🔴 NetScaler zero-days patched, CISA orders feds to fix by Wednesday, 🎯 ShinyHunters web shells widen across PeopleSoft sectors, 💸 Operation Master turns GlobalProtect bypass into invoice fraud, 📦 Kiteworks lifts weekend shutdown with no CVE materialized, 🤖 CARBONATO botnet hijacks Hermes AI agent on exposed Docker

[UPDATE] The weekend turned the Citrix NetScaler zero-days into a fully declared emergency: Citrix shipped fixes in bulletin CTX697096 for all eight flaws, CVE-2026-88771 through CVE-2026-88778, confirming exploitation of CVE-2026-88771 (CVSS 9.5, unauthenticated RCE against every ADC and Gateway deployment including default configurations) and CVE-2026-88772 (memory overflow enabling RCE or DoS wherever DTLS is enabled, the default on VPN virtual servers), published IOCs, and CISA KEV-listed the pair with a Wednesday, September 30 remediation order for federal agencies. Hospitals in two Dutch regions preemptively pulled patient portals offline. Patch builds are 14.1-73.37 and 13.1-64.23; anything internet-facing still on older builds is exposed to confirmed in-the-wild exploitation.

[REVISIT] Mandiant and Google Threat Intelligence Group's full report on the renewed Oracle PeopleSoft CVE-2026-35273 campaign confirms ShinyHunters, tracked as UNC6240, has now deployed web shells on dozens of systems worldwide and widened targeting well past the original 100-organization, 68-percent higher-education footprint into technology, IT services, healthcare, agriculture, transportation and government, riding the percent-encoded /%50SEMHUB/ path variant that defeats WAF rules matching the literal string. The CVSS 9.8 unauthenticated RCE in PeopleTools 8.61 and 8.62 still has mitigations only, so verify PSEMHUB is disabled rather than filtered, confirm edge rules decode encoded variants, and re-hunt for MeshCentral agents and zstd-compressed exfil from any instance exposed since May.

[REVISIT] New reporting shows the KEV-listed PAN-OS GlobalProtect authentication bypass CVE-2026-0257 feeding a profit pipeline rather than a ransom note: the operation tracked as Operation Master used the bypass, which requires authentication-override cookies with a certificate shared across services, to enter networks through seven gateways in four countries, deployed AdaptixC2, stole billing data and customer details, and ran an industrial-scale invoice-fraud platform that turned the stolen customer details into convincing fraudulent bills. Portals and gateways should be on the fixed builds from Palo Alto's advisory wave, and gateway-auth logs deserve a pass for cookie-based logins against local admin accounts before invoice-fraud losses surface on the finance side.

[UPDATE] Kiteworks lifted its emergency shutdown recommendation on September 27, characterizing the weekend blackout as preventive with no confirmed compromise, and the CVE or advisory that the cited federal threat intelligence implied has still not materialized; keep the post-restart incident hunt on authentication logs and transfer records running until something does.

[REVISIT] Cloudflare's root-cause write-up on the Containers cross-tenant exposure discloses the mechanism: dm-thin pools provisioned container root disks with skip_block_zeroing, so a 4 KiB write to freshly allocated space left roughly 60 KiB of a prior tenant's residual bytes readable from the raw device, demonstrated on 18 of 24 test placements with directory listings, SQLite databases, Chromium profiles, .env files and credentials among the recovered data. Cloudflare removed the option fleet-wide with disk retirement complete September 7 and cleared cached snapshots by September 19; any secret a Containers, Sandboxes or Browser Run workload held on disk before September 7 should still be treated as readable by an unknown co-tenant and rotated.

[REVISIT] CISA's confirmation that ransomware gangs have joined exploitation of TeamCity CVE-2026-63077 (CVSS 9.8 unauthenticated deserialization riding a permissive XStream allowlist) lands with relayed reporting of roughly 160 installations still exposed, months after the July 27 fix, the August 5 KEV listing and published indicators. A compromised TeamCity server hands over stored credentials, build configurations and artifacts, so any instance not on 2025.11.7 or 2026.1.3 should be treated as compromised, indicator-swept and credential-rotated.

[NEW] AhnLab's ASEC documents in a Telerik web-shell attack case two Korean incident cases where the 2019 Telerik UI deserialization flaw CVE-2019-18935 (CVSS 9.8, in unpatched RadAsyncUpload) still delivered the full modern chain: a reverse shell to 206.82.6.22, SweetPotato-family privilege escalation, and a Godzilla web shell injected directly into IIS memory with no file artifact, while a second case used the same entry point to launch a Rust scanner probing 53 WordPress configuration paths and exfiltrating results through a Telegram bot. Sweep for POSTs to /Telerik.Web.UI.WebResource.axd with type=rau and for child processes spawning from w3wp.exe, because clearly the patch backlog from 2020 is still paying someone.

[NEW] A 16-year-old researcher, Faav, disclosed in a write-up on Microsoft's 17-trillion-record exposure over the weekend that Microsoft's internal Titan analytics service accepted unsigned JWTs at its /v2/Query endpoint, so forging the upn claim produced administrator-level SQL access to an environment estimated at 17.3 trillion rows across 17 connected analytics databases; testing stayed bounded to metadata and row samples, and Microsoft Security Response Center locked the endpoint within days of disclosure. No breach is claimed, but the architecture lesson stands: a VPN-gated front end protects nothing once the backend API is directly reachable and signatures go unverified.

[NEW] Researcher Two Seven One Three published a Windows process injection technique that bypasses EDR monitoring, console named-pipe injection, which feeds payload bytes into a child console process such as nslookup.exe or netsh.exe through redirected stdin on a named pipe, then changes page protections and hijacks execution without ever calling the heavily monitored VirtualAllocEx and WriteProcessMemory pair. EDR telemetry keyed to allocate-write-execute patterns will miss it, so detection needs correlation of console spawning, pipe creation and cross-process thread redirects instead.

[NEW] Researchers detail CARBONATO, a Docker-focused botnet that turns daemons exposed without authentication on TCP 2375 into worm-propagating nodes, hides its container as systemd-resolved, persists through cron and systemd timers, tunnels out over reverse SSH, and runs an interactive control layer built on the open-source Hermes Agent framework, prioritizing AI API keys ahead of every other stolen credential. One day of read-only collection against an operator registry left open since May yielded 59 repositories, 234 image tags and 4.3 GB of data, including a parallel operation distributing trojanized cryptocurrency wallet apps; audit Docker daemon exposure now.

[NEW] CERT/CC's VU#234131 chains three unauthenticated flaws in ViewSonic vCast software bundled with ViewBoard smart displays, CVE-2026-82987 through CVE-2026-82989: anyone on the same network can pull screen images from exposed /snapshot and /screen endpoints, install malicious Android applications, and reach full device control through input injection. No exploitation is confirmed yet, but classrooms and boardrooms run these displays, so isolate them from untrusted networks and apply vendor patches when available.

[NEW] Microsoft's September 24 Storm-2570 tracking report describes a ransomware affiliate with unusually repeatable tradecraft that treats the payload itself as a late-stage choice, deploying Qilin, DragonForce or Anubis builds only after access, credential theft and exfiltration are complete, with hunting queries published alongside. The practical read: defend against the affiliate's common playbook of access and staging rather than betting on any single ransomware family's signatures.

[NEW] Qilin's leak-site activity added Touring Club Suisse as a claimed victim, still unverified, while reporting on the MedImpact breach ties the pharmacy benefit manager's incident to Qilin with an 11-month member-notification delay and a potential class action now under investigation. Read the first as a claim and the second as the pattern: ransomware encryption followed by notification timelines measured in months.

Watchlist: the September 30 federal deadline on the NetScaler pair and whether KEV grows to cover the remaining six CVEs in CTX697096; whether Oracle ships an actual PeopleTools patch while the encoded-path exploitation wave keeps expanding; the CVE or advisory that would explain Kiteworks' blackout, still unpublished two days on; ShinyHunters' one-week deadline to publish its claimed FBI archive; and ViewSonic's patch cadence for VU#234131, since no fix was available at disclosure.

Generated by zai/glm-5.3-flash. Input tokens: 84,320, output tokens: 28,211, cache read: 1,386,752, cache write: 0.