Citrix rushed out an emergency NetScaler patch for a SAML denial-of-service zero-day now in CISA's exploited list, a wave of breaches at South Korean banks drew a presidential probe, and China-aligned attackers phished US AI policy experts.
🔴 CRITICAL (1)
Citrix patches NetScaler SAML zero-day exploited in attacks, CISA adds it to KEV (CVE-2026-88779) Confirmed
Citrix released emergency updates for CVE-2026-88779, a memory buffer flaw (CVSS 8.7) that lets an unauthenticated attacker crash NetScaler ADC and NetScaler Gateway appliances configured as a SAML service provider or identity provider, causing a denial of service. Citrix says it has observed targeted attacks on unpatched appliances, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 4 October with a 7 October deadline for federal agencies. Researchers are investigating whether the flaw can also be used for remote code execution. Administrators who already patched September’s NetScaler zero-days must upgrade again, to 14.1-73.41 or 13.1-64.28 plus the matching FIPS builds, and can check the running configuration for ‘add authentication samlAction’ or ‘add authentication samlIdPProfile’ to confirm exposure.
Sources Citrix|CISA|BleepingComputer
🟠 HIGH (2)
South Korean banks hit by wave of data breaches, President orders national probe Under investigation
A rapid run of data breaches at South Korean financial institutions, including Shinhan Bank, KB Kookmin Bank and Hana Bank, exposed customer information, with Shinhan confirming that data on about 25,000 customers such as names, phone numbers and annual income was leaked. The Financial Services Commission ordered banks, card issuers and savings institutions to inspect their internet-facing systems, and President Lee Jae Myung called for a thorough investigation and response measures on 4 October. Reports say AI tools may have assisted at least one of the attacks. Financial firms should review access controls and monitor for automated intrusion attempts.
Sources Reuters|Korea Times
China-aligned TA419 phishes US AI policy experts via Microsoft adversary-in-the-middle attacks Confirmed
Proofpoint reports that a China-aligned espionage group it tracks as TA419 impersonated a former White House science and technology official, other policy figures and an Anthropic employee to phish people working on US AI policy at think tanks, universities and law firms. The campaign opened with benign introduction emails, then used a spoofed Microsoft OneDrive login page to capture session cookies and reach cloud accounts, targeting fewer than ten people. Defenders should treat unsolicited invitations from named experts as suspicious, verify through a second channel, and move sensitive accounts to passkeys.
Sources Proofpoint|The Hacker News|CyberScoop
🟡 MEDIUM (1)
Unnamed DeFi vault on Base drained of about $6 million in wrapped staked Ether Under investigation
An unidentified DeFi vault on the Base network lost roughly 1,783 wrapped staked Ether, about $6 million, on 4 October after a newly deployed contract gained whitelist access and borrowed against the vault’s position on Aave V3. Security firms Blockaid, Spot On Chain and PeckShield traced the funds, and both Aave and Base were confirmed not to have been breached. The case points to access-control weaknesses in the vault rather than a protocol flaw.
Sources CryptoTimes|Blockonomi
⚪ WATCH (1)
Trump names intelligence chief Jay Clayton to lead new federal AI task force Confirmed
President Trump named Director of National Intelligence Jay Clayton, a former SEC chair, to lead a new federal AI task force reported to be called the Super Intelligence Force, tasked with coordinating US AI policy. The appointment places a figure known for crypto enforcement cases at the centre of federal AI direction. Security teams should watch for forthcoming policy and procurement changes that affect AI risk management.
Sources Decrypt|SecurityWeek
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.