cyber.hendryadrian.com
Security News · helpnetsecurity.com

Week in Review: NetScaler Zero-Days Exploited as Researcher Accesses Microsoft Analytics Service

· Original article ↗

Summary

A weekly roundup covers exploited zero-days in NetScaler, Apple, Cisco SD-WAN and FortiMail, a confirmed OpenInfra Europe breach, a reported FBI portal compromise, and security risks involving AI systems and coding agents.

Key points

  • Citrix NetScaler zero-days were exploited to install webshells on compromised devices.
  • Apple, Cisco SD-WAN and FortiMail also faced reports of actively exploited zero-days.
  • OpenInfra Europe confirmed attackers compromised its self-hosted JFrog Artifactory instance; packages may have been affected.
  • A researcher disclosed a flaw in Microsoft's Titan analytics service that could have exposed employee records and Bing search analytics.
  • ShinyHunters claimed a breach involving FBI job portals, which remained offline; the compromise was reported but not confirmed in the roundup.
  • The roundup highlighted AI-related risks including malicious Custom GPTs used to deliver a RAT and coding agents exposing sensitive information.

Article Details

Event Type
Weekly cybersecurity news roundup covering active zero-day exploitation, breaches, ransomware activity, and AI-related security risks.
Impact
Reported and confirmed incidents included zero-day attacks against Citrix NetScaler, Apple operating systems, Cisco SD-WAN, and FortiMail; webshells were planted on compromised NetScaler devices. OpenInfra Europe confirmed a breach of its self-hosted JFrog Artifactory instance, with packages potentially compromised. FBI job portals remained unavailable after an apparent compromise claimed by ShinyHunters. A separate report described an AI-agent attack exploiting two Zammad zero-days to breach the Dutch Institute for Vulnerability Disclosure.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers exploited zero-day vulnerabilities in internet-exposed Citrix NetScaler deployments.T1505.003 · Web ShellAttackers planted webshells on compromised Citrix NetScaler devices.

CVE

CVE-2026-104286Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)CVE-2026-76504New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)CVE-2026-86950Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)CVE-2026-88771Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)CVE-2026-88772Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

People

Charles CarmakalMandiant CTO who said suspected state-sponsored threat actors likely were behind initial targeted intrusions exploiting CVE-2026-88772.

Threat Actors

KillSecRansomware group whose suspected 16-year-old main operator was arrested; Eurojust says the group is responsible for almost 1,000 attacks worldwide.ShinyHuntersCyber extortion group linked to the reported compromise of FBI job portals; the portals remained unavailable.

Vendors

AppleLast week’s security news was dominated by active exploitation of multiple zero-days in Citrix NetScaler, Apple, Cisco SD-WAN, and FortiMail, alongside a major breach of OpenInfra Europe’s JFrog Artifactory and aCiscosecurity news was dominated by active exploitation of multiple zero-days in Citrix NetScaler, Apple, Cisco SD-WAN, and FortiMail, alongside a major breach of OpenInfra Europe’s JFrog Artifactory and a reported FBICitrixLast week’s security news was dominated by active exploitation of multiple zero-days in Citrix NetScaler, Apple, Cisco SD-WAN, and FortiMail, alongside a major breach of OpenInfra Europe’s JFrog Artifactory and aFortinetFortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway.OpenInfra Europezero-days in Citrix NetScaler, Apple, Cisco SD-WAN, and FortiMail, alongside a major breach of OpenInfra Europe’s JFrog Artifactory and a reported FBI portal compromise linked to ShinyHunters.

Products

Cisco SD-WANsecurity news was dominated by active exploitation of multiple zero-days in Citrix NetScaler, Apple, Cisco SD-WAN, and FortiMail, alongside a major breach of OpenInfra Europe’s JFrog Artifactory and a reported FBIFortiMaildominated by active exploitation of multiple zero-days in Citrix NetScaler, Apple, Cisco SD-WAN, and FortiMail, alongside a major breach of OpenInfra Europe’s JFrog Artifactory and a reported FBI portal compromiseiOSApple patched an actively exploited Core Graphics zero-day in iOS and macOS.JFrog ArtifactoryNetScaler, Apple, Cisco SD-WAN, and FortiMail, alongside a major breach of OpenInfra Europe’s JFrog Artifactory and a reported FBI portal compromise linked to ShinyHunters.macOSApple patched an actively exploited Core Graphics zero-day in iOS and macOS.NetScaler ADCCitrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells onNetScaler GatewayCitrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells onZammadAI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit

Related Articles