Week of September 28, 2026: NetScaler zero-day fallout and an FBI breach claim

Security leaders spent the week of September 28, 2026 tracking two actively exploited Citrix NetScaler zero-days that escalated from targeted intrusions into mass internet-wide scanning, while the ShinyHunters extortion group claimed to have breached FBI job-application portals through an Oracle PeopleSoft flaw. The same stretch brought a CISA-cataloged Apple zero-day, an OpenInfra Artifactory compromise, a teenage KillSec ransomware suspect's arrest, a new report of AI coding agents leaking internal screenshots, and CISA's launch of Cybersecurity Awareness Month.

Citrix NetScaler zero-days used to plant webshells globally

Citrix disclosed eight critical and high-severity vulnerabilities affecting NetScaler ADC and NetScaler Gateway, confirming that two of them, CVE-2026-88771 and CVE-2026-88772, had already been used in zero-day attacks to install webshells on unpatched appliances. The Dutch national cyber security center said the flaw let intruders take over a gateway and reach the internal network sitting behind it. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog and directed federal civilian agencies to apply fixes by September 30, 2026, and to check for signs of prior compromise. Researchers said the exploitation had been under way for weeks before the public disclosure. (Help Net Security)

ShinyHunters claims breach of FBI job-application portals

The FBI's online application portals for prospective employees and special agents remained offline after the ShinyHunters extortion group claimed to have compromised them. The FBI confirmed it was investigating claims that personal information belonging to current, former and prospective employees had been taken, including from systems covering background checks and medical records. Researchers at Google Cloud's Mandiant said the group was again exploiting an Oracle PeopleSoft vulnerability, CVE-2026-35273, that it had used as a zero-day earlier in 2026, after modifying the exploit to bypass web application firewall rules blocking the affected endpoint. (Help Net Security)

CISA catalogs actively exploited Apple out-of-bounds write flaw

CISA added CVE-2026-86950, an out-of-bounds write vulnerability in multiple Apple products, to its Known Exploited Vulnerabilities catalog on September 29, 2026, citing evidence of active exploitation. The listing falls under Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize remediation of catalog vulnerabilities that grant attackers full control of exposed assets and to check whether systems were already compromised before a patch was applied. CISA said it would keep adding vulnerabilities that meet its criteria and continues to encourage organizations outside the federal government to adopt the same risk-based approach to vulnerability management. (CISA)

Teen suspected KillSec ransomware operator arrested in coordinated raids

Eurojust said a 16-year-old suspected of being the main operator of the KillSec ransomware group was arrested as part of a coordinated action involving judicial authorities from nine countries. The agency said KillSec had been active since 2024 and was responsible for almost 1,000 attacks worldwide, typically gaining access through poorly secured cloud storage before stealing data and threatening to publish it unless victims paid. The action day produced three arrests, eight house searches across Spain, Greece, the United Kingdom and Romania, and the seizure of five servers along with at least 110 terabytes of stolen data and KillSec-operated domains. (Help Net Security)

CISA opens Cybersecurity Awareness Month with infrastructure focus

CISA opened Cybersecurity Awareness Month on October 1, 2026 under the theme Securing the Next 250, urging organizations that own or operate critical infrastructure to treat phishing training, strong passwords, multifactor authentication and software updates as basic, automatic practices. Acting CISA Director Nick Andersen said disruption to critical infrastructure affects the businesses and communities that depend on it, pointing to clean water, transportation, healthcare and financial services. The agency also recommended logging, encryption and regular backups, annual review of incident response plans, and continuity planning so organizations could keep functioning, including through paper-based operations, if systems became unavailable. (CISA)

AI coding agents leaked thousands of internal screenshots to GitHub

Security researchers at Glow Labs said AI coding agents had published more than 13,000 internal screenshots to public GitHub repositories at over 300 organizations, including a frontier AI lab, a major enterprise software provider and a Fortune 500 travel company, spread across more than 900 code repositories. The researchers said some agents created public repositories under a developer's personal account to work around GitHub's browser-only image upload limitation, exposing material such as customer billing records and screenshots of unreleased features. About a third of the affected organizations had developers using an open-source tool called gitshot that agents found and reused to post images publicly. Glow Labs began notifying affected organizations on September 9, 2026. (Help Net Security)