Daily Brief
Citrix Flaws Exploited Globally; OT Zero-Day Risks Industrial Crash
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
CISA has added two critical vulnerabilities in Citrix NetScaler ADC and Gateway (including CVE-2026-88771, CVSS 9.5) to its Known Exploited Vulnerabilities catalog. These flaws allow unauthenticated attackers to perform improper input validation, and they are currently being exploited globally.
Prioritise patching all Citrix NetScaler ADC and Gateway instances immediately to address CVE-2026-88771 and related critical vulnerabilities.
One Packet Can Crash OT Servers in Industrial Sectors
A high-severity zero-day vulnerability in the TDengine time-series database allows attackers to crash servers using a single malicious packet. This database is widely used in industrial IoT, energy, and automotive sectors to manage time-series data from sensors and industrial controllers.
Identify TDengine deployments within OT environments and implement network segmentation to isolate these databases from external traffic until a patch is applied.
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
Apple has patched a critical out-of-bounds write vulnerability (CVE-2026-86950) in the CoreGraphics component across older versions of iOS, iPadOS, and macOS. The flaw, which allows arbitrary code execution via crafted files, may have been exploited in targeted attacks.
Ensure all legacy Apple devices in the enterprise fleet are updated to the latest available security releases to mitigate CoreGraphics exploitation.
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
The threat actor JADEPUFFER (Storm-3168) has been observed using compromised service principals to conduct destructive attacks within Microsoft Azure environments. The group exfiltrated credentials and subsequently deleted core cloud resources, including databases and applications, within an 18-hour window.
Review Azure service principal permissions and implement strict conditional access policies to prevent unauthorised resource deletion.
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Cryptocurrency exchange Bitget lost $388 million after attackers exploited a vulnerability in a third-party security product to obtain high-level internal credentials. The attackers used these credentials to issue fraudulent withdrawal commands to the exchange's wallet system on 24 September.
Audit the permissions and security posture of third-party security integrations that hold high-level administrative credentials for sensitive financial systems.