BigDiskBuster PoC silently blocks Windows Defender updates by exhausting disk space during update staging, leaving the engine running but security intelligence stale with no patch available.
BigDiskBuster opens raw NT handles to C:\ and MRT.exe, recursively watches the volume for Defender update activity, then creates GUID-named hidden files in %TEMP% sized to claim all free space. Defender updates fail with generic error 0x80070643 while the service reports healthy. The tool re-arms on every size-change event, racing to refill any freed space until the update aborts.
CVE-2026-88779, a high-severity memory overflow in Citrix NetScaler ADC and Gateway SAML configurations, is under active targeted exploitation and listed in CISA's KEV Catalog.
The flaw is a memory overflow in NetScaler ADC and Gateway when configured as a SAML SP or IdP, causing denial of service that disrupts authentication and remote access. Only customer-managed appliances are affected; Citrix-managed cloud services are patched. CISA has confirmed active exploitation and added the CVE to its KEV Catalog.
ClickFix tricks users into pasting obfuscated commands into Windows Run dialog, using finger.exe as a LOLBIN to fetch payloads, bypassing file-based endpoint security entirely.
ClickFix defeats endpoint security by eliminating the file artifact—users paste obfuscated commands directly into the Run dialog. The technique uses caret escaping to evade string matching and Windows finger.exe to fetch payloads over the finger protocol. Huntress's Attack Disruption engine kills these chains in under one second by matching command-line shape gated behind explorer.exe as parent process.
ClingSTUN Linux backdoor exploits 30+ unpatched IoT CVEs to infect devices, abusing public STUN servers for NAT traversal while establishing persistence and remote command execution.
ClingSTUN is a Linux back-connect proxy backdoor targeting internet-facing IoT devices through known CVEs across multiple vendors. It uses three downloader iterations with shifting infrastructure. The malware persists via boot scripts, disguises itself as the init process using bind mounts, disables watchdog timers, and contacts legitimate public STUN servers to maintain NAT connectivity for remote operator access.
Weekly bulletin: Citrix NetScaler, Cisco SD-WAN Manager, Apple CoreGraphics, and GitLab AI Gateway flaws under active exploitation; Warlock, Star Blizzard, TA419, and UAT-11587 campaigns detailed.
Active exploitation of critical Citrix NetScaler and Cisco SD-WAN Manager flaws enables remote access, web shell deployment, and lateral movement; Cisco has no fix yet. Espionage actors UAT-11587, TA419, and Star Blizzard target government and policy organizations with tailored phishing and backdoors. Warlock ransomware exploits SharePoint ToolShell flaws to disable endpoint protection and encrypt hosts.
CVE-2026-88779 in Citrix NetScaler ADC and Gateway is exploited in the wild and added to CISA's KEV catalog; patch affected versions immediately.
Citrix NetScaler ADC and NetScaler Gateway builds prior to the listed fixed versions are vulnerable to CVE-2026-88779, which Citrix states is exploited in the wild. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 4, 2026. Administrators should apply updates as they become available.
The dominant development this week was the active exploitation of two pre-authentication zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances. CVE-2026-88771 enables unauthenticated command injection and CVE-2026-88772 triggers a heap buffer overflow via DTLS, both confirmed exploited in the wild before patches were available. Multiple research teams published technical analyses, exploitation artifacts, and post-compromise tooling details, while CISA added a third related NetScaler flaw (CVE-2026-88779) to its Known Exploited Vulnerabilities catalog on October 4.
Beyond NetScaler, reporting covered AI-enhanced malware using commercial language models for post-compromise decisions, synthetic media social engineering causing multi-million-dollar fraud, ClickFix attacks abusing ChatGPT Custom GPTs, supply chain compromises across VS Code extensions and WordPress ecosystems, ransomware operations targeting water and telecom utilities, and a broad set of ICS/OT and IoT vulnerability disclosures from CISA affecting cellular base stations, cameras, building controllers, EV charging systems, and physical access control platforms.
CISA added CVE-2026-88779, a Citrix NetScaler memory buffer vulnerability under active exploitation, to its Known Exploited Vulnerabilities Catalog.
The flaw is an improper restriction of operations within the bounds of a memory buffer in Citrix NetScaler, a class CISA flags as a frequent attack vector. CISA states it is actively exploited. BOD 26-04 requires FCEB agencies to remediate KEV-listed flaws on exposed assets and check for prior compromise.
ENISA's 2026 Threat Landscape identifies ransomware as the highest-impact threat, DDoS as the most frequent, and AI-driven attacks as an expanding surface across EU sectors.
Vulnerability exploitation accounts for 60% of identified intrusion vectors across EU incidents. Ransomware drives 40% of financially motivated cybercrime events, while low-impact DDoS dominates by volume at 51% of cases. Supply-chain and third-party attacks produce large-scale incidents. AI serves dual roles as both attacker tool and attack target, expanding the surface for cybercrime and information manipulation.
Two critical Citrix NetScaler ADC and Gateway vulnerabilities are under active exploitation worldwide; a separate unpatched SAML DoS issue also affects patched appliances.
CVE-2026-88771 enables unauthenticated remote code execution on NetScaler appliances via improper input validation. CVE-2026-88772 is a buffer overflow allowing code execution, memory corruption, or denial of service. A distinct SAML authentication issue introduced in Update 1 causes system instability and reboots, and is not remediated by existing patches.
Ransomware first-day response fails on decisions, not technique—attackers dwell 14 days, exfiltrate within hours, and target backups before encrypting.
Median dwell time before encryption is 14 days, with initial access brokers handing off to ransomware crews in as little as 22 seconds. Attackers exfiltrate data within hours using legitimate admin tools and deliberately destroy backup infrastructure before deploying encryption.
Johnson Controls EasyIO Neo controllers transmit credentials in cleartext over HTTP, enabling network attackers to intercept session data via CVE-2026-64893.
CVE-2026-64893 enables man-in-the-middle interception of credentials and session tokens transmitted in cleartext over HTTP to EasyIO Neo EC and CW building automation controllers. Attack requires network positioning and user interaction. Fixed in EC firmware V3.3b64 and CW firmware V3.3b26. Affected deployments span critical manufacturing, energy, transportation, and government facilities worldwide.
CISA added two actively exploited Zammad vulnerabilities to the KEV Catalog, requiring urgent patching of session fixation and privilege management flaws.
CVE-2026-102489 (session fixation) and CVE-2026-102490 (improper privilege management) in Zammad are being actively exploited per CISA. Federal agencies must remediate per BOD 26-04 and check for prior compromise.
Trail of Bits releases SequenceHash and SequenceMAC, hash-agnostic multihashing constructions that prevent ambiguous input encoding and length-extension attacks in cryptographic protocols.
SequenceHash uses 128-bit length-suffix encoding and a double-hash construction to provide unambiguous multihashing with any secure hash function, unlike NIST's TupleHash which requires Keccak. SequenceMAC adds keyed mode with a 32-byte minimum key, fixing HMAC key pseudocollision issues. Implementations in Rust, Go, and Python are released with test vectors under C2SP.
GlassWorm-linked malicious VS Code theme extensions across VS Code Marketplace and Open VSX deliver staged loaders using Solana blockchain dead-drops and AES-encrypted payloads to steal developer credentials.
Two confirmed malicious VS Code theme extensions deliver staged malware loaders. Cosmic Nebula Themes decrypts AES-256-CBC embedded JavaScript, queries a Solana address for next-stage infrastructure via transaction memos, and executes remote code in memory with Node.js capabilities. Aurora Nocturne Night Theme downloads and executes a batch file linked to XWorm RAT infrastructure.
CVE-2026-104286 is a path traversal vulnerability in Fortinet FortiMail, actively exploited in the wild and added to CISA's KEV catalog.
FortiMail versions across branches 7.2 through 8.0 are vulnerable to CVE-2026-104286, a path traversal flaw. CISA confirmed active exploitation and added it to the KEV database on October 1, 2026.
Meari IoT Cloud Platform OpenAPI Service has two missing-authorization flaws letting authenticated users alter device configs and read device credentials; no fix is planned.
Two missing-authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI Service let any authenticated user manipulate or read data from devices they do not own. CVE-2026-101104 enables unauthorized configuration changes; CVE-2026-96613 leaks device credentials, owner details, and telemetry.
ANY.RUN's September digest adds 1,100+ detection rules and covers IronToll PhaaS, CSuite device-code phishing, Nyan malware, and an HVNC backdoor targeting Latin America.
IronToll PhaaS imitates government websites to steal payment cards via WebSocket panels with live operator interaction. CSuite targets US and EU organizations with device-code phishing abusing Adobe and DocuSign lures to hijack Microsoft 365 sessions. Nyan malware masquerades as CPUID Hardware Monitor, reads machine GUID from registry, and performs system information discovery.
Four unpatched vulnerabilities in Monta's EV charging platform enable unauthorized administrative control and denial-of-service attacks against charging stations worldwide.
WebSocket endpoints lack authentication, rate limiting, and session validation across all versions of monta.app. Attackers can impersonate charging stations using publicly exposed identifiers, brute-force authentication, or hijack predictable sessions. Energy and transportation sectors are affected globally with no patched version available.
Armatura One access-control system ships five vulnerabilities including a critical Apache ActiveMQ deserialization RCE already exploited in ransomware campaigns; upgrade to V4.7.2 or V4.6.1_USA immediately.
Armatura One embeds Apache ActiveMQ vulnerable to CVE-2023-46604, enabling unauthenticated remote code execution with highest privilege. Four additional CVEs expose hard-coded crypto keys, fixed database superuser passwords, and plaintext credential logging, compounding post-compromise risk.
