⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats

Summary: A placeholder domain that appeared in roughly 1,700 repositories was registered by someone and used to serve malicious lures. Citrix released patches for CVE-2026-88771, an improper input validation flaw allowing unauthenticated arbitrary command execution, and CVE-2026-88772, which allows remote code execution or denial-of-service, both under active exploitation, with CISA urging federal agencies to patch by Wednesday.
What's compelling: CISA's statement that threat actors are actively exploiting the Citrix NetScaler flaws globally puts a federal patch deadline of Wednesday against internet-facing gateways that sit in front of many organizations' applications.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-0244 CVE-2026-18311 CVE-2026-18312 CVE-2026-18320 CVE-2026-28324 CVE-2026-28325 CVE-2026-68490 CVE-2026-75682 CVE-2026-75684 CVE-2026-75686 CVE-2026-75689 CVE-2026-75697 CVE-2026-75698 CVE-2026-75745 CVE-2026-75907 CVE-2026-77179 CVE-2026-80143 CVE-2026-80144 CVE-2026-80145 CVE-2026-81995 CVE-2026-82000 CVE-2026-82356 CVE-2026-82987 CVE-2026-82988 CVE-2026-82989 CVE-2026-85102 CVE-2026-86296 CVE-2026-86510 CVE-2026-86552 CVE-2026-86553 CVE-2026-86554 CVE-2026-86555 CVE-2026-86867 CVE-2026-87899 CVE-2026-87900 CVE-2026-87902 CVE-2026-88771 CVE-2026-88772 CVE-2026-89775 CVE-2026-90898 CVE-2026-93485 CVE-2026-93616 CVE-2026-93952 CVE-2026-94127 CVE-2026-94545 CVE-2026-95281 CVE-2026-95284 CVE-2026-95310 CVE-2026-95313 CVE-2026-95322 CVE-2026-95329 CVE-2026-95339 CVE-2026-95349 CVE-2026-95350 CVE-2026-95356 CVE-2026-95357 CVE-2026-96560 CVE-2026-97359 CVE-2026-97360
Related: Critical Forti Mail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes Cyber Risks ·
⚡ Weekly Recap: Net Scaler and Forti Mail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests Cyber Risks ·
Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026