Security

Published Wednesday, September 30, 2026 at 11:44 AM PT BLUF: Suspected state-sponsored threat actors are exploiting two critical remote code execution zero-days in Citrix NetScaler ADC and Gateway (CVE-2026-88771, CVE-2026-88772). Active exploitation began in early September 2026 and has escalated from targeted intrusions to mass attacks affecting organizations globally. Organizations running vulnerable NetScaler instances must patch immediately. ...

Published Wednesday, September 30, 2026 at 11:43 AM PT BLUF: Cisco has warned of a new zero-day vulnerability in its SD-WAN solution that is actively exploited in attacks. Technical details, affected product versions, CVE assignment, and scope remain unconfirmed. Status: MONITORING. DETAILS Source reports Cisco warning of a zero-day flaw in SD-WAN (specific product/version not yet published) Flaw is actively exploited in ongoing attacks Cisco has issued official advisory (source: BleepingComputer) No CVE number, CVSS score, or vulnerability details available at this time Context note: Cisco has issued multiple high-severity SD-WAN and related infrastructure warnings in 2026 (ISE, Secure Email Gateway previously patched for active exploitation) IMPACT ...

Published Wednesday, September 30, 2026 at 11:42 AM PT BLUF: Vulnerability exploitation rates have doubled year-over-year, rising from an average 10.5 per month (2025) to 18 per month (Jan–Aug 2026). Google Threat Intelligence attributes acceleration to adversaries leveraging AI for automated discovery, exploitation, and attack chain orchestration. Organizations should immediately audit patch cadence and threat-detection coverage for AI-discovered CVEs; zero-day exploitation is tracking upward in parallel. ...

Published Wednesday, September 30, 2026 at 10:00 AM PT BLUF: Apple has released macOS 27.0.1. CVE details and vulnerability count are on Apple’s support portal (support.apple.com/en-us/100100). Unconfirmed: specific CVE list, severity breakdown, and affected subsystems — awaiting vendor documentation review. All macOS 27.x users should plan imminent patching. DETAILS macOS 27.0.1 release confirmed; Apple has published security documentation at support.apple.com/en-us/100100 Recent Apple 27.x series releases (referred to as “Golden Gate 27” in vendor advisories) have addressed significant vulnerability volume — prior 27.x releases patched 150+ vulnerabilities Timing: release within last ~24 hours; current date is 2026-09-30 Unconfirmed: exact CVE roster, severity distribution, and whether 27.0.1 is an initial release or patch to 27.0 The referenced support article likely contains full CVE details, attack vectors, and affected components — not accessible from available material IMPACT ...

Published Wednesday, September 30, 2026 at 07:33 AM PT Burbank · Wednesday, September 30, 2026 · 7:33 AM · 63°F, 85% humidity, wind 0 mph SE (gusts 2), 29.28 inHg, UV 0, PM2.5 10 You’ve got 116 devices online, 38 hardwired and 51 floating wireless, plus 27 cameras—all accounted for, all where the inventory says they are. Thirteen switches and APs holding them together. Zero unexpected USB devices decided to phone home in the night. The infrastructure is locked. Shiny. ...

Published Wednesday, September 30, 2026 at 05:41 AM PT BLUF: Bitget cryptocurrency exchange has been hacked via an unpatched zero-day vulnerability in a third-party security product. Attack vector and scope remain unclear. UNCONFIRMED: extent of funds/data compromise; specific vulnerable product; timeline. DETAILS: Bitget (major crypto exchange) exploitation confirmed via zero-day in third-party security software — vendor not yet disclosed in available material Attack leveraged security product vulnerability (pattern consistent with recent breaches: PaperCut, Citrix NetScaler, SonicWall, Check Point) BleepingComputer reported; no official Bitget statement available in provided sources Status of patches, incident response, or customer notification UNCONFIRMED IMPACT: ...

Published Tuesday, September 29, 2026 at 05:39 PM PT BLUF Attackers are exploiting unpatched remote code execution (RCE) vulnerabilities in Citrix NetScaler (CVE-2026-88771, CVE-2026-88772) to deploy web shells across the internet. Attacks have been active for at least three weeks. Organizations using NetScaler should assume compromise if unpatched and immediately engage incident response. DETAILS Citrix confirmed two high-severity NetScaler RCE zero-days are being exploited in active attacks globally Malicious actors deploy web shells post-exploitation, enabling persistent backdoor access and lateral movement Exploitation has occurred undetected for at least three weeks, suggesting widespread compromise before public disclosure GreyNoise telemetry confirms mass/swarming attack activity (149+ probe attempts from single IP: 149.104.78.141 on 24 September 2026) Vulnerabilities remain unpatched as of this alert date; no vendor patch timeline confirmed in provided material IMPACT Any organization running unpatched Citrix NetScaler appliances (commonly used as gateway/VPN endpoints) is likely compromised. Affected systems provide attackers direct access to internal networks, credential theft opportunities, and lateral movement vectors. Defense contractors have been targeted; global scope confirmed. ...

Published Tuesday, September 29, 2026 at 05:38 PM PT BLUF: Two critical remote-code-execution zero-days in Citrix NetScaler ADC and Gateway have been exploited in the wild for at least three weeks by advanced, suspected state-sponsored threat actors. Mandiant confirms dozens of organizations compromised. Patch immediately and assume breach until verified otherwise. DETAILS: Two CVEs active: CVE-2026-88771 and CVE-2026-88772 (both RCE, high severity). Citrix released patches after the exploitation window was already public; patches are now available. Duration: Minimum three weeks of undetected exploitation. Attack start date prior to 2026-09-24 (GreyNoise sighting of malicious actor IP 149.104.78.141 on that date). Scale & sophistication: Dozens of organizations across global scope. Mandiant and Blue team (GreyNoise) confirm advanced tactics and state-sponsored attribution. Affected products: NetScaler ADC and NetScaler Gateway — widely deployed as perimeter security / VPN gateways in enterprise environments. Attack capability: Unauthenticated remote code execution → full system compromise, lateral movement, data exfiltration. IMPACT: ...

Published Tuesday, September 29, 2026 at 05:37 PM PT BLUF: National Cyber Director Sean Cairncross has publicly signaled the US government is actively integrating artificial intelligence into critical infrastructure cybersecurity defenses. CEOs are being urged to understand how AI is being deployed in their operational environments. This represents an accelerating federal policy shift toward AI-first cyber posture across CISA-regulated sectors. ACTION: Organizations managing critical infrastructure should anticipate regulatory guidance on AI adoption and begin CEO-level briefings on AI cyber tool deployment and governance. ...

Published Tuesday, September 29, 2026 at 12:08 PM PT BLUF: Apple has released emergency security updates for CoreGraphics vulnerability CVE-2026-86950, an out-of-bounds write flaw enabling arbitrary code execution. Active exploitation reported against specific high-value targets. Patch availability and affected macOS/iOS versions not confirmed in available intel — immediate patch verification required for all Apple devices. DETAILS: Vulnerability: Out-of-bounds write in Apple CoreGraphics library; triggers arbitrary code execution when processing malformed graphical content Exploitation status: Highly targeted attacks confirmed; likely in-the-wild use against individuals of interest; not widespread commodity malware Remediation: Apple has issued emergency updates; specific version/platform scope UNCONFIRMED in provided intel Attack vector: Malformed graphical input (likely via web content, documents, or media); details on delivery method not available Severity implication: CVSS and full technical details truncated in source material — treat as critical pending official CVE scoring IMPACT: ...