🚨 Second NetScaler zero-day CVE-2026-88779 lands on KEV, 🔴 FortiMail 9.8 file-write zero-day KEV'd amid mass scanning, 🎭 Alleged ShinyHunters leader caught in Jordan and cooperating, 🇰🇷 Seoul probe flags AI-powered bank attacks, 🧩 GlassWorm hides loaders in VS Code color themes, 🤖 Google suspends OSS bug bounty under AI spam surge

[UPDATE] The NetScaler zero-day crisis split in two: Citrix confirmed CVE-2026-88779 (CVSS 8.7), a memory overflow hitting NetScaler ADC and Gateway instances configured as a SAML SP or IdP, which explains last week's reboot loop on fully patched appliances, and CISA has added it to KEV after Citrix observed targeted attacks on unmitigated deployments that can keep services down persistently. SecurityWeek reports researcher Kevin Beaumont, who dubbed it PitScaler 2, has seen exploitation attempts against patched honeypots, and Citrix so far claims availability impact only. Meanwhile defenders got fresh hunting material for the first zero-day: CVE-2026-88771 footholds are held through PHP web shells disguised as CSS files.

[REVISIT] Fortinet's FortiMail zero-day CVE-2026-104286 is now formally on CISA's KEV catalog, turning what scanners already showed into a statutory clock: a CVSS 9.8 path traversal letting unauthenticated attackers write arbitrary files, disclosed October 1 with exploitation confirmed. Fixed builds 7.4.9, 7.6.7 and 8.0.2 are the exit, and with mass scanning against FortiMail edges already underway, patching this week is the sane default.

[UPDATE] The ShinyHunters arrest story gained a head: Reuters and SecurityWeek identify the detainee, Saif al-Din Khader aka Rey, a teenage cybercriminal from Amman, as the group's alleged leader and a Scattered Lapsus$ Hunters member, now reportedly walking the FBI through a crew blamed for more than 140 victims and roughly $70 million in extorted payments.

[UPDATE] Seoul's bank breach probe widened: President Lee Jae Myung has ordered a comprehensive investigation into the leaks at Shinhan, Woori and other institutions, with regulators flagging that attackers may have used AI-enabled offensive security tools, and Welcome Savings Bank separately confirmed a breach touching 2,200 corporate clients.

[NEW] Google suspended product-vulnerability submissions to its open-source bug bounty effective October 1 after a flood of AI-generated reports, the vast majority invalid, keeping supply chain reports and the Patch Rewards Program open while promising a restructured program in Q1 2027; when AI noise overwhelms triage at Google, every bounty program is on notice. The same company disclosed that PageBreak, its internal AI security agent, has validated more than 500 XSS vulnerabilities across its first-party web applications, the offensive mirror of the same automation curve.

[NEW] GlassWorm moved into editor cosmetics: researchers at Socket found malicious loaders hidden inside VS Code color themes on both the Visual Studio Marketplace and the Open VSX Registry, including extensions with more than 8,000 installs such as a Coca-Cola theme, executable JavaScript that no pure color package has any business carrying. Themes install with near-zero scrutiny, which is exactly what makes them a clean initial-access vector; audit installed themes for unexpected scripts.

[NEW] Backup software is the crown-jewel beat again: CVE-2026-105134 is a critical OS command injection in Ahsay AhsayCBS versions up to 10.3.2, reachable through the Replication Receiver endpoint at /rps/api/json/UpdateReceivers.do for remote command execution. No exploitation or fix is confirmed yet, so isolate backup servers from untrusted networks and watch for the vendor advisory.

[NEW] The ZITADEL identity platform fixed a cluster of seven CVEs topped by CVE-2026-105209 (CVSS 9.3): forging the x-zitadel-orgid header lets an attacker issue passkey enrollment for any user in any organization, a cross-org authentication bypass that ends in full account takeover. Upgrade now and audit existing passkey enrollments for entries you did not create.

[NEW] Mac developers are the target of an AMOS stealer campaign delivered through malicious ads impersonating Claude Code, captured by malware-traffic analysis on October 2: a fake setup guide for the AI coding tool installs the stealer, which harvests credentials and sensitive data. AI-branded lures now work well enough on precisely the audience most likely to paste untested commands.

[NEW] ASUS patched two critical router firmware flaws, CVE-2026-14157 and CVE-2026-13313, authentication bypass and remote execution paths triggered through malicious VPN configuration files. Router firmware updates move slowly, so apply this one before the VPN-parsing bug class finds a botnet.

[NEW] A phishing campaign is abusing the legitimate ScreenConnect client, delivering a genuine, digitally signed ConnectWise remote-access client preconfigured to call operator-controlled infrastructure, with an unpaid-invoice lure citing a $5,745.65 payment. Signed RMM tooling defeats allowlisting by design, which is why RMM abuse keeps showing up in incident data.

Watchlist: whether CVE-2026-88779 exploitation on NetScaler is confirmed beyond denial of service and what the next emergency build changes for SAML deployments, the federal KEV clock on FortiMail CVE-2026-104286 as scanning continues, what Rey's cooperation produces for the FBI's ShinyHunters case after last week's Dutch arrest, today's BOD 26-04 deadline on the Zammad pair for federal agencies, and the AhsayCBS advisory that turns CVE-2026-105134 from theory into a patch.

Generated by zai/glm-5.3-flash. Input tokens: 77,241, output tokens: 36,586, cache read: 1,066,624, cache write: 0.