alongside logs showing shell commands buried in username fields. One admin who retrieved the script said it tries to plant web shells, survive reboots and upload configuration and backups — while cautioning there was no proof it ever ran.
Security firm watchTowr has since reproduced the flaw and found it can only crash systems, with no route to code execution. The firm suspects attackers crashed machines deliberately to make exploitation of CVE-2026-88771 faster. Citrix says the same thing from its side: service availability is affected, customer data integrity is not.
CISA added the flaw to its KEV catalog on October 4, giving federal agencies until October 7 to remediate. It's the sixth exploited NetScaler vulnerability CISA has cataloged in 2026.
Source: SecurityWeek
A fresh zero-day vulnerability is hitting Citrix NetScaler appliances — even ones administrators had just patched days earlier. Tracked as CVE-2026-88779, the high-severity memory overflow flaw affects NetScaler ADC and Gateway instances configured as SAML SP or IdP, causing Denial of Service through repeated crashes. Those earlier patches covered CVE-2026-88771 and CVE-2026-88772, fixed the week before.
Security researcher Kevin Beaumont, who named this one PitScaler 2, confirmed seeing exploitation attempts against patched honeypots, and reported one honeypot running a downloaded malware binary. Admins reported reboots alongside logs showing shell commands buried in username fields. One admin who retrieved the script said it tries to plant web shells, survive reboots and upload configuration and backups — while cautioning there was no proof it ever ran.
Security firm watchTowr has since reproduced the flaw and found it can only crash systems, with no route to code execution. The firm suspects attackers crashed machines deliberately to make exploitation of CVE-2026-88771 faster. Citrix says the same thing from its side: service availability is affected, customer data integrity is not.
CISA added the flaw to its KEV catalog on October 4, giving federal agencies until October 7 to remediate. It's the sixth exploited NetScaler vulnerability CISA has cataloged in 2026.
Source: SecurityWeek
A newly established ransomware group called BYOD claims to have stolen personal data from Trump Mobile customers, posting a file to its dark web leak site last week containing 3,615 records — names, addresses, phone numbers, emails, and order details. Straight Arrow News reported it on October 5, 2026, after reviewing the data and calling people listed in it.
Several confirmed their details were accurate. Several others confirmed the same, then denied being Trump Mobile customers and hung up — so the file holds up for some entries without standing up all 3,615. Among those listed is Eric Brunnett, vice president and chief information officer at the Trump Organization. Straight Arrow found no Trump family members in the data.
BYOD says it got in by infecting an employee at Florida-based Liberty Mobile with malware. The malware family, the infection method and the access path remain unestablished, and nothing in the reporting shows ransomware encrypted any systems. Trump Mobile is owned by T1 Mobile and licenses its branding from the Trump Organization.
BYOD also claims it still has access to Trump Mobile's backend dashboard, backing that up with a screenshot of customer data. Whether that access is live is the open question. Trump Mobile had not commented at publication time. No passwords or card numbers have been shown as exposed, but customers should watch for phishing attempts and verify any unexpected outreach through official channels.
Source: Cybersecurity News
A newly established ransomware group called BYOD claims to have stolen personal data from Trump Mobile customers, posting a file to its dark web leak site last week containing 3,615 records — names, addresses, phone numbers, emails, and order details. Straight Arrow News reported it on October 5, 2026, after reviewing the data and calling people listed in it.
Several confirmed their details were accurate. Several others confirmed the same, then denied being Trump Mobile customers and hung up — so the file holds up for some entries without standing up all 3,615. Among those listed is Eric Brunnett, vice president and chief information officer at the Trump Organization. Straight Arrow found no Trump family members in the data.
BYOD says it got in by infecting an employee at Florida-based Liberty Mobile with malware. The malware family, the infection method and the access path remain unestablished, and nothing in the reporting shows ransomware encrypted any systems. Trump Mobile is owned by T1 Mobile and licenses its branding from the Trump Organization.
BYOD also claims it still has access to Trump Mobile's backend dashboard, backing that up with a screenshot of customer data. Whether that access is live is the open question. Trump Mobile had not commented at publication time. No passwords or card numbers have been shown as exposed, but customers should watch for phishing attempts and verify any unexpected outreach through official channels.
Source: Cybersecurity News
Saif al-Din Khader, known as "Rey" and believed to lead the ShinyHunters extortion group, has been arrested in Jordan and is reportedly cooperating with the FBI to identify other members. Jordan confirmed the arrest without naming him — the identification comes from Reuters sources, who place the detention on September 29. The FBI has declined to comment on any arrest in Jordan.
Khader, a teenager from Amman, is also linked to the Scattered Lapsus$ Hunters group, where Brian Krebs placed him as a key member when he first named him in November 2025. Some reporting calls him ShinyHunters' leader; most call him a suspected member. Charges and extradition haven't been disclosed.
The arrest follows ShinyHunters hacking and defacing the FBI's jobs site, FBIJobs.gov, claiming to have stolen 2-3 terabytes of data including personal and health information of all current and former FBI employees. Last week, Dutch police arrested a 24-year-old Amsterdam man in the same investigation.
Dutch police and the FBI both declined to name the Amsterdam suspect, though independent reports point to Pepijn van der Stap, a convicted hacker on supervised release. The FBI says the man it arrested took part in hacking more than 140 organizations and collected at least $70 million in extortion payments. Krebs reported that Khader apparently tried to pin the FBI hack on van der Stap, planting a defacement image of Umbreon, van der Stap's old nickname. Patel says more arrests are "on the table."
Source: SecurityWeek
Saif al-Din Khader, known as "Rey" and believed to lead the ShinyHunters extortion group, has been arrested in Jordan and is reportedly cooperating with the FBI to identify other members. Jordan confirmed the arrest without naming him — the identification comes from Reuters sources, who place the detention on September 29. The FBI has declined to comment on any arrest in Jordan.
Khader, a teenager from Amman, is also linked to the Scattered Lapsus$ Hunters group, where Brian Krebs placed him as a key member when he first named him in November 2025. Some reporting calls him ShinyHunters' leader; most call him a suspected member. Charges and extradition haven't been disclosed.
The arrest follows ShinyHunters hacking and defacing the FBI's jobs site, FBIJobs.gov, claiming to have stolen 2-3 terabytes of data including personal and health information of all current and former FBI employees. Last week, Dutch police arrested a 24-year-old Amsterdam man in the same investigation.
Dutch police and the FBI both declined to name the Amsterdam suspect, though independent reports point to Pepijn van der Stap, a convicted hacker on supervised release. The FBI says the man it arrested took part in hacking more than 140 organizations and collected at least $70 million in extortion payments. Krebs reported that Khader apparently tried to pin the FBI hack on van der Stap, planting a defacement image of Umbreon, van der Stap's old nickname. Patel says more arrests are "on the table."
Source: SecurityWeek
Citrix has pushed emergency patches for a zero-day vulnerability in NetScaler ADC and Gateway appliances that attackers are already exploiting. Tracked as CVE-2026-88779 with a CVSS 4.0 score of 8.7, the memory overflow flaw hits systems configured as SAML service providers or identity providers, triggering denial of service through repeated crashes. No credentials or user interaction are needed to exploit it — just network access, and attack complexity is low.
Citrix confirmed targeted attacks and says the impact is availability only, with no sign of data theft. Its CVSS vector agrees, rating confidentiality and integrity impact at none. But the question isn't closed. Administrators logged authentication requests carrying shell commands, Kevin Beaumont saw a malware binary running on a patched honeypot, and watchTowr reproduced the flaw within hours. Nobody has confirmed code execution, and nobody has ruled it out.
Either way, the clock is running. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 4 and gave federal agencies until October 7 to fix it, with forensic triage required under BOD 26-04 to establish whether an appliance was hit before the patch went on. To find out if you're in scope, check the configuration for add authentication samlAction or add authentication samlIdPProfile — either entry meets the precondition.
Administrators who patched for the two earlier NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, must upgrade again. Go to 14.1-73.41 or 13.1-64.28 on the standard branches, 14.1-73.41 FIPS for FIPS appliances, or 13.1-37.282 for 13.1 FIPS and NDcPP. Citrix-managed cloud services are covered already. Global Deny Lists buy time; patching ends it.
Source: Cyber Security News
Citrix has pushed emergency patches for a zero-day vulnerability in NetScaler ADC and Gateway appliances that attackers are already exploiting. Tracked as CVE-2026-88779 with a CVSS 4.0 score of 8.7, the memory overflow flaw hits systems configured as SAML service providers or identity providers, triggering denial of service through repeated crashes. No credentials or user interaction are needed to exploit it — just network access, and attack complexity is low.
Citrix confirmed targeted attacks and says the impact is availability only, with no sign of data theft. Its CVSS vector agrees, rating confidentiality and integrity impact at none. But the question isn't closed. Administrators logged authentication requests carrying shell commands, Kevin Beaumont saw a malware binary running on a patched honeypot, and watchTowr reproduced the flaw within hours. Nobody has confirmed code execution, and nobody has ruled it out.
Either way, the clock is running. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 4 and gave federal agencies until October 7 to fix it, with forensic triage required under BOD 26-04 to establish whether an appliance was hit before the patch went on. To find out if you're in scope, check the configuration for add authentication samlAction or add authentication samlIdPProfile — either entry meets the precondition.
Administrators who patched for the two earlier NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, must upgrade again. Go to 14.1-73.41 or 13.1-64.28 on the standard branches, 14.1-73.41 FIPS for FIPS appliances, or 13.1-37.282 for 13.1 FIPS and NDcPP. Citrix-managed cloud services are covered already. Global Deny Lists buy time; patching ends it.
Source: Cyber Security News
GitLab has pushed urgent security updates to fix a critical vulnerability in its AI Gateway component, tracked as CVE-2026-90970 with a near-perfect CVSS 3.1 score of 9.9. The flaw lets authenticated users with Duo Agent Platform access submit crafted flow configurations that break out of the prompt template sandbox and execute arbitrary commands on the gateway server. Security researcher invisiblemeerkat reported it.
Affected builds run from 18.1.6 up to 19.2.4, plus 19.3 before 19.3.2 and 19.4 before 19.4.1 — and those three releases are the fixes, available now. Note that's the gateway's own version, not your GitLab instance's, so check the deployment itself before deciding you're clear.
Most customers don't have to. GitLab.com, Dedicated, and self-managed instances pointed at a GitLab-hosted gateway are already covered. Only operators running their own AI Gateway must upgrade manually — immediately. GitLab hasn't reported any exploitation, but the attack needs low complexity and no user interaction at all, so the bar is a valid Duo-enabled account and nothing more.
Source: Cybersecurity News
GitLab has pushed urgent security updates to fix a critical vulnerability in its AI Gateway component, tracked as CVE-2026-90970 with a near-perfect CVSS 3.1 score of 9.9. The flaw lets authenticated users with Duo Agent Platform access submit crafted flow configurations that break out of the prompt template sandbox and execute arbitrary commands on the gateway server. Security researcher invisiblemeerkat reported it.
Affected builds run from 18.1.6 up to 19.2.4, plus 19.3 before 19.3.2 and 19.4 before 19.4.1 — and those three releases are the fixes, available now. Note that's the gateway's own version, not your GitLab instance's, so check the deployment itself before deciding you're clear.
Most customers don't have to. GitLab.com, Dedicated, and self-managed instances pointed at a GitLab-hosted gateway are already covered. Only operators running their own AI Gateway must upgrade manually — immediately. GitLab hasn't reported any exploitation, but the attack needs low complexity and no user interaction at all, so the bar is a valid Duo-enabled account and nothing more.
Source: Cybersecurity News
Researchers at Bay Area Labs have uncovered a critical vulnerability (CVE-2026-18397, scored 9.4 by Thales on the CVSS 4.0 scale) in SConnect, a browser-based authentication tool with more than a million Chrome installs, used to access SWIFT banking networks and major government systems in Qatar and Sweden. The flaw lets attackers execute remote code on victims' machines via a malicious webpage, or any iframe loaded onto one — no interaction required beyond a visit, and 6–10 seconds in the researchers' testing.
The bug stems from a homegrown cryptographic check. SConnect verifies a site's RSA signature inside a block of memory it never clears first, so whatever was there before stays put. Feed it an oversized signature and the calculation fails without writing anything — but the check reads that block anyway. That means an attacker who sprays the right bytes into memory passes as a Thales-approved site, and an approved site can tell SConnect to load a plugin.
Pulling that off isn't easy: AI-assisted exploitation made it work roughly 18% of the time. But failed attempts raise nothing the user can see, so an attacker just keeps firing until one lands. Thales patched the Chrome and Apple versions on August 7, then pulled SConnect from Edge on September 13 — 89 000 users still had it, and the researchers can't confirm those copies were removed — and published the CVE on October 1.
SWIFT replaced SConnect with Web Connect in September 2025 and retired SConnect in September this year. Even so, the researchers expect SConnect is still the fallback wherever Web Connect isn't configured, which is why many SWIFT users may still be running it. Update to host 2.16.1.0 and extension 2.16.1.1, then switch to Web Connect.
Source: Dark Reading
Researchers at Bay Area Labs have uncovered a critical vulnerability (CVE-2026-18397, scored 9.4 by Thales on the CVSS 4.0 scale) in SConnect, a browser-based authentication tool with more than a million Chrome installs, used to access SWIFT banking networks and major government systems in Qatar and Sweden. The flaw lets attackers execute remote code on victims' machines via a malicious webpage, or any iframe loaded onto one — no interaction required beyond a visit, and 6–10 seconds in the researchers' testing.
The bug stems from a homegrown cryptographic check. SConnect verifies a site's RSA signature inside a block of memory it never clears first, so whatever was there before stays put. Feed it an oversized signature and the calculation fails without writing anything — but the check reads that block anyway. That means an attacker who sprays the right bytes into memory passes as a Thales-approved site, and an approved site can tell SConnect to load a plugin.
Pulling that off isn't easy: AI-assisted exploitation made it work roughly 18% of the time. But failed attempts raise nothing the user can see, so an attacker just keeps firing until one lands. Thales patched the Chrome and Apple versions on August 7, then pulled SConnect from Edge on September 13 — 89 000 users still had it, and the researchers can't confirm those copies were removed — and published the CVE on October 1.
SWIFT replaced SConnect with Web Connect in September 2025 and retired SConnect in September this year. Even so, the researchers expect SConnect is still the fallback wherever Web Connect isn't configured, which is why many SWIFT users may still be running it. Update to host 2.16.1.0 and extension 2.16.1.1, then switch to Web Connect.
Source: Dark Reading
Symantec reports that the China-nexus group behind Warlock ransomware is still breaking into organizations through Microsoft SharePoint, a year after that route made its name. The group goes by Longlegs at Symantec and Storm-2603 at Microsoft. In the two months to October 1, it hit at least four organizations across Europe, Africa, and Latin America: a water utility, a telecom provider, a regional government body, and a university.
In one intrusion against a critical infrastructure operator, the attackers pushed an AV and EDR killing tool to at least 40 hosts inside about two hours, then ran Warlock on at least 33 of them. They staged the payload in the domain's SYSVOL share, so routine domain replication carried it everywhere at once.
The way in is on-premises SharePoint Server, not the cloud version. Once inside, the group plants a webshell and steals the farm's ASP.NET machine keys, then uses them to forge a signed payload. That changes what cleanup means: patching alone leaves stolen keys valid, so they have to be rotated too.
Security tools go down via a signed but vulnerable driver — K7RKScan in other recent Longlegs intrusions, unidentified in this one. For remote access the group installs Visual Studio Code's tunnel service, so the traffic reads like a developer's. Unpatched SharePoint servers remain the primary entry point. A year on, that still works.
Source: SecurityWeek
Symantec reports that the China-nexus group behind Warlock ransomware is still breaking into organizations through Microsoft SharePoint, a year after that route made its name. The group goes by Longlegs at Symantec and Storm-2603 at Microsoft. In the two months to October 1, it hit at least four organizations across Europe, Africa, and Latin America: a water utility, a telecom provider, a regional government body, and a university.
In one intrusion against a critical infrastructure operator, the attackers pushed an AV and EDR killing tool to at least 40 hosts inside about two hours, then ran Warlock on at least 33 of them. They staged the payload in the domain's SYSVOL share, so routine domain replication carried it everywhere at once.
The way in is on-premises SharePoint Server, not the cloud version. Once inside, the group plants a webshell and steals the farm's ASP.NET machine keys, then uses them to forge a signed payload. That changes what cleanup means: patching alone leaves stolen keys valid, so they have to be rotated too.
Security tools go down via a signed but vulnerable driver — K7RKScan in other recent Longlegs intrusions, unidentified in this one. For remote access the group installs Visual Studio Code's tunnel service, so the traffic reads like a developer's. Unpatched SharePoint servers remain the primary entry point. A year on, that still works.
Source: SecurityWeek
Fortinet is warning customers about a critical zero-day in FortiMail that attackers are already exploiting. Tracked as CVE-2026-104286 with a CVSS score of 9.8 (Critical), the flaw lets unauthenticated attackers write arbitrary files to affected devices using crafted HTTP or HTTPS requests — no login required. Fortinet rates the impact as code execution.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 1, the same day Fortinet published its advisory, and gave federal civilian agencies until October 4 to act. Four branches are affected: 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9. None has a fixed build yet.
Fortinet lists 8.0.2, 7.6.7, and 7.4.9 as upcoming releases, and tells 7.2 users to move to branch 7.4 or later. Every 7.4 build shipped so far sits inside the affected range, so that route only helps once 7.4.9 arrives.
Until then, disable IBE support from the CLI, or cut the management interface off the internet. Then go hunting. Fortinet published hashes for seven added or modified files, including a planted ld.so.preload, two attacker IPs (79.141.169.187 and 45.129.0.192), and a log entry adding an archive account named archive234 that reports to the first. The IPs alone won't tell you whether a box is already compromised.
Source: Cybersecurity News
Fortinet is warning customers about a critical zero-day in FortiMail that attackers are already exploiting. Tracked as CVE-2026-104286 with a CVSS score of 9.8 (Critical), the flaw lets unauthenticated attackers write arbitrary files to affected devices using crafted HTTP or HTTPS requests — no login required. Fortinet rates the impact as code execution.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 1, the same day Fortinet published its advisory, and gave federal civilian agencies until October 4 to act. Four branches are affected: 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9. None has a fixed build yet.
Fortinet lists 8.0.2, 7.6.7, and 7.4.9 as upcoming releases, and tells 7.2 users to move to branch 7.4 or later. Every 7.4 build shipped so far sits inside the affected range, so that route only helps once 7.4.9 arrives.
Until then, disable IBE support from the CLI, or cut the management interface off the internet. Then go hunting. Fortinet published hashes for seven added or modified files, including a planted ld.so.preload, two attacker IPs (79.141.169.187 and 45.129.0.192), and a log entry adding an archive account named archive234 that reports to the first. The IPs alone won't tell you whether a box is already compromised.
Source: Cybersecurity News
The Dutch Institute for Vulnerability Disclosure was hacked on September 21 in what it calls an agentic AI-powered attack, a first for the organization. Attackers chained two Zammad zero-days — CVE-2026-102489, a session hijack giving remote code execution as the zammad user, and CVE-2026-102490, a local escalation to root — moving from one to the other in seconds.
The two flaws cover different ground. CVE-2026-102489 affects Zammad 6.3.0 through 6.5.4, and sits in 7.0.0 to 7.1.3 without being exploitable there. CVE-2026-102490 reaches every release from v1.5.0 to v7.1.0-alpha, so moving to version 7 closes the first flaw and not the second. DIVD still advises upgrading or taking instances offline.
Network segmentation stopped the attackers going deeper, though they pivoted to other services and exfiltrated data — The Register reports email addresses were taken. DIVD notes the agent left visible traces of its work, and warns that a more careful attacker using the same approach would be far harder to spot.
Source: SecurityWeek
The Dutch Institute for Vulnerability Disclosure was hacked on September 21 in what it calls an agentic AI-powered attack, a first for the organization. Attackers chained two Zammad zero-days — CVE-2026-102489, a session hijack giving remote code execution as the zammad user, and CVE-2026-102490, a local escalation to root — moving from one to the other in seconds.
The two flaws cover different ground. CVE-2026-102489 affects Zammad 6.3.0 through 6.5.4, and sits in 7.0.0 to 7.1.3 without being exploitable there. CVE-2026-102490 reaches every release from v1.5.0 to v7.1.0-alpha, so moving to version 7 closes the first flaw and not the second. DIVD still advises upgrading or taking instances offline.
Network segmentation stopped the attackers going deeper, though they pivoted to other services and exfiltrated data — The Register reports email addresses were taken. DIVD notes the agent left visible traces of its work, and warns that a more careful attacker using the same approach would be far harder to spot.
Source: SecurityWeek
The Defense Manpower Data Center began notifying roughly 3 million people on September 18 that their personal data was exposed — 2.76 million living and 294,000 deceased. The exposed information includes full Social Security numbers, names, dates of birth, contact and demographic details, and military occupational specialties.
An unauthorized party reached an unencrypted file-sharing system between October 2025 and July 16, 2026, when DMDC found the vulnerability and patched it. The agency holds at least 60 million records covering military and civilian personnel, contractors, retirees, veterans, and their families.
DMDC says there is no indication the information has been misused, and no group has claimed responsibility — though the department declined to say who accessed the data or whether the breach was deliberate. Affected people are being offered 12 months of credit monitoring and identity restoration through IDX.
Source: SecurityWeek
The Defense Manpower Data Center began notifying roughly 3 million people on September 18 that their personal data was exposed — 2.76 million living and 294,000 deceased. The exposed information includes full Social Security numbers, names, dates of birth, contact and demographic details, and military occupational specialties.
An unauthorized party reached an unencrypted file-sharing system between October 2025 and July 16, 2026, when DMDC found the vulnerability and patched it. The agency holds at least 60 million records covering military and civilian personnel, contractors, retirees, veterans, and their families.
DMDC says there is no indication the information has been misused, and no group has claimed responsibility — though the department declined to say who accessed the data or whether the breach was deliberate. Affected people are being offered 12 months of credit monitoring and identity restoration through IDX.
Source: SecurityWeek
