NetScaler Zero-Days, FBI Breach Claims, and Fresh Security Leadership Moves

Security leaders start October knowing that suspected state-sponsored actors have been exploiting a Citrix NetScaler zero-day since early September, while the FBI's job-application portals remain offline after the ShinyHunters group claimed a breach via an Oracle PeopleSoft flaw. Apple and CISA pushed fixes for separately exploited zero-days, Astrana Health and Hasbro disclosed breaches rooted in social engineering, and Lumen named a new Chief Security Officer.

Suspected state-sponsored actors exploited NetScaler zero-day since early September

Mandiant and Google's Threat Intelligence Group say advanced, suspected state-sponsored threat actors likely drove the earliest exploitation of CVE-2026-88772, one of two Citrix NetScaler ADC and Gateway zero-days patched this week. The campaign has hit dozens of organizations across North America and Europe spanning government, financial services, education, telecommunications, and legal and professional-services sectors. Exploitation abuses an authentication bypass that crashes NetScaler's packet-processing engine to gain root access. Mandiant's CTO warned that simply upgrading firmware does not remove attackers already inside networks or address stolen credentials, so incident response and credential rotation are required alongside patching. (Help Net Security)

CISA adds actively exploited Cisco Catalyst SD-WAN Manager bug to KEV catalog

CISA added CVE-2026-76504, a hex-encoding vulnerability in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities catalog on September 30, 2026, citing evidence of active exploitation. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV-listed flaws found on internet-facing assets that grant full control after exploitation, and to check whether systems were compromised before patching. CISA encourages all organizations, not just federal agencies, to adopt the same risk-based prioritization and remediate the flaw promptly. (CISA)

Apple patches CoreGraphics zero-day used in a sophisticated targeted attack

Apple shipped iOS, iPadOS, and macOS updates fixing CVE-2026-86950, an out-of-bounds write vulnerability in the Core Graphics framework that enables arbitrary code execution when a vulnerable device processes a malicious file. Apple said it is aware of a report that the flaw may have been exploited in an extremely sophisticated attack against specific targeted individuals running versions of iOS before iOS 27. Fixes are included in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1; Apple's newest iOS 27.0.1 and macOS Golden Gate 27.0.1 releases were not listed as affected, though all users should update promptly. (Help Net Security)

FBI job-application portals remain offline after ShinyHunters breach claims

FBI's online job-applicant and special-agent application portals remained offline after the ShinyHunters extortion group claimed to have breached them via an Oracle PeopleSoft zero-day, along with FBI's AWS GovCloud-managed servers. The FBI has confirmed it is investigating claims that personal information belonging to current, former, and prospective employees was stolen, including data from platforms covering background checks, medical records, and investigative information. Mandiant separately detailed how the same actors modified their original PeopleSoft exploit to bypass web-application-firewall rules blocking the vulnerable endpoint, expanding targeting beyond academia into healthcare, technology, transportation, and government institutions. (Help Net Security)

Astrana Health discloses material breach after employee social-engineering attack

Healthcare management company Astrana Health told the SEC that threat actors impersonated company personnel, spoofed its main phone number, and tricked employees into granting system access, rather than exploiting a software flaw. The company determined on September 22, 2026 that the incident was material given the sensitive nature of data involved, which may include patient, employee, credentialed-provider, intellectual-property, and confidential business and financial information. Astrana engaged a forensics firm, notified law enforcement, reset affected credentials, restricted remote-access tools, and restored systems from clean backups; no ransomware group has claimed responsibility. (The HIPAA Journal)

Hasbro confirms March breach began with vishing, six months after disclosure

Hasbro told Massachusetts regulators that the network intrusion it disclosed in an April 8-K began with vishing and social engineering rather than malware, roughly six months after it first flagged unauthorized access on March 28, 2026. The toy and entertainment company took certain systems offline, engaged outside forensics specialists, and invoked business-continuity procedures to keep shipping products during the investigation. The gap between the original filing and the newly disclosed attack method illustrates how long it can take companies to explain exactly how an intrusion happened, even after regulatory disclosure requirements are met. (Tech Insider)

Lumen names Kim Keever as Chief Security Officer

Lumen Technologies has appointed Kim Keever as Chief Security Officer to lead enterprise-wide security strategy spanning the company's physical, digital, and operational assets. Keever previously served as Chief Information Security Officer at Cox Communications and sits on the National Security Telecommunications Advisory Committee, which advises the US government on telecommunications resilience and national security. Lumen said the move supports its push toward automated network protection and integrated cybersecurity services backed by its Black Lotus Labs threat-research unit as AI adoption changes the risk picture for network providers. (Pulse 2.0)