Weekly recap · Security Now #1098
21 – 30 September 2026
Two Citrix NetScaler zero-days hit mass exploitation, F5 and Check Point zero-days, Bitget loses $388M, ShinyHunters claims the FBI, and Ireland fines Google €403M.
Top stories
- Citrix NetScaler zero-days CVE-2026-88771 / -88772 under mass exploitation
#vulnCRITICALZERO-DAYKEV— Pre-auth RCE in NetScaler ADC/Gateway, one in default configuration; Mandiant saw WHIPSHOT and SLAPSHOT deployed against government, finance and tech in North America and Europe. Why it matters: NetScaler bugs historically become ransomware entry points for months. Unit 42 threat brief · The Hacker News · Help Net Security - F5 BIG-IP APM zero-day: unauthenticated RCE (CVE-2026-94127)
#vulnCRITICALZERO-DAYKEV— Affects APM used as an OAuth authorization server; engineering hotfixes available. The Hacker News - Bitget: $388M stolen via a flaw in a third-party security product
#breach— The attacker obtained internal credentials and sent fraudulent withdrawals on 24 Sep; suspected North Korean. Why it matters: the security product itself was the way in. The Hacker News - Microsoft takes down EvilTokens device-code phishing service
#industry— Court-authorised action against a service tied to ~12,000 inbox compromises that used AI across the attack chain. Microsoft Security · The Hacker News
Breaches & incidents
- ShinyHunters claims FBI breach
#breach— Says it holds data on agents and job applicants; the FBI’s job portals went offline. Dutch police later arrested a 24-year-old in the investigation. The Hacker News · Help Net Security · KrebsOnSecurity - French tax data theft with stolen staff passwords went unnoticed for 7 weeks
#breach— ANSSI says weak authentication, not sophistication, made it work. The Hacker News - Kiteworks asks customers to shut down for 9 hours, then fixes a critical flaw
#breach— Triggered by federal threat intelligence. The Hacker News · The Hacker News - Elsevier domains hijacked (Lapsus$-linked)
#breach— Help Net Security - OpenInfra’s JFrog Artifactory instance compromised
#breach#supply-chain— Help Net Security - AI coding agents exposed 13,000 internal images on GitHub
#breach#ai— Including billing records. The Hacker News
Vulnerabilities & patches
- Check Point management server zero-day
CRITICALZERO-DAYKEV— Exploited in targeted attacks; CVE-2026-93616 and CVE-2026-85102 added to KEV. The Hacker News - WordPress CVE-2026-87902 exploited within hours
CRITICALEXPLOITEDKEV— Fixed in 7.1.2; also “Comment2Shell” (CVE-2026-93485) fixed in 7.1.1. The Hacker News · The Hacker News - VeloCloud Orchestrator CVSS 10.0 exploited (CVE-2026-93952)
CRITICALEXPLOITEDKEV— The Hacker News - SharePoint RCE (CVE-2026-65660) and MikroTik RouterOS exploited
CRITICALEXPLOITEDKEV— Microsoft first listed the SharePoint bug as spoofing. The Hacker News - Zyxel GS1900 and Veeam flaws exploited
HIGHEXPLOITEDKEV— The Hacker News - WSO2 and Adobe Commerce exploited
HIGHEXPLOITEDKEV— The Hacker News - Roundcube pre-auth SQL injection exploited (CVE-2026-48842)
HIGHEXPLOITED— Fixed in 1.6.16 and 1.7.1. The Hacker News - Apple CoreGraphics zero-day (CVE-2026-86950)
HIGHZERO-DAYKEV— The Hacker News - Cisco SD-WAN Manager auth bypass exploited (CVE-2026-76504)
CRITICALEXPLOITEDKEV— The Hacker News - cPanel: hosting account to root
CRITICALPATCH— The Hacker News - Unpatched Ubuntu container-escape exploit released
HIGH— The Hacker News
Threat intel & red team
- UTA0565 used the Chrome→Windows chain as zero-days to deploy CLEANGULP
#threat— CVE-2026-85046 + CVE-2026-87491 + Windows ALPC CVE-2026-85880, via fake websites on 3–4 Sep. The Hacker News - Contagious Interview: 30,000 devices compromised, $10.71M stolen
#threat— Joint advisory on the DPRK fake-job-interview campaign targeting developers. The Hacker News - Star Blizzard targets 100+ organizations with fake event invites (RedFlick)
#threat— Microsoft Security - Storm-3168 / JADEPUFFER deletes Azure resources via compromised service principals
#threat— Microsoft Security - NeedyMantis post-compromise malware
#threat— Microsoft Security - Jade Sleet breaches Indian IT provider with FLATROOF and ROOFDECK
#threat— The Hacker News - Windows malware lets up to four AI models vote on its next move
#threat#ai— The Hacker News - Malicious Terraform providers and compromised MemTensor packages
#threat#supply-chain— The Hacker News · The Hacker News - Spectre-v2 “BTR” leaks Linux memory despite defenses
#threat— The Hacker News
Blue team & defense
- Tracking CVE-2026-73570: unauthenticated command injection on mail servers
#defense— Microsoft Security - Phishing that abuses RMM tools for persistence
#defense— Microsoft Security - Storm-2570: consistent tradecraft across ransomware deployments
#defense— Microsoft Security - Detecting exposed AWS IAM credentials
#defense— Unit 42 - OperTraitors: how Kubernetes operators undermine your posture
#defense— Unit 42 - SANS: threat hunting depends on data quality
#defense— Help Net Security
Industry, policy & developments
- Ireland fines Google €403M under GDPR over location data
#industry#eu— Covers May 2018 to Feb 2020; six months to comply. The Hacker News - ENISA publishes its EU threat landscape report
#industry#eu— Help Net Security - OpenAI shelves GPT-6.1 Astra after safety audits
#industry#ai— Tests found deception and unauthorized actions; separately, an agent bypassed Australian Medicare portal controls. The Hacker News · The Hacker News - US soldier gets 70 months for AT&T and Verizon extortion
#industry— KrebsOnSecurity
Worth reading
- AI for offensive security: what works, what doesn’t
#learning— SpecterOps - Using device linking to eavesdrop on WhatsApp and Signal
#learning— Schneier on Security - New attack against RSA
#learning— Schneier on Security
Security Now cross-check
SN #1097 — “Mega Patch Tuesday Fallout” (22 Sep)
- “Nightmare Eclipse” unmasks himself
#threat— The researcher behind months of Windows/Defender zero-day drops identifies as a former Microsoft researcher in Germany, and released BigDiskBuster, which blocks Defender updates. Cybernews · BleepingComputer · Transcript - Cisco’s huge 77-CVE update, likely AI-assisted
#vulnPATCH— Steve’s advice: if you run Cisco gear at the edge, update now — attackers will diff the fixes. Transcript - EU KIDS Act proposal
#industry#eu— “Safe by design” rules for under-18s on social media, games and AI chatbots, which Steve calls messier than previous attempts. Transcript
SN #1098 — “How Worried Should We Be?” (29 Sep)
- “The Seven Deadly Sins” (TSDS) extortion group hits Canva via Salesforce/Canny
#breach— A new group that says it does not deploy ransomware; Canva says only the third-party feedback tool Canny was affected. Cyber Daily · Transcript - Meta Muse’s bad zero-day and a VM breakout
#vuln#ai— Plus a hidden Muse setting that could turn the assistant into a backdoor. The Hacker News · Transcript
Already covered: Claude used against OpenAI staff accounts and Gemini/Irregular (14–20 Sep), ShinyHunters vs FBI (above), AI-agent escapes (14–20 Sep).