🚨 ACTIVE EXPLOITATION
- UPDATE: Citrix NetScaler zero-days mass-exploited; third SAML DoS flaw patched
Suspected state-linked hackers have mass-exploited Citrix NetScaler zero-day flaws, compromising dozens of organizations across North America and Europe.- Citrix NetScaler ADC and NetScaler Gateway customers are affected; two critical RCE zero-days, CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5), were confirmed exploited in the wild.
- CVE-2026-88771 is an unauthenticated improper-input-validation RCE affecting all deployments, including default configurations; CVE-2026-88772 is a memory overflow requiring DTLS, which is enabled by default on VPN virtual servers.
- A third exploited flaw, CVE-2026-88779, is a memory-overflow denial-of-service affecting SAML-based Gateway/AAA deployments; Citrix patched it on October 3 and CISA added it to the KEV catalog.
- Attacks traced back to at least August 21 deployed custom web shells: Whipshot for command-and-control via Base64 payloads hidden in HTTP headers and Slapshot, a Python tunneler for reconnaissance and credential theft; attackers also modified Apache configs to run .deb/.sig/.ico files as PHP and wiped local logs.
- Arctic Wolf counted at least 78 victim organizations across the US, Canada and Europe; Shadowserver found more than 20,000 exposed NetScaler instances; fixes are in builds 14.1-73.37 and 13.1-64.23 and later.
💥 BREACHES & INCIDENTS
- Hackers leak personal data of 3,615 Trump Mobile customers after breach
A ransomware group has breached Trump Mobile and leaked personal data of 3,615 customers on a dark web leak site.- Trump Mobile customers are affected; the leaked data includes names, email addresses, phone numbers, home addresses, and order details, and exposes Trump Organization CIO Eric Brunnett and lawyer Nicholas Hayes.
- The cybercrime group BYOD says it infected an employee of Florida-based Liberty Mobile, a related company, with malware, claims it still holds access to Trump Mobile's backend dashboard, and says the company replied to the breach notice saying it had 'no team to handle this'.
- Leaked entries include $100 pre-order deposits for the T1 phone and mobile data plan purchases; leaked data also revealed only about 10,000 unique customers and roughly 30,000 pre-orders, contradicting earlier claims of 600,000.
- A separate ransomware leak-site post dated September 23, 2026 (Endzone) also listed Trump Mobile as a victim, alleging stolen data including eSIM QR codes.
- An earlier vulnerability in the Trump Mobile customer web portal, found by researcher '10N', exposed user profiles publicly before being fixed after Coffeezilla publicized it.
🕵️ RESEARCH & DEEP DIVES
- Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2, Ransomware Arrests
The Hacker News' weekly recap highlights actively exploited NetScaler and FortiMail zero-days, a new Spectre v2 attack, Star Blizzard's CosmicPulse backdoor, and arrests of ShinyHunters and KillSec members.- Citrix patched CVE-2026-88779 (CVSS 8.7), a memory overflow in NetScaler ADC and Gateway exploited in targeted zero-day attacks; exploitation requires SAML SP or IdP configuration
- CISA warned of active exploitation of critical FortiMail flaw CVE-2026-104286 (CVSS 9.8), letting unauthenticated attackers write arbitrary files via crafted HTTP/HTTPS requests
- Two ShinyHunters members were arrested, including a 24-year-old Amsterdam man believed to be Pepijn van der Stap and Saif al-Din Khader detained in Jordan
- Operation KillSwitch led to the arrest of KillSec's suspected 16-year-old leader in Spain, seizure of 110TB of data, and three arrests across Greece, Romania, Spain, and the U.K.; the group is linked to ~1,000 attacks since 2024
- A new Spectre v2 variant, Branch Target Reuse (BTR), can leak Linux root password hashes from Intel CPUs in 3-5 minutes by exploiting stale branch predictor state after JIT memory reuse
🔓 CVEs & KEV
- CVE-2026-79820 — Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out (iLO) 7 — CVSS 9.0 — A remote user validation failure vulnerability exists in HPE Integrated Light...