NetScaler KEV Deadline, Atlassian Exploits Begin, New CISOs at Lumen and ADM

Security leaders face a tight remediation clock after CISA ordered federal agencies to patch a crashing NetScaler flaw by October 7, while watchTowr's technical breakdown of Atlassian's critical Data Center file-access bug (CVE-2026-21589) was quickly followed by real exploitation attempts against honeypots. Away from vulnerabilities, a suspected ShinyHunters member was detained in Jordan, and Lumen, Accenture Federal Services and ADM all named new security chiefs this week.

CISA sets October 7 deadline as attackers crash patched NetScaler appliances

CISA added CVE-2026-88779, a memory overflow flaw in Citrix NetScaler ADC and Gateway appliances, to its Known Exploited Vulnerabilities catalog after Citrix observed targeted attacks causing denial-of-service conditions. The bug only affects on-prem deployments configured for SAML authentication alongside Gateway or AAA functionality. Researchers reported crashes and reboots on appliances recently patched for two other actively exploited zero-days, with attackers apparently attempting to install webshells. CISA ordered federal civilian agencies to remediate by October 7 and check for signs of compromise, while Citrix pushed temporary signatures to block known malicious IP addresses. (Help Net Security)

Exploitation begins against critical Atlassian Data Center file-access flaw

Atlassian's critical arbitrary file access vulnerability, CVE-2026-21589, carries a 9.3 CVSS score and affects all versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center products plus Crucible and Fisheye. A day after patches shipped, watchTowr published technical details tracing the flaw to a routing library that mishandles path traversal, and threat intelligence vendor Previdian reported exploitation attempts hitting its honeypot network. Attackers who read Crowd's plaintext configuration file could escalate to Jira administrator. Atlassian urges immediate upgrades or taking vulnerable instances offline, and recommends checking access logs for compromise indicators. (Help Net Security)

Dell warns of root-privilege flaw in System Update tool for PowerEdge servers

Dell is urging administrators to patch CVE-2026-86360, a path traversal flaw in Dell System Update with a 9.6 CVSS score, which could let an unauthenticated remote attacker execute arbitrary code with root privileges on PowerEdge server management tools. Successful exploitation could fully compromise the application and underlying operating system. Dell also fixed four other high-severity DSU flaws, two allowing remote code execution and two enabling privilege escalation. The company recommends upgrading to DSU version 2.3.0.0 or later at the earliest opportunity; the advisory does not say whether any of the flaws have been exploited. (Help Net Security)

Suspected ShinyHunters member detained in Jordan amid ongoing FBI probe

A suspected ShinyHunters member known as Rey, identified as Saif al-Din Khader, was detained in Jordan last week and is reportedly helping the FBI identify other members of the hacking group. The arrest follows ShinyHunters' claimed breach of FBI job-applicant portals through an Oracle PeopleSoft zero-day, which the group said exposed personnel files including medical information. A 24-year-old man from Amsterdam was separately arrested as part of the same investigation. ShinyHunters has been linked to recent breaches at ADT, the European Commission, Aura and Rockstar Games, and the FBI says it expects more arrests. (Help Net Security)

Lumen names Kim Keever chief security officer

Lumen has named Kim Keever as chief security officer, bringing more than a decade of experience as chief information security officer at Cox Communications plus a recent role at Spectrum. Keever also serves on the US National Security Telecommunications Advisory Committee, which advises the President on connectivity infrastructure security. The appointment comes as Lumen expands its network-as-a-service business following its $475 million acquisition of Alkira, with Keever expected to bolster security measures alongside the company's threat-intelligence partnership with Palo Alto Networks that extends its Multi-Cloud Gateway service to more than 10 million US business locations. (SC Media)