Vulnerabilities (2)

A fresh zero-day vulnerability is hitting Citrix NetScaler appliances — even ones administrators had just patched days earlier. Tracked as CVE-2026-88779, the high-severity memory overflow flaw affects NetScaler ADC and Gateway instances configured as SAML SP or IdP, causing Denial of Service through repeated crashes. Those earlier patches covered CVE-2026-88771 and CVE-2026-88772, fixed the week before.

Security researcher Kevin Beaumont, who named this one PitScaler 2, confirmed seeing exploitation attempts against patched honeypots, and reported one honeypot running a downloaded malware binary. Admins reported reboots alongside logs showing shell commands buried in username fields. One admin who retrieved the script said it tries to plant web shells, survive reboots and upload configuration and backups — while cautioning there was no proof it ever ran.

Security firm watchTowr has since reproduced the flaw and found it can only crash systems, with no route to code execution. The firm suspects attackers crashed machines deliberately to make exploitation of CVE-2026-88771 faster. Citrix says the same thing from its side: service availability is affected, customer data integrity is not.

CISA added the flaw to its KEV catalog on October 4, giving federal agencies until October 7 to remediate. It's the sixth exploited NetScaler vulnerability CISA has cataloged in 2026.

Source: SecurityWeek

Citrix has pushed emergency patches for a zero-day vulnerability in NetScaler ADC and Gateway appliances that attackers are already exploiting. Tracked as CVE-2026-88779 with a CVSS 4.0 score of 8.7, the memory overflow flaw hits systems configured as SAML service providers or identity providers, triggering denial of service through repeated crashes. No credentials or user interaction are needed to exploit it — just network access, and attack complexity is low.

Citrix confirmed targeted attacks and says the impact is availability only, with no sign of data theft. Its CVSS vector agrees, rating confidentiality and integrity impact at none. But the question isn't closed. Administrators logged authentication requests carrying shell commands, Kevin Beaumont saw a malware binary running on a patched honeypot, and watchTowr reproduced the flaw within hours. Nobody has confirmed code execution, and nobody has ruled it out.

Either way, the clock is running. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 4 and gave federal agencies until October 7 to fix it, with forensic triage required under BOD 26-04 to establish whether an appliance was hit before the patch went on. To find out if you're in scope, check the configuration for add authentication samlAction or add authentication samlIdPProfile — either entry meets the precondition.

Administrators who patched for the two earlier NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, must upgrade again. Go to 14.1-73.41 or 13.1-64.28 on the standard branches, 14.1-73.41 FIPS for FIPS appliances, or 13.1-37.282 for 13.1 FIPS and NDcPP. Citrix-managed cloud services are covered already. Global Deny Lists buy time; patching ends it.

Source: Cyber Security News

GitLab has pushed urgent security updates to fix a critical vulnerability in its AI Gateway component, tracked as CVE-2026-90970 with a near-perfect CVSS 3.1 score of 9.9. The flaw lets authenticated users with Duo Agent Platform access submit crafted flow configurations that break out of the prompt template sandbox and execute arbitrary commands on the gateway server. Security researcher invisiblemeerkat reported it.

Affected builds run from 18.1.6 up to 19.2.4, plus 19.3 before 19.3.2 and 19.4 before 19.4.1 — and those three releases are the fixes, available now. Note that's the gateway's own version, not your GitLab instance's, so check the deployment itself before deciding you're clear.

Most customers don't have to. GitLab.com, Dedicated, and self-managed instances pointed at a GitLab-hosted gateway are already covered. Only operators running their own AI Gateway must upgrade manually — immediately. GitLab hasn't reported any exploitation, but the attack needs low complexity and no user interaction at all, so the bar is a valid Duo-enabled account and nothing more.

Source: Cybersecurity News

Researchers at Bay Area Labs have uncovered a critical vulnerability (CVE-2026-18397, scored 9.4 by Thales on the CVSS 4.0 scale) in SConnect, a browser-based authentication tool with more than a million Chrome installs, used to access SWIFT banking networks and major government systems in Qatar and Sweden. The flaw lets attackers execute remote code on victims' machines via a malicious webpage, or any iframe loaded onto one — no interaction required beyond a visit, and 6–10 seconds in the researchers' testing.

The bug stems from a homegrown cryptographic check. SConnect verifies a site's RSA signature inside a block of memory it never clears first, so whatever was there before stays put. Feed it an oversized signature and the calculation fails without writing anything — but the check reads that block anyway. That means an attacker who sprays the right bytes into memory passes as a Thales-approved site, and an approved site can tell SConnect to load a plugin.

Pulling that off isn't easy: AI-assisted exploitation made it work roughly 18% of the time. But failed attempts raise nothing the user can see, so an attacker just keeps firing until one lands. Thales patched the Chrome and Apple versions on August 7, then pulled SConnect from Edge on September 13 — 89 000 users still had it, and the researchers can't confirm those copies were removed — and published the CVE on October 1.

SWIFT replaced SConnect with Web Connect in September 2025 and retired SConnect in September this year. Even so, the researchers expect SConnect is still the fallback wherever Web Connect isn't configured, which is why many SWIFT users may still be running it. Update to host 2.16.1.0 and extension 2.16.1.1, then switch to Web Connect.

Source: Dark Reading

Fortinet is warning customers about a critical zero-day in FortiMail that attackers are already exploiting. Tracked as CVE-2026-104286 with a CVSS score of 9.8 (Critical), the flaw lets unauthenticated attackers write arbitrary files to affected devices using crafted HTTP or HTTPS requests — no login required. Fortinet rates the impact as code execution.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 1, the same day Fortinet published its advisory, and gave federal civilian agencies until October 4 to act. Four branches are affected: 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9. None has a fixed build yet.

Fortinet lists 8.0.2, 7.6.7, and 7.4.9 as upcoming releases, and tells 7.2 users to move to branch 7.4 or later. Every 7.4 build shipped so far sits inside the affected range, so that route only helps once 7.4.9 arrives.

Until then, disable IBE support from the CLI, or cut the management interface off the internet. Then go hunting. Fortinet published hashes for seven added or modified files, including a planted ld.so.preload, two attacker IPs (79.141.169.187 and 45.129.0.192), and a log entry adding an archive account named archive234 that reports to the first. The IPs alone won't tell you whether a box is already compromised.

Source: Cybersecurity News

The Dutch Institute for Vulnerability Disclosure was hacked on September 21 in what it calls an agentic AI-powered attack, a first for the organization. Attackers chained two Zammad zero-days — CVE-2026-102489, a session hijack giving remote code execution as the zammad user, and CVE-2026-102490, a local escalation to root — moving from one to the other in seconds.

The two flaws cover different ground. CVE-2026-102489 affects Zammad 6.3.0 through 6.5.4, and sits in 7.0.0 to 7.1.3 without being exploitable there. CVE-2026-102490 reaches every release from v1.5.0 to v7.1.0-alpha, so moving to version 7 closes the first flaw and not the second. DIVD still advises upgrading or taking instances offline.

Network segmentation stopped the attackers going deeper, though they pivoted to other services and exfiltrated data — The Register reports email addresses were taken. DIVD notes the agent left visible traces of its work, and warns that a more careful attacker using the same approach would be far harder to spot.

Source: SecurityWeek

Apple shipped emergency updates on September 28, 2026 to fix CVE-2026-86950, an out-of-bounds write in CoreGraphics that lets a maliciously crafted file run arbitrary code on the device. The fixes landed in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, covering iPhone 11 and later along with iPad models back to the third-generation iPad Air.

Apple says the issue "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Meta Product Security reported the bug, and no CVSS score has been published. Update through Settings > General > Software Update.

Source: Cybersecurity News

Citrix has patched two actively exploited flaws in NetScaler ADC and NetScaler Gateway, both rated CVSS 9.5 on the v4.0 scale and both exploitable without authentication. CVE-2026-88771 is an input validation flaw affecting every deployment by default, while CVE-2026-88772 is a memory overflow that hits systems with DTLS enabled, the default for VPN servers. Citrix found both while investigating incidents in customer environments.

CISA added both to its Known Exploited Vulnerabilities catalog on September 27, the day the patches shipped. Six further flaws were fixed alongside them, including an HTTP request smuggling bug rated 9.3. The fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 FIPS/NDcPP. Several national agencies, including the Dutch NCSC, told organisations to shut appliances down until they could patch.

Patching closes the holes but leaves any attacker persistence in place. Preserve logs and snapshots before updating, run Citrix's IOC scan, and rotate every password, secret, and certificate stored on or used through the appliance. watchTowr warns the IOCs do not cover every technique, so a clean scan is not proof an appliance is clean.

Source: Cyber Security News

CISA added CVE-2026-5430 to its Known Exploited Vulnerabilities catalog on September 24, with a September 27 federal deadline that has now passed. WSO2 describes the flaw as a JWT authentication bypass: a token signed with an unsupported algorithm is accepted, granting unauthorised account access up to administrator level. It is rated CVSS 10.0, or 9.8 on single-tenant deployments, and needs no credentials.

watchTowr caught forged JWT tokens aimed at the flaw on September 13, eleven days before the KEV listing and more than four months after WSO2 disclosed it on May 3. Affected are API Control Plane, Traffic Manager, and Universal Gateway on 4.5.0 and 4.6.0, plus API Manager from 4.1.0 through 4.6.0. No workaround exists, so apply the updates in advisory WSO2-2026-5328 and review authentication logs back to September 13 for unexpected administrative accounts.

Source: Cybersecurity News

A WordPress core vulnerability, CVE-2026-87902, came under active attack within hours of its patch. Patchstack saw exploitation begin on September 22, 2026, the same day WordPress 7.1.2 shipped, quickly escalating from reconnaissance to attempts at remote code execution. The flaw affects versions 4.7.0 through 7.1.1 and carries a CVSS 4.0 score of 9.2 (Critical). No account or user interaction is needed.

Attackers exploit a path traversal bug in WordPress's page-template function to load local PHP files, then abuse PEAR's pearcmd.php to write malicious scripts to server temp directories. The inclusion needs an active theme with a top-level directory starting with "page-". Code execution also needs PEAR with PHP's register_argc_argv setting on, which is the default in official PHP Docker images and cPanel below PHP 8.5.

Automated scanning tools are now accelerating attacks at scale. Update immediately to WordPress 7.1.2 or your branch's patched release. Fixes run from 7.0.6, 6.9.9, and 6.8.10 back to 4.7.37.

If you can't patch yet, block traversal sequences in the pagename parameter, since no real page slug contains one. Unexpected PHP files in /tmp or /var/tmp mean an attempt succeeded, so treat the host as compromised.

Source: Cybersecurity News