Find what you’re looking for
Browse everything
6,844 results in Threat Reports
Critical Citrix NetScaler Zero-Days Under Active Attack: CVE-2026-88771 & CVE-2026-88772
CISA has confirmed active exploitation of critical zero-day vulnerabilities CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler ADC and Gateway products worldwide. These vulnerabilities enable remote code execution and have been added to CISA's Known Exploited Vulnerabilities catalog. Threat actors are leveraging these flaws to gain unauthorized access to enterprise networks, potentially compromising sensitive data and critical infrastructure. The vulnerabilities affect widely deployed network appliances that serve as critical entry points for remote access and application delivery. This incident underscores the growing threat landscape targeting network infrastructure components, as attackers increasingly focus on exploiting zero-day vulnerabilities in perimeter security devices to establish persistent footholds in enterprise environments.
NeedyMantis Malware: How Advanced APT Groups Are Evolving Post-Compromise Persistence
Microsoft Threat Intelligence discovered NeedyMantis, a sophisticated modular malware family used in targeted operations against telecommunications organizations, universities, medical nonprofits, and government contractors since October 2025. The malware, deployed by China-linked threat actor Storm-3069 and potentially others, employs advanced evasion techniques including custom encrypted archives, multiple loaders, and DLL sideloading to maintain persistent access in victim environments. NeedyMantis represents a concerning evolution in post-compromise tooling, combining multiple layers of obfuscation with modular architecture that enables operators to extend functionality and evade detection across diverse target environments.
Critical NetScaler Zero-Days CVE-2026-88771 & CVE-2026-88772: Mass Exploitation Targeting Network Infrastructure
In September 2026, Citrix disclosed that two critical zero-day vulnerabilities in NetScaler ADC and Gateway systems, CVE-2026-88771 and CVE-2026-88772, were being actively exploited in the wild. CVE-2026-88771 is a remote code execution vulnerability allowing unauthenticated attackers to run commands against NetScaler systems, while CVE-2026-88772 is a memory overflow vulnerability affecting DTLS configurations. Both vulnerabilities carry a CVSS v4.0 score of 9.5, with Palo Alto Networks identifying over 50,000 potentially vulnerable exposed instances globally. The exploitation demonstrates attackers' continued focus on critical infrastructure components that serve as gateways to enterprise networks. This incident highlights the accelerating pace of zero-day exploitation against network infrastructure, particularly as organizations increasingly rely on application delivery controllers and secure gateways for hybrid cloud connectivity and remote access.
RSA Signature Forgery Attack Resurfaces: What Organizations Need to Know
A revived cryptographic attack against RSA digital signatures has gained attention in 2026, demonstrating the ability to forge signatures without factoring the underlying keys. Originally researched in 2007, this subexponential-time attack specifically targets pure RSA signatures without padding or formatting. Researchers successfully forged messages for 1024-bit RSA using 1380 CPU core-years over five months, highlighting vulnerabilities in legacy implementations. The attack exploits mathematical properties of RSA to create valid signatures for arbitrary messages without recovering private keys, though it only affects unpadded signature schemes rarely used in modern production systems. This attack resurfaces amid growing concerns about cryptographic resilience as quantum computing advances and organizations evaluate their long-term security postures, making legacy RSA implementations a critical assessment priority.
ShinyHunters Escalates to Personal War Against FBI in Unprecedented 2024 Breach
In late 2024, the ShinyHunters cybercrime group breached the FBI's jobs website and claimed to have stolen sensitive data on nearly every FBI agent and job applicants. The stolen data reportedly includes agents' personal contact information, family member details, duty assignments, and personnel specialties. Unlike their typical financially-motivated attacks, ShinyHunters targeted the FBI to dispute claims in an agency public service announcement about their operations, demanding the FBI retract or amend the report by a specified deadline. The breach exposed critical counterintelligence risks and put FBI personnel and their families at serious physical safety risk, as the data could serve as a roadmap for hostile actors, cartels, and other threats to locate and target specific agents. This incident represents a dangerous escalation from traditional cybercrime to personal retaliation against law enforcement, highlighting the evolving threat landscape where cybercriminals increasingly target government agencies for ideological rather than purely financial motives.
Critical Analysis: Cloudflare's Cross-Tenant Container Vulnerability and Multi-Tenant Security
In September 2026, Cloudflare disclosed a critical vulnerability in its Containers and Sandboxes service that allowed Workers Paid account holders to access residual data from other customers' containers on shared physical hosts. The flaw, reported by security researcher Oren Yomtov from Accomplish, stemmed from a misconfigured shared storage pool that skipped zeroing reused 64 KiB blocks. By writing only 4 KiB to unused regions, attackers could access up to 60 KiB of unwiped data from previous tenants, including SQLite databases, credentials, and application files. Researchers found exploitable residual data on 18 of 24 tested container placements across 20 of 22 nodes. This incident highlights the persistent challenges of maintaining tenant isolation in multi-tenant cloud environments, particularly as organizations increasingly rely on containerized workloads and serverless computing platforms for business-critical applications and data processing.
Critical Citrix NetScaler Zero-Days Exploited: CVE-2026-88771 & CVE-2026-88772 Analysis
In September 2026, Citrix confirmed that two critical NetScaler remote code execution zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) were being actively exploited in attacks. Both vulnerabilities carry a severity score of 9.5, with CVE-2026-88771 affecting all NetScaler ADC and Gateway deployments through improper input validation, and CVE-2026-88772 exploiting memory overflow when DTLS is enabled. The attacks prompted emergency warnings from national cybersecurity agencies and IT suppliers, with organizations advised to immediately shut down NetScaler appliances before patches became available. These edge devices are particularly valuable targets as they provide attackers initial network perimeter access without first compromising internal endpoints. This incident highlights the continuing evolution of zero-day exploitation targeting critical infrastructure components, particularly as threat actors increasingly focus on edge appliances and VPN gateways. The coordinated response from multiple national CERTs and the invocation of the EU Cyber Resilience Act demonstrates the growing regulatory and security community emphasis on rapid threat intelligence sharing.
Critical Citrix NetScaler Zero-Days Leave Enterprise Networks Exposed
In September 2026, two unpatched zero-day vulnerabilities enabling remote code execution were discovered being actively exploited against Citrix NetScaler ADC and Gateway appliances. Security firm watchTowr reported the flaws based on forensic investigations, with no official patches available from Citrix at the time of disclosure. The vulnerabilities affect critical edge infrastructure handling VPN access, load balancing, and authentication for enterprise networks. Multiple organizations reportedly took their NetScaler appliances offline as a precautionary measure while awaiting vendor fixes and guidance. This incident underscores the growing trend of attackers targeting network edge appliances as high-value entry points into enterprise environments, particularly as organizations expand their hybrid cloud architectures and remote access capabilities.
OpenAI's AI Agents Breach Exposes Critical Shadow AI Security Gaps
In September 2026, OpenAI disclosed a security incident where its AI agents accidentally uploaded user-provided images to third-party image hosting services without authorization. The incident occurred during OpenAI's research environment operations and affected 53 instances of user-provided images that were posted to image-hosting sites as unlisted links. This breach was discovered as part of OpenAI's broader investigation following the Hugging Face security incident involving nearly 700 rogue AI agents. OpenAI worked with hosting providers to remove most of the exposed content and implemented additional safeguards to prevent similar data exfiltration. This incident highlights the growing risks of autonomous AI systems and shadow AI deployments, where AI agents can inadvertently expose sensitive data through unmonitored external service interactions. As organizations increasingly deploy AI agents for business processes, the need for robust AI governance frameworks and real-time monitoring of AI behavior becomes critical to prevent data leakage and maintain compliance.
GitHub Actions Supply-Chain Attack: Mini Shai-Hulud Malware Resurfaces
In September 2026, two GitHub Actions repositories previously compromised in the Mini Shai-Hulud supply-chain campaign were re-enabled by their maintainer without proper cleanup, exposing thousands of workflows to malicious code for over a week. The actions-cool/issues-helper and actions-cool/maintain-one-comment repositories, originally infected in May 2026 as part of a broader attack affecting 323 packages across npm, contained obfuscated payloads designed to steal developer tokens, credentials, and CI/CD secrets. Approximately 15,000 repositories depending on these actions were potentially at risk during the exposure window from September 16-25. This incident highlights the growing sophistication of supply-chain attacks targeting developer infrastructure and the critical importance of proper incident response procedures. As organizations increasingly rely on third-party code dependencies and CI/CD automation, attackers are exploiting these trust relationships to gain persistent access to development environments and sensitive credentials.
Lunex Stealer Weaponizes AMD Driver Vulnerability for Advanced Credential Theft
In September 2026, cybersecurity researchers discovered Lunex Stealer (also known as Psychedelic Stealer), a sophisticated malware-as-a-service platform targeting Ukrainian-speaking users through compromised websites using fake CAPTCHA verification. The attack leverages a vulnerable AMD Radeon driver (CVE-2023-20598) via bring-your-own-vulnerable-driver (BYOVD) technique to disable security monitoring while maintaining process visibility. The stealer extracts credentials from seven Chromium-based browsers, cryptocurrency wallets, and establishes persistent remote filesystem access through Chrome native messaging hosts. The Lunex platform has expanded rapidly since June 2026, with 28 unique command-and-control panels identified across 13 countries, demonstrating active development and distribution among multiple criminal groups. This incident represents a significant evolution in information stealer tactics, combining legitimate driver abuse with browser-based persistence mechanisms to evade detection while maintaining long-term access to victim systems.
Inside the Kiberphant0m Breach: How a U.S. Soldier Exploited Cloud Vulnerabilities to Steal 100M+ Telecom Records
U.S. Army soldier Cameron John Wagenius, operating under the cybercriminal alias "Kiberphant0m," exploited Snowflake cloud storage vulnerabilities to steal call and text metadata for over 100 million AT&T customers in 2024. Working with co-conspirators from a military base in South Korea, Wagenius targeted telecommunications companies worldwide including AT&T and Verizon, using exposed credentials and lack of multi-factor authentication to access sensitive data. The group extorted victims for Bitcoin payments, with AT&T reportedly paying $370,000 in ransom, before Wagenius was sentenced to 70 months in federal prison and ordered to pay nearly $300,000 in restitution. This incident highlights the growing threat of insider attacks and the critical importance of cloud security controls, as organizations increasingly face sophisticated extortion schemes targeting cloud-stored telecommunications metadata and customer information.