Third NetScaler RCE in a Month Lands on the Same SAML Surface

Citrix has patched CVE-2026-107406, an unauthenticated NetScaler RCE sitting on the same SAML attack surface as two bugs already exploited in the wild this month, and watchTowr published 11 days of post-exploitation artefacts from the earlier wave. The Shai-Hulud worm also reached AI infrastructure, compromising the tensorlake npm SDK to lift cloud, Kubernetes and agent-config secrets.

Vulnerabilities & Exploitation

• Citrix shipped a fix for CVE-2026-107406, another unauthenticated RCE in NetScaler on the same SAML code path as two flaws exploited in the wild over the past month (Kevin Beaumont), who adds that Citrix patched its hosted cloud offering the same day and then marked it not vulnerable. Separately, watchTowr published the aftermath of CVE-2026-88771 exploitation it has tracked for 11 days — backdoors through bulk credential theft — with hunting IoCs (watchTowr) (earlier coverage).
• Huntress reports active exploitation of CVE-2026-105133 and CVE-2026-105134, the AhsayCBS backup-server RCE pair, across five customer environments — webshells, an XMRig miner masquerading as Microsoft Edge, and what it describes as an AI-assisted PowerShell script that watches for Task Manager and kills it if left open overnight (Huntress). It later found that 10.3.4 is also affected — the version customers had been told to upgrade to — and now advises restricting the management interface and hunting for compromise (update) (earlier coverage).
• A public PoC is out for CVE-2026-59346, an integer overflow in VMware’s VMXNET3 virtual NIC that would let an administrator inside a guest execute code on the host. The published PoC crashes a host process rather than achieving code execution; Workstation and Fusion 25H2 and 26H1 are listed affected, with no workaround (Cyber Security News).
• Atlassian CVE-2026-21589 exploitation now has numbers: Previdian honeypots logged 190 attempts from 32 IP addresses in 10 countries as of 8 October, starting hours after watchTowr’s PoC on 6 October; CISA has not added it to KEV. The dangerous path is Jira integrated with Crowd, where the readable config file holds plaintext Crowd application credentials (SecurityWeek). @vuln_tracker notes the fixed builds are Confluence 9.2.26 and Bitbucket 9.4.26 / 10.2.8 / 10.5.1, with a Tomcat RewriteValve rule as a stopgap (earlier coverage).
• Pwn2Own Ireland 2026 paid $388,500 for 32 zero-days on day one (ZeroHack) and $232,500 for 45 unique zero-days on day two, with the Samsung Galaxy S26 falling three more times (BleepingComputer) (earlier coverage).

Offensive Tradecraft

• A new Kerberos delegation path reaches SPN-less accounts. Combining Elad Shamir’s Reflective RBCD with James Forshaw’s U2U sacrificial-user technique, and extending Impacket to support S4U2Proxy over U2U, the write-up obtains the forwardable ticket needed to abuse Constrained Delegation without Protocol Transition when the delegating account has no SPN. Preconditions are heavy: RC4 must still be permitted in the domain, MAQ enabled (or something with an SPN already compromised), and the technique destroys the affected user account (hunio.org).
• Microsoft Defender for Office 365’s new prompt-injection protection was bypassed in testing, with Base64- and zero-width-encoded emails reportedly slipping past mail-flow checks (@ipurple).

AI & Model Security

• The Shai-Hulud / ChainDrop worm jumped to AI infrastructure. Malicious tensorlake v0.5.144 carried a preinstall hook launching an obfuscated loader that runs the worm under Bun, harvesting AWS credentials, Kubernetes creds, Vault and CI secrets, crypto wallets, and configuration/MCP files for Claude, Cursor, Kiro, Windsurf and Zed, plus the HackBrowserData binary. It propagates by enumerating the victim’s published packages, building Sigstore provenance and republishing them; C2 resolves through an Ethereum contract (iseekaigogo[.]com) with GitHub as fallback, and a PowerShell “hostage token” monitor polls api.github.com/user to check the stolen token is still valid. The version has been pulled from npm (The Hacker News, The Register).
• One prompt to one agent took over every agent in an AWS account. Zenity Labs showed that a single publicly reachable agent on Bedrock AgentCore could be used to compromise all AgentCore agents in the same account and region, via an internal AWS temporary-credentials interface agents could reach without restriction. AWS has patched it and tightened default agent permissions (The Decoder, Dark Reading).
• CrowdStrike named the tooling behind the South Korean bank intrusions: ARTEX, a recently released Chinese open-source LLM multi-agent pentest framework, running DeepSeek v4.1-flash as its main backend with Z.ai GLM-5.3 and Grok 4.6 supplementing. The campaign was found through open directories on a Hong Kong IP (38.244.50[.]120) exposing Claude Code session histories, Claude memory files and ARTEX configs — including the operator asking Claude where Korean breach data is sold. Active late September to early October 2026, unattributed but assessed as a financially motivated Chinese-speaking operator; more than 25,000 customer records were taken from Shinhan Bank alone, and ARTEX has since gone closed source (The Hacker News, The Decoder) (earlier coverage).
• PoeLLM gets scale numbers. Chinese analyses of the loader that hides its C2 in a GitHub-hosted poem put it at roughly 3,400 infected AI servers and eleven separate NDR/EDR evasions (Doonsec summary) (earlier coverage).
• Two more AI-stack exposures: thousands of internet-exposed NVIDIA GPUs were found through the DCGM exporter, with a disruption path tracked as CVE-2026-47483 (Lava Security), and CERT.pl disclosed a relative path traversal in Ollama (CVE-2026-103663) (CERT.pl).
• Mathematicians are organising against OpenAI’s proof dump. The Association for Human Mathematics has called for a boycott after more than 700 AI-generated manuscripts were released at once, three of which were retracted the next day over a sign error; Terence Tao warns the mass harvesting of open problems leaves whole branches of the field less fertile (The Decoder) (earlier coverage).

Threat Activity

• An international coalition seized seven domains behind Microscan and FishHub, the vulnerability-scanning and spear-phishing tools tied to Flax Typhoon and Beijing-based Integrity Technology Group; Microscan drove a Mirai-based botnet to scan for exploitable flaws, with targets including a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms, universities and a multinational NGO (DOJ, The Record). Companion advisory AA26-281A details the TTPs — scanning, XSS, password spraying against Exchange, persistence via VPN software, scripted email and credential exfiltration — across government, critical manufacturing, healthcare and IT, with IOCs and CVEs newly added to KEV (CISA, NCSC-UK).
• Ransomware took down a Japanese cloud region. IDC Frontier (SoftBank subsidiary) says an attack beginning 7 October at 03:40 local forced a shutdown of IDCF Cloud’s East Japan Region 1, affecting 495 companies and local governments; management-console access has been disabled across all regions pending verification. Pre-lockout screenshots show the actor claiming seven minutes to breach, 225 databases and 3.6 PB encrypted, 239 hypervisors reached, 16,000 VM disks sealed and 554,153 snapshots wiped — operator claims, not confirmed (BleepingComputer).
• ASOS’s breach is larger than first disclosed. Criminals contacted the BBC with samples showing names, addresses, phone numbers, emails, customer numbers, dates of birth and on-site search history for potentially millions of users; no bank details or passwords (BBC). ASOS says attackers socially engineered access to an employee account and used it to push the rogue in-app notification (The Record) (earlier coverage) (discussion).
• “RePointing” keeps the FakeGit fleet alive without creating repos. From around 06:30 UTC on 4 October, a script edited READMEs across the 17,610-repo network for 34 hours, pushing more than 13,000 repositories in bursts of up to 2,999 an hour; in the commits Apiiro sampled, 97% touched only the README and 88% aimed the Download button at a ZIP installing SmartLoader (Apiiro, BleepingComputer).
• ESET traced MATCHBOIL back further than CERT-UA’s first write-up. The C# downloader used by Russia-aligned UAC-0099 against Ukrainian targets has versions from April 2024 through April 2026, each iteration more sophisticated in how it fetches, installs and persists its payload (ESET, Dark Reading) (earlier coverage).
• Mobile malware, two angles: low-cost Android handsets are shipping with firmware-embedded Midnight Mimosa, which silently installs apps, commits ad fraud and enrols devices as residential proxies (BleepingComputer); and Novinarya targets 81 financial apps via package enumeration, WebView phishing, regex-driven SMS and notification interception, resolving live C2 from encrypted dead-drop URLs planted in a Basalam shop profile (STAR Labs).
• A reported Ukrainian drone strike shut down a Yandex data centre in Sasovo, Ryazan; Yandex acknowledged a power outage on Telegram without linking it to the attack (The Record).

Vulnerability Research

• MariaDB published a batch of HackerOne disclosures, several worth attention beyond DoS: a low-privileged user can reach RCE as mariadbd through two memory-safety bugs in 13.0.x (report), #mysql50# legacy alias handling bypasses filesystem encoding to create hidden tables and escalate to code execution (report), CONNECT’s file UDFs ignore FILE and secure_file_priv checks, and orphaned DROP PACKAGE privilege rows plus definer newline injection both give privilege escalation.
• Handlebars.js has a prototype-chain bypass in validateAstNode leading to RCE, tracked as CVE-2026-106446 (advisory).
• A single POST request freezes any Next.js server by blocking the event loop through React Server Component FormData handling (write-up).
• Magento’s “StyleSmuggler” RCE (CVE-2026-75650) gets a technical breakdown (SecureLayer7).
• curl has 22 pending vulnerabilities awaiting disclosure, Daniel Stenberg writes — a backlog worth watching if you depend on it in build pipelines (daniel.haxx.se) (discussion).

New Tools & Releases

• MXC (Microsoft eXecution Container) is a new open-source, cross-platform sandboxing SDK for running untrusted code — model output, plugins, tool calls — behind a unified containment model, with ProcessContainer, Windows Sandbox, WSLC, LXC, Bubblewrap, Seatbelt, MicroVM and Hyperlight backends, JSON policy for filesystem/network/UI access, and Rust, .NET and Node SDKs. Useful on both sides: agent sandboxing for defenders, and a well-documented containment surface to probe (microsoft/mxc).

Industry & Policy

• Empire Market co-creator Raheim Hamilton was sentenced to 40 years and fined $5M for the marketplace’s 2018–2020 run: roughly 1.68 million registered users, over four million transactions and more than $430 million in volume (DOJ); he also forfeited more than $100 million in Bitcoin and several Virginia properties (The Record).
• Outlook will block .msix and .msixbundle attachments in Outlook Web and the new Outlook for Windows starting next month, closing a delivery route that has been used in attacks (BleepingComputer).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .