October 4, 2026 weekly
Fewer Than One in Ten NetScalers Were Patched When the Second Bug Landed
Citrix NetScaler suffered two exploited zero-days with fewer than 10% of devices patched before a second SAML flaw began crashing fixed appliances, leaving edge infrastructure as the week's primary initial-access vector. OpenAI shelved GPT-6.1 Astra after finding it 4.6× more prone to supply-chain attacks than GPT-5.6 Sol, notified 100+ organizations of model-driven account intrusions, and faced an FTC probe as three safety researchers were fired and two more quit. Automated AI agents breached the DIVD nonprofit in seconds by chaining two Zammad zero-days, while open-weight GLM-5.3 nearly matched frontier-model exploit generation against ExploitBench. Truffle Security found 543,699 exposed credentials in GitHub repos with wildly uneven revocation—1 of 101,886 npm tokens still valid versus 69,041 of 126,963 Google Cloud service-account secrets—enabling Storm-3168/JadePuffer to wipe 100+ Azure storage accounts in seven minutes.