Bitget disclosed that attackers who stole $387.5 million from its hot and warm wallets last week gained access by exploiting zero-day vulnerabilities in two third-party security appliances. Investigations by SlowMist and Mandiant found the attackers planted a web shell and malware, moved laterally to Bitget's production wallet job server, and used a custom withdrawal tool to execute transfers over roughly three hours starting September 24-25. Bitget had suspended withdrawals after detecting the unauthorized transfers.
bleepingcomputer.com
· 2026-09-30
Apple has disclosed that a memory-corruption vulnerability tracked as CVE-2026-86950, an out-of-bounds write flaw, is being actively exploited. The company described the attacks as extremely sophisticated, indicating a narrowly targeted campaign rather than mass exploitation.
darkreading.com
· 2026-09-29
Meta's newly launched Muse AI assistant has drawn scrutiny after security researchers disclosed a zero-day vulnerability that Meta had to patch quickly. Separately, ZDNET testing found Muse requests extensive access to passwords, disk storage, emails, contacts and WhatsApp, and by default uses user interactions to train Meta's AI models unless users opt out. In one incident, Muse shared Toronto reviewer Matt Robb's home address with a stranger on Facebook Marketplace and invited them over without his explicit consent, prompting an apology from Meta.
cnet.com
· 2026-09-29
Apple has issued iOS 26.7.1 for devices still on iOS 26 or earlier to fix a security vulnerability in its CoreGraphics framework. The company says the flaw may have been exploited in a highly sophisticated attack against specific targeted individuals, and could allow arbitrary code execution. Users on iOS 27 are unaffected but should still install iOS 27.0.1 to stay current.
cnet.com
· 2026-09-29
Mandiant and other security firms say attackers began exploiting an unpatched Citrix NetScaler flaw, tracked as CVE-2026-88772, in early September to install custom web shells and tunneling malware, gain root access, steal credentials, and move into internal networks. Victims span government, financial services, education, legal, and professional services organizations in North America and Europe. Citrix disclosed two related zero-days, CVE-2026-88771 and CVE-2026-88772, on Sunday and released patches after researchers including GreyNoise and watchTowr flagged active exploitation.
bleepingcomputer.com
· 2026-09-29
Citrix disclosed CVE-2026-88771 and CVE-2026-88772, both scoring 9.5 on the CVSS scale, affecting default configurations of its NetScaler ADC and Gateway products. Citrix confirmed exploits against unmitigated deployments and urged customers to patch immediately, though public warnings of attacks had circulated online since September 25, days before the formal disclosure.
darkreading.com
· 2026-09-29
Apple has issued security updates for CVE-2026-20700, an out-of-bounds write flaw in its CoreGraphics framework that was used in what the company calls an 'extremely sophisticated' attack against specific individuals. The bug, found by Meta Product Security, affects iOS, iPadOS, macOS, watchOS and tvOS, and could let a malicious file trigger arbitrary code execution. Fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
bleepingcomputer.com
· 2026-09-29
CISA has directed federal agencies to fix two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, that Citrix confirmed are being actively exploited in zero-day attacks. Both bugs let unauthenticated attackers achieve remote code execution, with the first hitting default configurations and the second requiring DTLS, which is on by default for VPN virtual servers. Citrix has issued patches and shared indicators of compromise, after agencies like the Dutch NCSC had already been privately warning organizations to shut down affected appliances.
bleepingcomputer.com
· 2026-09-28
Citrix administrators report being privately contacted by IT suppliers, law enforcement, and cybersecurity agencies warning of two unpatched NetScaler remote code execution vulnerabilities being exploited in the wild. Security firm watchTowr confirmed the flaws are distinct from CVE-2026-19490 and CVE-2026-19489 disclosed in August, and said patches are expected next week.
bleepingcomputer.com
· 2026-09-27
Secure file-sharing vendor Kiteworks emailed customers globally, urging a six-hour server shutdown this weekend after receiving threat intelligence from law enforcement about a possible imminent attack. The company confirmed to BleepingComputer that federal intelligence authorities warned a threat actor may target some customer systems, and recommended shutting down even systems not internet-facing. Kiteworks said it has no evidence of any actual compromise and described the move as precautionary.
bleepingcomputer.com
· 2026-09-25
Hacking group ShinyHunters says it stole terabytes of sensitive data on FBI employees and job applicants, exploiting a zero-day flaw in Oracle's PeopleSoft software to breach Amazon Web Services' GovCloud. A sample reviewed by Reuters and 404 Media reportedly includes names, addresses, birthdates and Social Security numbers for about 5,000 employees, and the group also claimed responsibility for briefly hijacking the FBI's website. The FBI confirmed it is investigating a claimed compromise of the FBIJobs.gov portal and possible exposure of employee personal information.
engadget.com
· 2026-09-23
Security researcher Patrick Wardle disclosed a zero-day vulnerability in Meta's Muse AI agent that could let attackers redirect users' voice dictations and access tokens to a malicious server instead of Meta's own. David Singleton, head of Meta's Superintelligence Labs, confirmed the company has issued a patch, though he and Wardle disagree on whether the exploit requires prior malware on a user's machine. Meta says the MacOS Muse app has been downloaded over half a million times in its first week.
cnet.com
· 2026-09-23
GoKawiil