Daily Brief
Urgent Citrix Patching and AI Supply Chain Risks
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
Citrix has confirmed that two critical zero-day vulnerabilities in NetScaler ADC and Gateway are being actively exploited in the wild. One of these flaws allows remote code execution (RCE) on all deployments of affected versions, including those using default configurations. Six additional vulnerabilities were also addressed in the same update.
Immediately apply the latest security updates for NetScaler ADC and NetScaler Gateway, prioritising internet-facing appliances.
Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors
Anthropic has launched a marketplace for Claude, featuring over 2,000 third-party plugins, connectors, and agents. While expanding functionality, these integrations introduce new supply chain risks and potential data egress points within the enterprise AI environment.
Review and restrict the use of third-party AI plugins via CASB or web filtering until a formal third-party risk assessment is completed.
CISA orders feds to patch exploited Citrix flaws by Wednesday
CISA has added the Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating that US federal agencies apply patches by Wednesday. The urgency follows reports from security researchers that these flaws provide a direct path for attackers to gain initial access to corporate networks.
Use CISA's KEV catalog to audit your environment for these Citrix flaws and enforce a 48-hour patching window for critical perimeter assets.
OpenAI is preparing “o,” an always-on ChatGPT assistant that could handle email
OpenAI is reportedly testing an 'always-on' assistant capable of managing emails and other background tasks. This persistent access model increases the potential impact of prompt injection and session hijacking if the assistant is granted broad permissions to sensitive communication channels.
Update acceptable use policies to address persistent AI assistants and ensure 'human-in-the-loop' requirements for automated email actions.