CVE-2024-23692, CVE-2026-61500, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
Get tomorrow's brief in your inbox
Today: Citrix NetScaler zero-day CVE-2026-88779 is under active exploitation just days after two other NetScaler flaws forced emergency patching. Rejetto HFS servers face RCE attacks after a PoC dropped for CVE-2026-61500. ShinyHunters leader arrested in Jordan, cooperating with FBI on identifying other group members.
Citrix NetScaler Zero-Day CVE-2026-88779 Exploited in Targeted Attacks
Citrix patched CVE-2026-88779 (CVSS 8.7), a memory overflow vulnerability in NetScaler ADC and Gateway that causes denial-of-service when configured as a SAML SP or IdP. Attacks began Friday against fully patched systems that had been updated just days earlier for CVE-2026-88771 and CVE-2026-88772. Exploitation appears limited to targeted attacks but honeypot data shows attempts against patched instances, with some evidence suggesting possible RCE capability beyond DoS. Admins reported systems rebooting repeatedly, with logs showing authentication requests carrying shell commands in username fields attempting to plant web shells and exfiltrate configuration backups.
add authentication samlAction) or SAML IdP (add authentication samlIdPProfile) entries to verify exposure. Review logs for suspicious authentication attempts and unusual reboots since October 3.Rejetto HFS CVE-2026-61500 Under Active Exploitation
CVE-2026-61500 (CVSS 9.3) is a session forgery vulnerability in Rejetto HTTP File Server 3.0.0-3.2.0 that enables attackers to forge admin session cookies and achieve remote code execution. The flaw stems from weak PRNG used for session cookie signing keys, with outputs exposed to unauthenticated clients during login. VulnCheck detected exploitation attempts from China targeting US hosts on October 1, one day after Horizon3.ai published technical details. The vulnerability was discovered using Anthropic's Mythos AI model and patched in July 2026 (version 3.2.1), but exploitation began after a public PoC was released September 30.
3 claims tracked across 1 group in the last 48 hours:
| Group | Victim | Sector | Country |
|---|---|---|---|
| Byod | Trump Mobile Wireless | Telecom | US |
| Byod | Eteam | BPO | Unknown |
| Byod | Royal Selangor | Retail | Unknown |
Byod claims data on Trump Mobile (3,615 customers, PII and telecom details), Eteam (BPO list with "extreme PII"), and Royal Selangor (300K registered users/customers, names, emails, phone numbers, addresses, purchase data).
Slate Valley School District Refuses Ransom Payment, Kairos to Leak Student Data
Kairos ransomware group claims 762 GB from Vermont's Slate Valley Unified School District, including 647 GB of SQL databases with student and employee PII. The district's board formally voted October 2 to decline ransom payment. DataBreaches.net verified the data includes current student records with names, DOB, parent information, addresses, and special education IEP documentation from 2026. Records also include employee data. The district was breached September 3 and has not confirmed whether student data was compromised, though they state "it is unlikely for current students."
ShinyHunters Leader Arrested in Jordan, Cooperating with FBI
Saif al-Din Khader (alias "Rey"), alleged leader of ShinyHunters extortion group, was arrested in Jordan and is cooperating with FBI to identify other members. The arrest follows ShinyHunters' hack of FBIJobs.gov and claimed theft of 2-3 TB of data including PII and health information of current and former FBI employees. A 24-year-old Dutch suspect (reportedly Pepijn van der Stap) was arrested last week, connected to hacking 140+ organizations and collecting $70 million in extortion payments. FBI Director Kash Patel indicated more arrests are pending.
CVE-2026-88779: Citrix NetScaler Memory Overflow
See Critical Alerts section above.
CVE-2026-61500: Rejetto HFS Session Forgery
See Critical Alerts section above.
CVE-2024-23692: Rejetto HFS (Historical Context)
Previously exploited HFS vulnerability (CVSS 9.8) added to CISA KEV in July 2024. Multiple threat actors weaponized this flaw to deliver cryptocurrency miners, trojans, and HATVIBE malware. Organizations running HFS should ensure both CVE-2024-23692 and CVE-2026-61500 are remediated.
NetScaler is experiencing a cluster of zero-day exploitation with three CVEs exploited in rapid succession, suggesting either coordinated campaigns or multiple threat actors capitalizing on organizational chaos during emergency patching. The ShinyHunters arrests mark a significant law enforcement win, but the group's claimed FBI breach demonstrates continued operational capability before the takedown.