Mandiant and other security firms say attackers began exploiting an unpatched Citrix NetScaler flaw, tracked as CVE-2026-88772, in early September to install custom web shells and tunneling malware, gain root access, steal credentials, and move into internal networks. Victims span government, financial services, education, legal, and professional services organizations in North America and Europe. Citrix disclosed two related zero-days, CVE-2026-88771 and CVE-2026-88772, on Sunday and released patches after researchers including GreyNoise and watchTowr flagged active exploitation.
bleepingcomputer.com
· 2026-09-29
Citrix disclosed CVE-2026-88771 and CVE-2026-88772, both scoring 9.5 on the CVSS scale, affecting default configurations of its NetScaler ADC and Gateway products. Citrix confirmed exploits against unmitigated deployments and urged customers to patch immediately, though public warnings of attacks had circulated online since September 25, days before the formal disclosure.
darkreading.com
· 2026-09-29
Apple has issued security updates for CVE-2026-20700, an out-of-bounds write flaw in its CoreGraphics framework that was used in what the company calls an 'extremely sophisticated' attack against specific individuals. The bug, found by Meta Product Security, affects iOS, iPadOS, macOS, watchOS and tvOS, and could let a malicious file trigger arbitrary code execution. Fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.
bleepingcomputer.com
· 2026-09-29
9to5Mac's latest Security Bite roundup finds that ClickFix, a technique tricking victims into pasting Terminal commands themselves, has become the default delivery method for nearly all new Mac stealer malware since the Q1 2026 review. Researchers at Group-IB, Huntress, and Kaspersky have each identified new malware families—including ClickLock, a Go-based stealer, and a MacSync variant disguised as Homebrew—all using this same social-engineering approach. The report notes attackers are adding persistence, backdoors, and infrastructure hidden inside Apple's own services.
9to5mac.com
· 2026-09-28
CISA has directed federal agencies to fix two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, that Citrix confirmed are being actively exploited in zero-day attacks. Both bugs let unauthenticated attackers achieve remote code execution, with the first hitting default configurations and the second requiring DTLS, which is on by default for VPN virtual servers. Citrix has issued patches and shared indicators of compromise, after agencies like the Dutch NCSC had already been privately warning organizations to shut down affected appliances.
bleepingcomputer.com
· 2026-09-28
Citrix administrators report being privately contacted by IT suppliers, law enforcement, and cybersecurity agencies warning of two unpatched NetScaler remote code execution vulnerabilities being exploited in the wild. Security firm watchTowr confirmed the flaws are distinct from CVE-2026-19490 and CVE-2026-19489 disclosed in August, and said patches are expected next week.
bleepingcomputer.com
· 2026-09-27
Secure file-sharing vendor Kiteworks emailed customers globally, urging a six-hour server shutdown this weekend after receiving threat intelligence from law enforcement about a possible imminent attack. The company confirmed to BleepingComputer that federal intelligence authorities warned a threat actor may target some customer systems, and recommended shutting down even systems not internet-facing. Kiteworks said it has no evidence of any actual compromise and described the move as precautionary.
bleepingcomputer.com
· 2026-09-25
Databricks has acquired Row Zero, an early-stage startup whose cloud spreadsheet tool scales beyond 1 million live rows. Databricks plans to combine Row Zero with its Genie AI agent so users can query and manipulate secured data using familiar spreadsheet formulas rather than exporting it elsewhere. Terms were not disclosed; Row Zero had raised $10 million in May 2025 at a $40 million valuation, per PitchBook.
techcrunch.com
· 2026-09-24
Amazon's chief sustainability officer Kara Hurst said at an Axios event that the company does not yet know exactly how it will reach its target of net-zero carbon emissions by 2040. She said Amazon remains committed to the goal, citing its position as one of the largest corporate buyers of clean energy with 42 gigawatts in its portfolio, while acknowledging emissions reduction requires cooperation from suppliers and governments across many sectors.
techcrunch.com
· 2026-09-23
Hacking group ShinyHunters says it stole terabytes of sensitive data on FBI employees and job applicants, exploiting a zero-day flaw in Oracle's PeopleSoft software to breach Amazon Web Services' GovCloud. A sample reviewed by Reuters and 404 Media reportedly includes names, addresses, birthdates and Social Security numbers for about 5,000 employees, and the group also claimed responsibility for briefly hijacking the FBI's website. The FBI confirmed it is investigating a claimed compromise of the FBIJobs.gov portal and possible exposure of employee personal information.
engadget.com
· 2026-09-23
Security researcher Patrick Wardle disclosed a zero-day vulnerability in Meta's Muse AI agent that could let attackers redirect users' voice dictations and access tokens to a malicious server instead of Meta's own. David Singleton, head of Meta's Superintelligence Labs, confirmed the company has issued a patch, though he and Wardle disagree on whether the exploit requires prior malware on a user's machine. Meta says the MacOS Muse app has been downloaded over half a million times in its first week.
cnet.com
· 2026-09-23
Security researchers found a zero-day vulnerability in Meta's newly released Muse AI assistant for macOS that lets any locally installed app or terminal command access the token authenticating a user's Muse account, along with a long list of undocumented settings. Amazon has begun blocking Muse on its site, and the flaw undermines macOS permission protections that Apple built to prevent unauthorized apps from reaching sensitive resources like the microphone, camera, and file system.
wired.com
· 2026-09-23
GoKawiil