October 9, 2026
Third NetScaler RCE in a Month Lands on the Same SAML Surface
Citrix NetScaler landed a third unauthenticated RCE vulnerability (CVE-2026-107406) on the same SAML attack surface exploited in two prior flaws this month, with watchTowr publishing post-exploitation artifacts from earlier attacks. The Shai-Hulud worm compromised the tensorlake npm package to harvest cloud credentials, Kubernetes secrets, and AI agent configuration files from infected systems. CrowdStrike attributed recent South Korean bank breaches to ARTEX, a Chinese open-source LLM multi-agent penetration testing framework powered by DeepSeek v4.1-flash, Grok 4.5, and Claude, with operators stealing over 25,000 records from Shinhan Bank. An international coalition seized domains used by Flax Typhoon-linked threat actors for vulnerability scanning and spear-phishing, disrupting a Mirai-based botnet targeting critical infrastructure globally.