A new unpatched Citrix NetScaler SAML issue triggered appliance crashes and suspected exploitation, Rejetto HFS and Fortra BoKS flaws joined the actively exploited list, and Denmark's DTU disclosed a breach affecting up to 200,000 people.
🟠 HIGH (5)
Citrix NetScaler SAML issue causes crashes and suspected exploitation, patch still pending Under investigation
Citrix has published guidance on a newly identified issue in NetScaler ADC and NetScaler Gateway deployments that use SAML authentication, saying a remote attacker may trigger system crashes and denial of service and that further exploitation is possible. The issue is separate from the CVE-2026-88771 and CVE-2026-88772 zero-days patched in September, and those updates do not fix it. Australia’s ACSC said on 3 October that it is aware of impacts to Australian organisations; admins should check for ‘add authentication samlAction’ or ‘samlIdPProfile’ in the configuration, apply Citrix’s mitigation, and treat repeated appliance reboots as a possible security incident.
Sources Australian Cyber Security Centre|Canadian Centre for Cyber Security|Cybersecurity News
Rejetto HFS admin-takeover flaw exploited in the wild after Mythos-assisted discovery (CVE-2026-61500) Confirmed
Attackers have begun exploiting CVE-2026-61500, a maximum-severity flaw in the open-source Rejetto HTTP File Server that lets an unauthenticated attacker forge an administrator session cookie and run code on the host. The bug was found by Horizon3.ai using Anthropic’s Mythos model and was patched in HFS 3.2.1 on 13 July, but VulnCheck said its sensors saw exploitation from 1 October targeting hosts in the United States and Japan. Admins running HFS 3.0.0 through 3.2.0 should upgrade and check logs for forged-session activity; the flaw is not yet in CISA’s KEV catalog.
Sources The Register|Horizon3.ai
Fortra patches three critical BoKS privileged-access flaws, including predictable AD passwords (CVE-2026-79901) Confirmed
Fortra has fixed eight flaws in BoKS, its Unix and Linux privileged access manager, three of them critical. The worst, CVE-2026-79901 (CVSS 9.9), arises from a weak random number generator used to create Active Directory service-account passwords, making them predictable; other critical bugs allow command injection that can run as root on the BoKS master. Fixes are in BoKS 9.0.0.6, and Fortra has reported no active exploitation, but teams should patch promptly given the access this product controls.
Sources SecurityWeek|Fortra
Technical University of Denmark breach may expose data of up to 200,000 people Under investigation
The Technical University of Denmark said attackers accessed its identity and access management system and downloaded a large amount of data, potentially affecting up to 200,000 current and former students and staff. Danish reporting says names, addresses and CPR national ID numbers dating back to 2003 may be involved. DTU has notified the Danish data protection authority, and affected people should watch for identity fraud.
Sources BleepingComputer|DTU
Warlock ransomware disables security tools at scale via SharePoint flaws Confirmed
Symantec and Carbon Black researchers say the China-linked Warlock group, also tracked as Longlegs and Storm-2603, is continuing to exploit Microsoft SharePoint vulnerabilities to break into critical infrastructure, government and education organisations in Portuguese- and Spanish-speaking countries. In one intrusion the attackers pushed a tool that disables security software to at least 40 hosts within about two hours, then staged ransomware in the domain’s SYSVOL share to deliver it to at least 33 machines. Organisations with on-premises SharePoint should confirm they have patched and mitigated the ToolShell flaws.
Sources The Hacker News
🟡 MEDIUM (1)
Suspected ShinyHunters member 'Rey' detained in Jordan and cooperating with FBI Unconfirmed report
A suspected member of the ShinyHunters extortion group, known online as ‘Rey’, has reportedly been detained in Jordan and is helping the FBI identify other members. The report has not been confirmed by US or Jordanian authorities. ShinyHunters has been linked to a string of data-theft extortion cases against SaaS and enterprise victims.
Sources BleepingComputer
⚪ WATCH (3)
MI5 warns 100+ UK-linked academics took part in research funding China's intelligence effort Confirmed
In a Security Service espionage alert dated 30 September, MI5 said more than 100 academics have taken part in research funded by China’s General Technology Research Institute, which the agency says exists to advance Chinese intelligence gathering. The alert names the institute and urges universities to review partnerships. It is a counter-espionage warning rather than a technical incident.
Sources The Hacker News
Google Gemini could soon gain broad access to Mac files, apps and the web Confirmed
BleepingComputer reports that Google’s Gemini assistant could soon open apps, browse the web and access files on a Mac without asking for permission each time. Agentic access of this kind widens the impact of a prompt injection or a compromised model, so organisations should watch how local AI agents are granted file and app permissions. No vulnerability or exploit is reported.
Sources BleepingComputer
Chainalysis used AI to trace the $387 million Bitget hack to North Korea Confirmed
Chainalysis said it used AI-assisted analysis to follow the on-chain trail of the roughly $387 million stolen from crypto exchange Bitget and attribute it to North Korea-linked actors. The tracing adds investigative detail to the September theft, which Bitget has said stemmed from a third-party zero-day. The disclosure is an investigation update, not a new incident.
Sources Decrypt|Chainalysis
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.