Suspected state-linked actors mass-exploit Citrix NetScaler zero-days

🚨 ACTIVE EXPLOITATION

• UPDATE: Hackers defrost fridges at hundreds of French supermarkets via vulnerable Danfoss controllers
  Attackers remotely triggered defrost cycles in Danfoss refrigeration controllers at hundreds of French supermarkets, spoiling food.

  • Affected: Intermarché/Netto (300+ stores), Coopérative U (100+), E.Leclerc, and reportedly Carrefour Market and Monoprix in France
  • Danfoss AK-SM800 and AK-SC355 fridge regulators were hit; Danfoss says most affected gear is legacy products no longer receiving updates
  • Attackers overrode defrost-cycle limits, driving fridge/freezer temperatures to 50°C for about six hours, causing food loss and fires; early losses near €300,000
  • Exploitation is trivial: thousands of controllers are internet-facing with username admin and a password that auto-changes daily to the current date; login is bypassed via a POST request to /xml.cgi
  • Claroty Team82 disclosed the hidden authentication mechanism in August; Shodan query html:danfoss product:"nginx" finds exposed devices
  Sources 📎 Coverage: qz.com · 👁 via @GossiTheDog@cyberplace.social (+5)

• Security researcher urges organizations to upgrade Ivanti Connect Secure appliances
  A security researcher is urging organizations to upgrade their Ivanti Connect Secure appliances.

  • Applies to organizations running Ivanti Connect Secure (ICS) VPN/secure access appliances, formerly known as Pulse Secure (PSA)
  • The call to upgrade was issued by researcher Kevin Beaumont (GossiTheDog) via Mastodon
  • No specific CVE identifiers or technical vulnerability details were provided in the available reporting
  Sources 📎 Coverage: cyberplace.social · 👁 via @GossiTheDog@cyberplace.social

💥 BREACHES & INCIDENTS

• (no items)

🔓 CVEs & KEV

• CVE-2026-9191 — Progress Software Corporation MarkLogic Server — CVSS 9.6 — MarkLogic Server Code Isolation Bypass Leads to Session Compromise

🕵️ RESEARCH & DEEP DIVES

• (no items)

📋 ADVISORIES

• UPDATE: Suspected state-linked actors mass-exploit Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772
  Suspected state-linked actors have mass-exploited two critical Citrix NetScaler zero-day RCE vulnerabilities, hitting dozens of organizations across North America and Europe.
  • Citrix NetScaler ADC and NetScaler Gateway users are affected; CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5) were exploited as zero-days before Citrix's Sept. 27, 2026 disclosure of eight vulnerabilities.
  • CVE-2026-88771 is an unauthenticated RCE via improper input validation, exploitable in default configurations; CVE-2026-88772 is a memory overflow leading to RCE or DoS when DTLS is enabled (default on VPN virtual servers).
  • Attackers delivered PHP and .deb web shells (e.g., Whipshot hiding Base64 C2 in HTTP headers, RC4-encrypted nsg64.deb shell) and a Python tunneler called Slapshot for reconnaissance and credential theft.
  • Activity dates back to at least Aug. 21, 2026; Arctic Wolf counted at least 78 targeted organizations in the U.S., Canada and Europe, and Shadowserver reports over 20,000 exposed NetScaler instances.
  • CISA added the flaws to the KEV Catalog and later added CVE-2026-88779, a SAML-related DoS flaw that can force a reboot and accelerate code execution from CVE-2026-88771 exploitation; Dutch hospitals including Frisius MC and Amphia took systems offline.
  Sources 📄 Source: support.citrix.com · 📎 Coverage: unit42.paloaltonetworks.com · 👁 via Cybersecurity Dive

📰 UNDER-REPORTED

• (no items)