Citrix Names the NetScaler SAML Zero-Day and Ships an Emergency Patch

Citrix has assigned CVE-2026-88779 to the NetScaler flaw it acknowledged last week and released emergency firmware, confirming targeted attacks against unmitigated appliances. South Korea’s financial regulator says a single actor hit seven banks and lenders with automated, LLM-driven tooling.

Exploited in the Wild

• Citrix assigned CVE-2026-88779 (CVSS 4.0 8.7) to the NetScaler bug it acknowledged on 2 October, with fixes in 14.1-73.41 and 13.1-64.28 (Citrix, NCSC-NL). Exploitation needs no authentication and no user interaction, but only appliances configured as a SAML Service Provider or Identity Provider are affected. Citrix says it has already seen targeted attacks on unmitigated devices, and researchers are still testing whether the flaw goes beyond denial of service into RCE (BleepingComputer). Kevin Beaumont points out the “memory overflow leading to DoS” wording is exactly what CVE-2025-6543 carried before it turned out to be used for code execution in the wild (earlier coverage). (discussion)
• A vulnerability in Roundcube webmail is reportedly being exploited in the wild, per Chinese security channel Doonsec; no CVE or technical detail accompanied the report, so treat the scope as unconfirmed for now (Doonsec).

Offensive Tradecraft

• Combat Theater published a breakdown (30 September) of module stomping — writing shellcode into the address space of a legitimately loaded DLL and executing from inside that module — after talking to authors of several commercial C2 products who all named it as their default injection primitive. It covers why operators pick it (remote injection for agent migration; stagers selecting from a predefined list of processes present on default Windows installs), the LoadLibraryEx + DONT_RESOLVE_DLL_REFERENCES approach used to avoid DllMain side effects and crashes, and the telemetry defenders can hunt on (Combat Theater).

New Tools & Releases

• SigLens narrows AV detections to a byte boundary on Windows binaries: it scans the full file, then progressively shorter and longer prefixes, to bound a reproducible CLEAN→DETECTED transition and map it back to PE section, RVA/VA, YARA match offsets and PDB symbols. It drives locally installed Defender and ClamAV, and runs AMSI full-buffer scans plus structural mapping for PowerShell/JS/VBS. The author is explicit that the boundary is inferred from repeated engine verdicts, not an offset the AV engine reports (GitHub).
• Cantina released apex-flash-1, its first open-weights model for security research, post-trained on real vulnerabilities; no benchmark figures accompanied the announcement (@thegrugq).
• OnionClaw gives AI agents Tor network access and dark-web data retrieval via a zero-config OpenClaw skill or standalone — relevant for automated CTI collection, and equally a building block for agentic leak-site scraping (@thegrugq).

AI & Model Security

• Prompt injection in repository content can break Claude Code out of its sandbox through .git worktree confusion, now tracked as CVE-2026-55607 and paid $3,700 under Anthropic’s bounty programme. Researcher Metnew’s write-up walks through how content the agent merely reads ends up as unsandboxed execution on the host (write-up).
• South Korean financial authorities say the same actor hit seven institutions — Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital — with recurring attacker IP infrastructure, rotated addresses, and a volume and degree of automation that points to AI tooling. Traces of ARTEX AI, an open-source, Chinese-language LLM-based autonomous penetration-testing system published on GitHub, were found on IPs used against the banks, and the National Police Agency’s cyber bureau is investigating; officials caution that an open-source tool plus IPs spread across eight countries makes country-level attribution unsafe. Data was taken from auxiliary systems used by staff and loan brokers, with no reported impact on customer banking or monetary loss, and multi-factor authentication is described as the dividing line between the victims and the near-misses. Sector-wide checks are ordered by 6 October for banks and card firms and 8 October for securities, insurance and savings banks (Yonhap).
• Google researchers propose RRSI, a regularisation method for self-improving agents that otherwise memorise their own test tasks; it lifts scores on unseen benchmarks by up to 4.7 points while using roughly 30% fewer tokens than the unregularised variant (The Decoder).

Vulnerability Research

• The hypervisor escape teased earlier this week now has a target: researcher Paulos Yibelo says he achieved guest VM → KVM escape → host root, and Vercel CEO Guillermo Rauch publicly confirmed that the company’s Sandbox bounty programme validated a KVM zero-day found during its sandbox-isolation challenge. No CVE, vendor advisory or technical detail has been published (DailyDarkWeb, earlier coverage).
• David Buchanan published attacks on C2PA provenance (“How to Hack Time, With C2PA”), including abuse of the spec’s arbitrary byte-range “exclusions” that are left out of the signature calculation (da.vidbuchanan.co.uk). Commenter bawolff on the thread: “Glad to see we learned from the mistakes of SAML” — a pointed note given the EU AI Act’s push to embed C2PA manifests in generated content (discussion).
• An issue filed on the net4people tracker alleges Xray-core silently fixed a certificate-verification bypass without disclosing it — in a proxy used heavily for censorship circumvention, a TLS verification bypass hands a network observer the traffic (net4people/bbs) (discussion).
• CVE-2026-105134 (CVSS 3.1 10.0) is an unauthenticated OS command injection in AhsayCBS’s Replication Receiver, via the random parameter of /rps/api/json/UpdateReceivers.do — centralised backup infrastructure typically run by MSPs. No exploitation reported (VulDB).

Detection & Defense

• Grizzly Sec measured the lag between a phishing page going live and blocklists catching up: 45% of the credential-phishing pages in its crawl were absent from Google Safe Browsing when first observed, and 29% were still absent a week later (Grizzly Sec).
• Android 17’s Advanced Protection restricts accessibility-service access to apps verified as Accessibility Tools, cutting off the API path that most Android banking malware and overlay fraud depends on (The Hacker News).

AI Infrastructure

• John Ousterhout is pushing Homa as a TCP replacement for AI-cluster traffic: message-based rather than stream-based, with the receiver scheduling transmission and prioritising short messages via shortest-remaining-processing-time, which he says cuts short-message latency by an order of magnitude. It installs as a Linux kernel module alongside TCP with no reboot, allowing incremental migration (The Register) (discussion).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .