Edge infrastructure set the agenda in this cybersecurity weekly report for September 28 to October 4, 2026. Two Citrix NetScaler zero-days, patched on September 27, were attacked at scale all week as GreyNoise, Mandiant and LevelBlue documented several actors installing web shells.
Citrix ended the week investigating a separate SAML reboot problem on patched appliances. Cisco confirmed a new SD-WAN Manager authentication bypass under attack, and Fortinet acknowledged exploitation of a FortiMail flaw whose fixed builds were still listed as upcoming.
Among the cybersecurity incidents this week, Bitget said a zero-day in a third-party security product led to a $387.5 million theft. Times Car confirmed about 6.6 million affected accounts, and a Dutch vulnerability-disclosure nonprofit said an AI agent chained two zero-days to break in.
European police seized KillSec’s leak site, and Reuters reported that a ShinyHunters suspect is cooperating with the FBI. Microsoft’s Digital Defense Report supplied the backdrop: the gap between vulnerability discovery and weaponization is now measured in hours.
Major Incidents
Four incidents stood out in the cybersecurity news this week, ordered here by how directly they affect defenders.
1. Citrix NetScaler – Exploitation Widens After the Emergency Patch
Citrix released fixes for CVE-2026-88771 and CVE-2026-88772 on September 27, with CISA adding both to its KEV catalog after confirmed worldwide exploitation.
During the week, GreyNoise observed widespread exploitation, while Mandiant and Google Threat Intelligence Group reported attacks against dozens of organizations across North America and Europe. Attackers exploited NetScaler appliances for root access, deploying WHIPSHOT PHP web shells and the SLAPSHOT Python tunneler for reconnaissance and credential theft.
LevelBlue also observed attacks that created superuser accounts and exfiltrated NetScaler configuration data.
CVE-2026-88771 enables unauthenticated root command injection, while CVE-2026-88772 is a DTLS memory-overflow flaw affecting VPN virtual servers. Both have a 9.5 CVSS 4.0 score. Censys identified 42,735 NetScaler hosts, while Unit 42 counted 50,277 internet-visible instances.
Why it matters: CISOs should patch immediately, isolate suspected appliances, preserve evidence, revoke credentials and investigate connected systems. Citrix is also investigating reported reboots after build 14.1-73.37 [Read more]
2. Bitget – Zero-Day in Third-Party Security Appliances Behind $387.5 Million Theft
On September 30, Bitget published findings from two investigations, by SlowMist and by Mandiant, into the theft of roughly $387.5 million from its wallet environment. According to Bitget, attackers gained privileged access to two third-party security appliances on September 24 using zero-day exploits.
They dropped web shells on one appliance, placed malware on a production wallet job server, and used a custom withdrawal tool to move funds over about three hours in the early hours of September 25. SlowMist traced the earliest malicious activity to August 31, weeks before any funds left.
Bitget has not named the vendor or product. SlowMist has not named a culprit, although Bitget’s chief executive earlier pointed to suspected North Korean hackers. That attribution remains unconfirmed. No source reviewed ties this theft to the NetScaler or Cisco activity covered in this report. [Read more]
3. Times Car – Breach Confirmed at About 6.6 Million Accounts
Times Mobility, the Park24 subsidiary that runs Japan’s Times Car car-sharing service, first reported a possible leak on September 25 and confirmed the scale on September 28: about 6.6 million accounts. The count covers current and former members, people who began but did not finish signing up, and users of the Times Business Service corporate program. It is a count of accounts, not people.
The company said the data includes names, addresses, dates of birth, phone numbers, email addresses, driver’s licence information, identity-verification document details and account passwords. Images of licences and similar documents are involved for about 1.6 million accounts.
Credit card data was not affected, and services stayed online. Times Mobility reported the incident to Japan’s Personal Information Protection Commission and to police. Reporting based on its disclosure says there was no evidence the data had been distributed online.
Access was blocked on September 26, and some coverage says the intruder first got in earlier in September. The sources reviewed do not describe the initial access method. Identity documents cannot be reset the way passwords can, so the exposure will outlast the incident. [Read more]
4. Dutch Institute for Vulnerability Disclosure – Intrusion Attributed to an AI Agent
The Dutch Institute for Vulnerability Disclosure (DIVD) said on September 30 that an attack on its network on September 21 chained two previously unknown flaws in Zammad, the open-source ticketing system.
CVE-2026-102489 is a remote code execution bug and CVE-2026-102490 is a privilege escalation flaw. Infosecurity Magazine reported a combined CVSS score of 9.4. Working with Merlon Security, DIVD found that Zammad versions 6.3.0 through 6.5.4 are affected. It said the chain took the attacker from a Zammad user to root within seconds.
DIVD’s assessment is that an agentic AI system drove the attack. The agent moved on its own and left explanations of its decisions, which let investigators reconstruct the intrusion. That is DIVD’s conclusion, and whether the activity was a live operation or a capability test is unknown. Network segmentation and incident response stopped the attacker from moving deeper.
Volunteer email addresses and possibly contact details were exposed, which raises the risk of someone impersonating DIVD staff. DIVD recommends upgrading to Zammad 7 or taking vulnerable instances offline. The Dutch NCSC advised copying application and network logs before updating. [Read more]
ANALYST INSIGHT: Three of these four incidents ran through internet-facing infrastructure or tooling that defenders trusted, and in each the attacker had a head start. NetScaler attempts predate the bulletin. DIVD’s attacker used two flaws that nobody could have patched because no fix existed. At Bitget, the intrusion SlowMist dates to August 31 surfaced only when funds started leaving. Outcomes turned on detection and containment, not on the exploit. DIVD responded as the attack unfolded, and segmentation held. Patch speed matters, but segmentation, logging that survives an appliance compromise and a rehearsed rebuild procedure decide the damage.
New Vulnerabilities & Patches
Management planes and edge appliances supplied most of this week’s exploited flaws. Citrix is covered above. For this cybersecurity weekly report, the rest follow in priority order, with exploitation evidence ahead of CVSS.
[CVE] CVE-2026-76504 | Cisco | Catalyst SD-WAN Manager | CVSS: 9.8 | Exploited: Yes
Cisco’s September 30 advisory describes an authentication bypass in the Manager’s API. Mishandled URI encoding lets a crafted HTTP request slip past a rule meant to restrict one endpoint, giving an unauthenticated attacker API access as the admin user.
The flaw affects the Manager regardless of configuration, and there is no workaround. Cisco says its PSIRT learned of exploitation in September 2026 while handling a support case. The advisory does not say how many customers were hit or by whom. CISA added the flaw to KEV on September 30. It is the eighth Cisco SD-WAN flaw added to the catalog in 2026.
Cisco’s compromise indicators center on login-path requests from unknown IP addresses in the service-proxy access log. The path is j_security_check, with one character URL-encoded. Defenders should also check vmanage-server log entries for users whose names begin with viptela-reserved-.
[PATCH] Upgrade to the first fixed release for your train: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1. A Manager updated only for the May and June flaws still needs this release. Restrict Manager access to trusted hosts, collect an admin-tech file before upgrading if you suspect compromise, and open a Severity 3 TAC case citing the CVE. Cisco’s earlier SD-WAN advisories said an update alone does not remove an attacker who is already in.
[CVE] CVE-2026-88771, CVE-2026-88772 | Citrix | NetScaler ADC and Gateway | CVSS: 9.5 (CVSS 4.0) each | Exploited: Yes
Exploitation detail appears in the incident section above. CVE-2026-88771 affects all deployments; CVE-2026-88772 needs DTLS enabled.
[PATCH] Update to 14.1-73.37 or later, 13.1-64.23 or later, or the matching FIPS and NDcPP builds in Citrix bulletin CTX697096. Treat any appliance that was internet-exposed before the update as potentially compromised, and review Citrix’s SAML guidance before upgrading given the reboot reports. Citrix has said a further fixed build is coming.
[CVE] CVE-2026-104286 | Fortinet | FortiMail | CVSS: 9.8 | Exploited: Yes
A path traversal and NULL-byte flaw (CWE-22 and CWE-158) lets an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests. Fortinet acknowledged exploitation in the wild, and CISA added the flaw to KEV on October 1 with a federal deadline of October 4.
Affected releases are FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8 and 7.2.0 through 7.2.9. Fixed builds 8.0.2, 7.6.7 and 7.4.9 were listed as upcoming when Fortinet published. Users on 7.2 must move to the 7.4 branch or later.
[IOC] IP address | 79.141.169[.]187, 45.129.0[.]192 | Addresses Fortinet associates with exploitation [IOC] File path | /data/lib/liblog.so (added), /data/etc/ld.so.preload (added) | Artifacts Fortinet lists on compromised FortiMail systems; the advisory carries the full list
These indicators belong to one campaign, so their absence proves little.
[PATCH] Apply the fixed build for your branch when it ships. Until then, disable IBE support using the CLI sequence in Fortinet’s advisory and remove internet access to the management interface or limit it to trusted private networks.
[CVE] CVE-2026-86950 | Apple | CoreGraphics (iOS, iPadOS, macOS) | CVSS: not published in the sources reviewed | Exploited: Exploitation reported in targeted attacks
On September 28, Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 for a CoreGraphics flaw. Apple said it may have been used in an extremely sophisticated attack against specific individuals on iOS versions before iOS 27.
Processing a maliciously crafted file can lead to code execution. SANS ISC reports that Meta Product Security reported the flaw and that the version 27 branch is not affected. As of September 29, the flaw was not in CISA’s KEV catalog.
[PATCH] Update affected iPhones, iPads and Macs, starting with devices used by staff who handle sensitive communications.
[CVE] CVE-2026-84411 | MikroTik | RouterOS | CVSS: 9.8 | Exploited: No public exploitation reported
CISA’s September 29 advisory, ICSA-26-272-06, describes an integer underflow in how the web management service handles HTTP request bodies, reachable before authentication. One crafted request can give root code execution or a denial of service on RouterOS versions before 7.24. CISA said it had received no reports of public exploitation for this CVE.
Coverage of the fix is inconsistent: the CISA record lists versions before 7.24 as affected, while Cybernews names 7.24.5 as the current stable release. This CVE is separate from the MikroTrick SSH chain that CERT Polska reported as exploited in early September.
[PATCH] Move to the latest stable RouterOS, keep the web management interface off the internet, and confirm the September MikroTrick fixes are also applied.
[CVE] CVE-2026-90970 | GitLab | AI Gateway | CVSS: 9.9 | Exploited: Unknown
GitLab disclosed on October 2 that a logged-in user with Duo Agent Platform access could, under certain conditions, run commands on a self-hosted AI Gateway. Gateways that GitLab operates for its customers are already fixed, so only organizations hosting their own gateway need to act.
[PATCH] Upgrade the self-hosted gateway to 19.2.4, 19.3.2 or 19.4.1.
[CVE] CVE-2026-63688, CVE-2026-63692 | Dell | Container Storage Modules | CVSS: 10.0 each | Exploited: Unknown
Dell fixed missing-authentication flaws that let an unauthenticated attacker obtain storage backend administrator credentials (CVE-2026-63688) or gain administrative privileges through the authorization proxy and tenant service (CVE-2026-63692). A third flaw, CVE-2026-67269, scores 9.9 and needs only low privileges.
[PATCH] Apply Dell’s Container Storage Modules updates. The reporting reviewed did not give fixed version numbers, so confirm them in Dell’s advisory.
PRIORITY ACTION: Make NetScaler and SD-WAN Manager the first hour of work on the cybersecurity threats this week. For NetScaler, patching is not the finish line: assume compromise on any appliance that was internet-exposed before the update, and run Citrix’s evidence-preservation and rebuild steps. For SD-WAN Manager, check the two logs Cisco names before upgrading and take management interfaces off the internet. FortiMail is next the moment fixed builds appear. The IBE workaround and management-interface restriction are available now.
Ransomware Activity
Law enforcement dominated ransomware coverage in the weekly cybersecurity news, while a Symantec report showed that intrusion activity continues underneath it. Of the cybersecurity incidents this week, these three fit the ransomware and extortion pattern.
KillSec – Leak Site Seized, Three Arrested
Hamburg police, working with Spanish, Romanian, UK and US partners, said on October 1 that three people were arrested on September 30 and KillSec’s leak site was taken over. The suspected main administrator is a 16-year-old detained in Alicante, Spain. A 24-year-old was detained in Romania, and a third person in their 20s was arrested in the UK, where Puerto Rico has filed an extradition request.
Police shut down five servers, including KillSec’s main server, put seizure notices on five domains and say they secured at least 110 terabytes of data. Hamburg police described the arrests as provisional, and the suspects are presumed innocent.
The scale figures are the authorities’ working numbers and may change. The investigation covers about 1,000 suspected attacks worldwide, roughly 500 identified as successful so far. Spanish police put the victim count above 280, and Europol said the group obtained substantial ransom payments. Hamburg police said the group used AI to build infrastructure and identify victims but gave no detail.
The agencies call KillSec a ransomware group, yet much of the conduct they describe is data theft and extortion through exploited software flaws and poorly secured cloud storage. Rapid7 reported in 2025 that the group began as hacktivist and moved to ransomware in October 2023. [Read more]
Symantec and Carbon Black’s Threat Hunter Team reported on October 3 that Warlock, which it tracks as Longlegs, attacked at least four organizations in two months: a water utility, a telecommunications provider, a regional government body and a university.
All were in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America. Symantec describes the actor as suspected China-linked.
It says Warlock’s continued use of ToolShell and related SharePoint flaws, more than a year after the group first rose to prominence, shows the route still works against unpatched or unmitigated servers. It offered two readings of the regional focus, opportunistic or deliberate, without choosing between them.
The speed is the real problem for defenders. In one intrusion at a critical infrastructure operator, the attackers pushed a security-disabling tool to at least 40 hosts in about two hours. They then deployed Warlock to at least 33 hosts by staging it in the domain’s SYSVOL share, where ordinary domain replication delivered it.
[TTP] Web shell that collects SharePoint machine keys to forge signed payloads and run code in the application pool: observed in Warlock intrusions [TTP] Bring-your-own-vulnerable-driver abuse of K7RKScan.sys (CVE-2025-1055) to disable security software: observed [TTP] Ransomware staged in SYSVOL for domain-wide delivery, with VS Code tunnels for remote access: observed [Read more]
ShinyHunters – “Rey” Reportedly Detained and Cooperating With the FBI
Reuters reported on October 3, citing three people familiar with the matter, that a suspected ShinyHunters member known as Rey was detained in Jordan on September 29 and is helping the FBI identify other members. Krebs named Rey in November 2025 as one of the administrators of Scattered LAPSUS$ Hunters. The detention rests on anonymous sources, and no official confirmation appears in the coverage reviewed.
It follows the arrest of a 24-year-old man in Amsterdam the previous week. After that arrest, an FBI cyber division official said the group’s alleged leader and co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments. ShinyHunters, for its part, claims to have taken about three terabytes from an FBI job-application portal and says it wanted no payment. Those are the group’s own claims [Read more]
ANALYST INSIGHT: KillSec lost its infrastructure, ShinyHunters is under pressure, and Warlock is still using a year-old SharePoint route to reach new victims. Takedowns remove brands and servers faster than they remove the access methods these crews depend on. Sekoia and Beazley Security made a similar point about ShinyHunters this week, calling it a brand and business model that has outlived its founders.
Threat Intelligence
The cybersecurity threats this week that matter most to SOC teams were two China-nexus campaigns and a self-healing WordPress backdoor, with a UK government warning covering the research side.
TA419 – Reply-Triggered Phishing Targets U.S. AI Policy Experts
Proofpoint published an analysis this week of TA419, a China-aligned, espionage-motivated actor that has run credential phishing against think tanks, defense contractors, universities and law firms in the U.S. and Japan since at least April 2025.
The campaigns now reported target AI policy experts, with lures that impersonate prominent economists, AI policymakers and an Anthropic employee. One February 2026 email to a think-tank expert carried the subject line “Request for Feedback on Military Integration of Claude.”
The first message is harmless. Only after the target replies does the actor send a shortened link that leads, through a redirect chain and a Cloudflare Turnstile check, to an adversary-in-the-middle page styled as OneDrive.
The page draws a fake sign-in window with a frameless browser-in-the-browser technique, and a custom module tracks the Microsoft sign-in flow, captures credentials and session cookies, and relays everything to the real service so the victim sees a normal login.
Proofpoint assesses that the activity likely supports wider Chinese intelligence aims on U.S. AI policy and regulation, and recommends phishing-resistant authentication such as passkeys.
[TTP] Reply-gated adversary-in-the-middle phishing with a frameless browser-in-the-browser page: session cookies captured while the victim signs in successfully [Read more]
UAT-11587 – Antino Backdoor Uses Outlook and OneDrive for Command and Control
Cisco Talos described a China-nexus cluster it tracks as UAT-11587, which targets government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand and Myanmar. Talos counts 16 targeted entities and says the cluster was first seen in September 2025.
It assesses China-nexus with high confidence based on Simplified Chinese lure metadata, a UTC+08:00 time zone in a phishing header and mainland-China crate-mirror paths in build artifacts. Talos found overlap with Jewelbug but could not link this espionage activity to that group’s financially motivated operations, so it tracks UAT-11587 separately.
The chain has five stages. A spear-phishing email, often spoofing a sender the target trusts so it passes SPF and DMARC checks, carries a fake Gmail attachment card that links to a Cloudflare Pages URL. That URL delivers an HTA or WSF stager, a JavaScript downloader and a .NET downloader, which fetch a decoy document and the Antino implant. Antino is a Rust backdoor launched by DLL sideloading.
It uses Microsoft Graph to exchange commands through an Outlook mailbox and to move heartbeats and files through OneDrive, so there is no dedicated command server to block. Talos notes that Antino runs attacker PowerShell through the Windows Scripted Diagnostics framework, but PowerShell, file-creation and registry telemetry remain observable.
[TTP] DLL sideloading through a Microsoft-signed binary: GatherOsState.exe loads the implant [TTP] Command and control over legitimate Microsoft 365 services: Outlook for commands, OneDrive for heartbeat and file transfer [Read more]
MI5 Espionage Alert – MSS-Linked Research Funding
On September 30, MI5 issued a Security Service Espionage Alert saying the China General Technology Research Institute, also called the China Academy of General Technology, exists mainly to fund research that improves the Ministry of State Security’s technical capability.
MI5 said more than 100 UK-linked academics have contributed to projects funded this way, in some cases without knowing who was paying, on topics including AI, cybersecurity, covert communications and steganography. The alert is aimed at universities and research-security teams rather than SOCs, but it names a collection channel those teams can screen for.
Sucuri – “SC” WordPress Backdoor Rebuilds Itself After Cleanup
Sucuri reported a WordPress compromise it calls SC, after “SC_” markers in the injected content. The payload lives in at least eight places across files, the database and shared memory, and each can rebuild the others. Deleting a plugin or drop-in is not enough, because the next page load restores the set, and Sucuri describes the malware as blockchain-controlled.
ANALYST INSIGHT: Both China-nexus campaigns lean on trusted Microsoft services: TA419 through a spoofed sign-in relayed in real time, Antino through Microsoft 365 as its command channel. That moves the defender’s work from blocking infrastructure to identity telemetry: phishing-resistant authentication, session and token monitoring, and alerts on unexpected Graph API use.
Industry & Regulatory News
Microsoft Digital Defense Report 2026
The cybersecurity news this week with the most numbers attached came from Microsoft, which released its 2026 Digital Defense Report. It says the median time from vulnerability discovery in the wild to weaponization has fallen well below 24 hours, and that AI is compressing post-compromise steps such as secret discovery, lateral movement and data theft from days to minutes.
Coverage of the report says phishing accounted for 23% of observed intrusions, up from 7% a year earlier. Microsoft’s India release says India ranks seventh globally among countries where its customers were most often affected. These figures come from Microsoft’s own telemetry across its customer base, so they describe its visibility rather than the whole internet. Even so, the weaponization finding matches what the NetScaler, Bitget and DIVD cases showed this week.
Google Gemini 4 Argon – Defender Access Without Cyber Guardrails
On September 30, Google announced Gemini 4 Argon and said it is rolling out first to trusted defenders through its Fairwind Program. Google said defenders and its own teams receive the model without cyber guardrails, that it was trained to find, validate and patch vulnerabilities, and that Wiz is already using it through a program that scans public infrastructure for free. Wider access starts with paid API customers and Google AI Ultra subscribers, and Google gave no date. Reporting notes that Google cited benchmark results its post does not independently verify.
Security Tool & Framework Updates
Google said on October 1 that in Android 17, turning on Advanced Protection restricts the AccessibilityService API to verified apps classified as accessibility tools. Malicious Android apps abusing that API are a main route for malware and financial fraud, so the change closes a common path while preserving assistive technology. It applies only to devices with Advanced Protection enabled, which limits its reach to users and organizations that turn it on.
The weekly cybersecurity news also included two practical tools for responders. DIVD published a verification script to hunt for signs of compromise on Zammad instances, and it is scanning for vulnerable servers and notifying owners. Citrix made generic indicators of compromise available through NetScaler Console, though a clean result does not rule out compromise given the weeks of pre-patch exploitation.
Looking Ahead
Four items from this cybersecurity weekly report are still moving. First, Citrix. The company said it will publish a new security bulletin and fixed build for the SAML reboot issue, and no date or CVE had been published when this report closed. Second, FortiMail.
Fortinet listed 8.0.2, 7.6.7 and 7.4.9 as upcoming builds, so teams should watch advisory FG-IR-26-175 and apply the IBE workaround meanwhile. Third, the cybercrime investigations. Hamburg police said inquiries into other possible KillSec members continue, and FBI Director Kash Patel said more arrests are possible after the Amsterdam detention.
Fourth, Bitget. Until the third-party security product is named, other customers of the same software cannot assess their exposure.
UPCOMING EVENTS: Microsoft’s regular Patch Tuesday falls on October 13. SecurityWeek’s virtual Zero Trust & Identity Strategies Summit runs on October 14.
For anyone tracking weekly cybersecurity news, the common thread to carry into next week is time. Microsoft’s data puts weaponization well under 24 hours, and the NetScaler timeline showed attempts three days before the patch. The useful question for each exposed system is how long it has been exposed, not only whether it is patched.
