VulnHub

Citrix has confirmed that two serious vulnerabilities in its NetScaler product, identified as CVE-2026-88771 and CVE-2026-88772, are currently being exploited in attacks. These vulnerabilities allow remote code execution, which means that attackers could potentially take control of affected systems. Organizations using NetScaler should prioritize applying the security updates released by Citrix to mitigate these risks. The situation is urgent, as the vulnerabilities are actively being exploited, putting many businesses at risk of unauthorized access and data breaches. Users are advised to stay vigilant and ensure their systems are up to date with the latest patches.

The Cybersecurity and Infrastructure Security Agency (CISA) has added a vulnerability in Microsoft SharePoint, identified as CVE-2026-65660, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw is currently being exploited in the wild, prompting CISA to issue a patching deadline for federal agencies by September 28. Organizations using SharePoint should prioritize applying the necessary updates to mitigate potential risks. The urgency of this situation lies in the fact that attackers can leverage this vulnerability for unauthorized access, which could lead to data breaches and other security incidents. It's crucial for users to stay informed and act quickly to secure their systems.

Last week, a significant data breach involving Gyazo was reported, exposing the personal information of 23.6 million users. The breach has raised concerns about the security of user data on the popular screenshot-sharing platform. Attackers managed to access sensitive information, including email addresses and user-generated content, which could lead to identity theft or phishing attacks. This incident underscores the importance of robust security measures for online services that handle sensitive user data. Users of Gyazo are advised to change their passwords and monitor their accounts for any suspicious activity.

Security researchers have identified two serious unpatched vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that can allow attackers to execute remote code. These zero-day flaws are currently being exploited in the wild, raising concerns among IT administrators. Citrix has not yet acknowledged the vulnerabilities or provided a fix, leading some organizations to proactively take their appliances offline to prevent potential attacks. The situation is urgent as these vulnerabilities could expose sensitive data and systems to unauthorized access. Companies using affected Citrix products should monitor for updates and consider temporary mitigation strategies until a patch is released.

Researchers at Manifold Security discovered a significant issue involving placeholder domains that were found in 359,000 GitHub files and linked to 349 AI agent skills. These domains are being used to redirect users to various scams, which could lead to financial losses and data theft. This situation raises concerns about the security of AI integrations and the potential for users to fall victim to these scams. It highlights the importance of scrutinizing third-party skills and applications, especially those that rely on external domains. Users and developers need to be vigilant about the sources of the tools they use to avoid being exploited by malicious actors.

A new malware called Lunex, which is part of a broader malware-as-a-service model, is targeting Ukrainian-speaking users through compromised websites. The attack involves a four-stage process starting with a fake CAPTCHA page designed to lure victims. Once engaged, the malware exploits an AMD driver to disable security monitoring, making it easier to steal sensitive information, such as browser credentials. This is particularly concerning as it highlights the tactics used by cybercriminals to bypass security measures and compromise user data. The findings from the cybersecurity firm Ontinue emphasize the need for increased vigilance among users, especially in regions facing heightened cyber threats.

Two third-party GitHub Actions, previously compromised during the Mini Shai-Hulud campaign, were re-enabled by their maintainer despite still containing malicious code. These actions remained accessible for over a week, potentially exposing users to ongoing threats. The situation raises concerns about the security practices of open-source maintainers and the oversight of GitHub's ecosystem. Users relying on these actions for their projects could inadvertently run harmful code, leading to security breaches or data loss. This incident underscores the need for vigilance when using third-party tools in software development.

A new Windows botnet known as x47.c has been discovered, which utilizes AI technology to enhance its operations. This botnet employs xAI Grok to select from a set of predefined actions, allowing it to adapt and maintain its presence on infected machines. The use of AI in this context raises concerns about the sophistication of cyber threats, as attackers can automate and optimize their strategies. This development could potentially affect a wide range of Windows users, as the botnet's ability to drain AI APIs may lead to unauthorized use of resources. Researchers are urging users and organizations to be vigilant and implement security measures to protect against this emerging threat.

Google has issued a warning about a surge in attacks exploiting a serious vulnerability in Oracle PeopleSoft, identified as CVE-2026-35273. This flaw has a CVSS score of 9.8, indicating a high risk of unauthorized remote code execution. The attacks are linked to the ShinyHunters group and are targeting various sectors worldwide. Organizations using Oracle PeopleSoft should take immediate action to secure their systems, as the vulnerability is currently being exploited in the wild. This situation underscores the need for companies to stay vigilant and apply necessary patches to mitigate the risk of exploitation.

The conversation around AI agents is evolving, particularly in the wake of security incidents like the recent intrusion at Hugging Face during assessments of OpenAI agents. Organizations are beginning to realize that deploying these AI tools isn't just about speed and productivity; it's crucial to have visibility and control over their operations. The incident at Hugging Face has raised concerns about how well organizations can monitor and secure their AI implementations. As companies invest in AI, they must prioritize establishing a 'Zero Trust' framework to ensure that these agents operate securely and transparently, minimizing the risk of similar breaches in the future. This shift is vital for maintaining trust and safety as AI technologies become more integrated into business processes.