Citrix Zero-Days, FBI Portal Breach, and a New CIO at Altera

Security leaders should move fast to patch Citrix NetScaler ADC and Gateway after CISA confirmed CVE-2026-88771 and CVE-2026-88772 are being exploited globally, and take note that the FBI's job-application portals remain offline following a ShinyHunters breach tied to an Oracle PeopleSoft zero-day. Rounding out the week: a fresh CISA KEV addition, a Swiss cybersecurity bill in motion, a researcher's disclosure inside Microsoft, and a new CIO at Altera.

Citrix NetScaler zero-days exploited for weeks, CISA orders federal fix by Sept 30

Citrix has patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which, CVE-2026-88771 and CVE-2026-88772, were exploited as zero-days to plant webshells on unmitigated devices. Warnings surfaced after Dutch NCSC-NL and IT suppliers flagged weeks of activity, with one researcher describing the campaign as likely nation-state espionage. CISA added both flaws to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to remediate by September 30, 2026, and to perform forensic triage. Organizations should check logs for compromise before patching, since updates may erase forensic evidence. (Help Net Security)

CISA adds SharePoint and Mikrotik flaws to Known Exploited Vulnerabilities catalog

CISA added two actively exploited flaws to its Known Exploited Vulnerabilities catalog on September 25, 2026: a Microsoft SharePoint code injection vulnerability (CVE-2026-65660) and a Mikrotik RouterOS behavioral workflow flaw (CVE-2026-67279) that can be chained for unauthenticated exploitation. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV entries on internet-facing assets that grant full control after exploitation, and to check for prior compromise before patching. CISA continues to encourage all organizations, not just federal agencies, to adopt the same risk-based prioritization for these two vulnerabilities. (CISA)

FBI job-applicant portals stay offline after ShinyHunters breach claim

The FBI's job-applicant and special-agent application portals remain offline following what appears to be a successful compromise by the ShinyHunters extortion group. The group told The Register it used an unconfirmed Oracle PeopleSoft zero-day to breach the portals and claims to have accessed FBI managed servers on AWS GovCloud, stealing personnel files, background-check data, and medical records tied to current, former, and prospective employees. Mandiant separately detailed how the group modified its original PeopleSoft exploit to bypass web-application-firewall rules blocking the vulnerable PSEMHUB endpoint, expanding targeting to education, healthcare, and government sectors. (Help Net Security)

Teen researcher finds unverified login tokens exposed Microsoft's internal Titan service

A 16-year-old security researcher disclosed a flaw in Titan, an internal Microsoft analytics service, that could have let an attacker read employee records and Bing search analytics. The researcher found Titan did not verify login-token signatures, letting him pose as an administrator and query 17 connected databases holding an estimated 17.3 trillion rows, including roughly 17,990 employee email records. Microsoft's Security Response Center locked the endpoint down on September 9, 2026, and paid a $5,000 bounty on September 17, 2026, after confirming no customer data was touched. (Help Net Security)

Altera names Nishit Sahay as Chief Information Officer

Altera, the world's largest pure-play FPGA solutions provider, announced that Nishit Sahay has joined as Chief Information Officer, effective September 28, 2026. Sahay will lead Altera's global technology strategy with a focus on strengthening cybersecurity, expanding data use, and advancing enterprise AI, while overseeing the company's IT organization. He joins from Marvell Technology, where he served as Senior Vice President and Chief Information Officer, leading corporate IT, the Data Office, and Enterprise AI initiatives. (Business Wire)

Switzerland moves to consolidate cybersecurity rules into a standalone Cybersecurity Act

Switzerland's Federal Council instructed the Federal Department of Defence, Civil Protection and Sport to draft a standalone Federal Act on Cybersecurity by June 2027, consolidating three parliamentary motions covering product cyber resilience, protection of critical digital data, and obligations for hosting and cloud providers. The new Cybersecurity Act would set binding requirements for manufacturers and importers, modeled on the EU's Cyber Resilience Act, and would transfer the existing obligation to report cyberattacks on critical infrastructure, in force since April 2025, from the Information Security Act. (Swiss Federal Council)