Cyber, in brief

Attackers used two holes in Citrix's NetScaler boxes before any fix existed, the security firm watchTowr said on Saturday 26 September. [2][1]

NetScaler boxes sit at the edge of a company's network. They check who is logging in and let staff reach work systems from outside. [2]

The same day, administrators wrote on Reddit that their IT suppliers had phoned to tell them to switch their NetScalers off at once, without giving details. [1][2]

Others said police, emergency response teams and national cyber agencies had been contacting organisations too. [1]

A private notice from the Netherlands' National Cyber Security Centre, copied online, said each hole on its own lets an attacker run their own code on the box. [1]

The notice said Citrix found the holes while investigating break-ins at its customers, and that several customers around the world had been hit. [1]

Before Citrix spoke, watchTowr had named no victim and shown no evidence. Some administrators took their boxes offline rather than wait. [2]

On Sunday CISA, the US cyber-defence agency, said Citrix had disclosed eight new flaws in NetScaler. [3]

CISA put two of them on its list of flaws used in real attacks, and said attackers are using them around the world. [3]

CISA asks owners to look for signs of a break-in before they update, because updating can wipe the traces an investigator needs. [3]

Under a CISA directive, US federal agencies have rules on when they must check for a break-in before fixing a flaw on that list. [4]

Citrix has published signs of a break-in to look for, in its NetScaler Console product and in a security bulletin. [3]

These are not the NetScaler flaws Citrix fixed on 19 August. CISA listed one of those as under attack on 9 September. [2][1]

The Dutch notice warned that attacks could grow once Citrix publishes its fixes and the details. [1]

Why it matters. Watch whether Citrix's fixes reach the older 13.1 version, and whether attacks grow once the details are public, as the Dutch notice warned. [2][1]

US prosecutors have charged Lee Reiber, chief executive of Oxygen Forensics, and Oleg Davydov, its chief technology officer, with conspiracy to commit wire fraud. [7][5] Oxygen, based in Virginia, sells software that pulls data off phones for investigators, and US agencies including the Secret Service bought it. [7][5] Prosecutors say five Russians secretly owned it through a Cyprus company, and its software was written in Russia. [5][7] Reiber was arrested in Idaho on Sunday 20 September, and Davydov at London's Heathrow Airport. [7][5]

Why it matters. Russia's FSB security service bought the same software under another name from a company run by Davydov, prosecutors say. [7][5] US officials say they would not have bought it had they known who owned it, and prosecutors do not claim it contained harmful code. [6][7]

ShinyHunters, an extortion gang, is attacking servers running Oracle's PeopleSoft software again, Google's Mandiant team says. [8] Oracle fixed the hole in June, but some owners only blocked one web address, /PSEMHUB/, with a firewall rule. [8] The gang now writes the P as %50, a code that means the same letter. [8] The firewall rule sees no match, and Oracle's server reads the code as P and passes the request on. [8]

Why it matters. Google says the gang has planted web shells, hidden back doors, on dozens of systems at universities, health-care groups, transport firms and government bodies. [8] The gang told BleepingComputer it used this trick against the FBI's jobs website. [8]

Check Point, a cybersecurity company, has confirmed that attackers are using a flaw in the part of its Security Gateway that handles VPN connections, the secure links staff use from outside. [9] It says a second flaw, in its management web service, has been used as a zero-day, meaning before any fix existed, since 23 July. [9] Attacks on the first flaw began on 12 September, from VPNs and proxies that hide where they come from. [9]

Why it matters. The Dutch National Cyber Security Centre had warned on 10 September that attacks were expected soon, and CISA gave US federal agencies until 25 September to fix both. [9] Check Point's fix is a LivePatch update or a newer hotfix, and it tells owners who cannot update to limit who can reach the VPN. [9]

Two GitHub Actions, small tools that run by themselves inside programmers' projects, were poisoned on 18 May in an attack called Mini Shai-Hulud. [11][10] GitHub's security team then removed them. [10] On 16 September they became available again without being cleaned, so their version labels still pointed at the harmful code, which steals passwords and keys. [11][10] Projects that called them by version label ran that code again until GitHub had switched them off by 25 September. [10]

Why it matters. Socket, a security firm, says about 15,000 projects on GitHub depend on one of the two tools, though not all of them ran the bad code. [10] Projects that named an exact version of the code, instead of a label that can be moved, were not affected. [11]

CISA, the US cyber-defence agency, published its 2026 Election Infrastructure Security Plan on Thursday 24 September, 40 days before the 3 November midterm elections. [14][13] It warns that rules for certifying voting systems can stop makers releasing fixes, and stop officials installing them quickly. [12] It says hackers have tried to break into voter registration systems in all 50 US states and succeeded in at least 20 over the last decade. [12][13]

Why it matters. Election officials told AP the help came too late after the Trump administration cut CISA's election work, and Minnesota expects to pay about $250,000 for private testing. [14] The plan says the Homeland Security department has consistently supported CISA's services, which many election officials say is not true. [14]

The inspector general of the US Homeland Security department, its internal watchdog, published a report on Wednesday 23 September. [15] It found 88 of 102 US civilian agencies had not put in place all the cloud security settings CISA ordered by June 2025. [15] By February 2026, 78 still had not. [15] The missing settings included blocking old login methods and requiring a second check at login. [15]

Why it matters. The watchdog says CISA lacks the power to make agencies follow its orders, which leaves their cloud systems open to attacks that could be prevented. [15] CISA did not respond to the report. [15]

A flaw in Cloudflare Containers, a service that runs customers' programs on shared servers, let one paying customer read data other customers had left behind. [16][17] Oren Yomtov of the security firm Accomplish reported it on 4 September. [16] Shared disk space was not wiped before it was handed to the next customer. [16] The researchers found leftover material, including databases, browser profiles and files holding logins, on 18 of 24 tries. [16][17]

Why it matters. Cloudflare finished fixing it on 19 September, says customers need do nothing, and found no sign anyone else used the method in the records it kept. [16][17] It has not said how long the unsafe setting was in place. [16]

Elementor, a WordPress add-on for building web pages that is active on 10 million sites, had a flaw that let one link create an administrator account for an attacker. [18] The link works when a logged-in administrator opens it, from an email, a chat message or a comment. [19] Elementor skipped a safety check whenever a certain phrase appeared anywhere in the web address, and whoever writes the link can add that phrase. [19] Only versions 4.3.0 and 4.3.1 are affected. [18]

Why it matters. Patchstack, a security firm, reported it on 22 September, and Elementor fixed it two days later in version 4.3.2. [18] The two affected versions are installed on up to 2 million sites. [18]

Labcorp, a large medical testing company, will pay a $2.3 million fine and change how it guards data, 44 US state attorneys general announced on Thursday 24 September. [20] It settles their case over a 2019 breach that exposed 10.2 million Labcorp customers. [20] That breach began at the American Medical Collection Agency, a debt collector Labcorp used, where 27.5 million people were affected in total. [20]

Why it matters. Labcorp must now write security rules into its contracts with suppliers and get regular audits from debt collectors. [20] The collector itself was ordered in 2021 to pay a $21 million fine, which was suspended because it went bankrupt. [20]

CISA added two critical flaws to its list of ones used in real attacks, BleepingComputer reported on 25 September. [21] One is in products from WSO2, an enterprise software maker with nearly 1,000 customers in banking, government, telecoms and logistics. [21] It accepts login tokens signed in a way it should reject, and was first disclosed in May. [21] The other is in Adobe Commerce and Magento, online shop software, and needs no account to use. [21]

Why it matters. US federal agencies had until Sunday 27 September to fix both. [21] The security firm watchTowr saw attempts on WSO2 on 13 September, and Sansec, which protects online shops, saw the Adobe flaw used in real attacks. [21]

D-Link has warned of a flaw rated at the maximum severity in its older DIR-822A Wi-Fi routers. [22] Someone on the same local network can send the router crafted messages that could crash it or let them run their own code, with no password. [22] The researcher who found it has published attack code, and D-Link has no fix yet. [22] A second flaw in the same router, also with public attack code, is still being investigated. [22]

Why it matters. D-Link tells owners to keep the routers off the open internet and limit who can manage them. [22] Attackers often add D-Link devices to botnets, networks of hijacked machines used to flood websites with traffic. [22]

Cisco Talos, a security research team, has found ClosedQuorum, Windows malware that asks up to four AI models what to do next on an infected computer. [23][24] DeepSeek, Qwen, Mistral and Gemini vote between stealing passwords, hiding inside other programs or staying on the machine. [23] When the vote is tied, DeepSeek's answer wins. [23] The stolen data goes to the operators through Discord, a chat app. [23]

Why it matters. Talos has not seen it used in real attacks, and the copy it studied held placeholder keys. [23][24] It says handing these choices to AI lets an attack run at any hour with no person involved. [23]

Group-IB, a security company, has found RemControl, Android malware rented out to criminals and spread through fake Google Play pages for TVTap, a TV-streaming app. [25][24] Once given special access, it lays fake login screens over banking apps and lets its operator control the phone remotely. [25] It targets customers of more than 30 banks in Western Europe, the Middle East and Canada. [24]

Why it matters. It also stops Google Play Protect, Android's built-in malware check, from checking it against known malware. [25] Group-IB suspects a link to the Medusa banking trojan. [25]

Kaspersky's researchers say a new version of MacSync, malware that steals passwords and crypto wallets from Macs, gets its orders from public iCloud calendar events. [26] Commands hidden in an event's description are downloaded and run, and they fetch the next part of the malware. [26] It has been spread through a fake crypto wallet called Toria, promoted on social media, and through apps offered as free or cracked. [26]

Why it matters. A new part of it poses as Finder, the Mac's file manager, and can swap an installed Ledger crypto wallet app for the attacker's version. [26] Kaspersky could not work out what one of its commands does. [26]

The security firm pwn.ai, which found the Click2Shell flaw in WordPress, software for building and running websites, has published full attack code for it. [27][28] A crafted link opened by a logged-in administrator makes the site install a theme from WordPress's own catalogue without asking. [27] pwn.ai says more than 40 themes in that catalogue can then run the attacker's code, even while switched off. [28]

Why it matters. The fix is in WordPress 7.1.1, and WordPress paid pwn.ai $300, its largest bug reward. [28] A site set to block file changes cannot be made to install the theme. [27]

Clop, a ransomware gang, has moved its leak site, where it posts victims' stolen files, to a new address on the Tor network. [29] It confirmed its old server was broken into and defaced earlier this month by ShinyHunters, an extortion gang. [29] BleepingComputer learned the way in was an unfixed flaw in Grav, the website software Clop used, that needed no login. [29]

Why it matters. Clop denied any link to ShinyHunters and said it has given it nothing. [29] ShinyHunters says it took Clop's code, server logs and keys, and has threatened to publish them unless Clop pays. [29]

CISA and the FBI have warned operators of essential services about the outside firms they hire to set up industrial control systems. [30] They describe foreign hackers who got into a US industrial automation company in March and April 2025, whose customers included power utilities and transport firms. [30] The hackers packed nine archive files with network drawings, device settings and customer details. [30] Separately, NIST, publisher of the Cybersecurity Framework 2.0, released a draft update of its security guide for these systems. [30]

Why it matters. The agencies say such firms should get only the access they need, and contracts should say where data is kept and how remote access works. [30] NIST's guide now covers water systems, food and farming, freight rail and ships, and comments are open until 30 November. [30]

SpyCloud, which studies stolen identity data, looked at data taken by password-stealing malware and linked to 10,000 US water and wastewater utilities and their suppliers. [24] It found stolen data at 1,787 of them, and logins for control or remote-access systems at 258. [24] One infected computer at a metering supplier held saved logins for about 167 utilities' metering websites. [24]

Why it matters. SpyCloud says these are possible ways in, not confirmed break-ins. [24] Most of the logins at the utilities themselves were for remote-control tools such as TeamViewer. [24]

Researchers at Team Cymru found nearly 11,000 servers running Claude Relay Service or sub2api, open-source tools that let many people share AI accounts. [24] The AI companies see only the relay, not the real user or where they are. [24] In one group of relays hosted in the US, more than 4,000 internet addresses in China and Hong Kong connected to 304 relays that also reached OpenAI, Anthropic, xAI and Google. [24]

Why it matters. Anthropic, OpenAI and Google exclude China and Hong Kong from their services, and the relays hide where users really are. [24]

Researchers at ThreatDown have described CARBONATO, a botnet that takes over computers running Docker, a tool for running programs, that were left open with no password. [24] It scans nearby networks every five minutes to spread. [24] On each machine it installs Hermes Agent, an open-source AI agent, and tells it to obey commands sent over Telegram and collect passwords, with AI keys ranked first. [24]

Why it matters. The researchers found it through a storage site the operators left open. [24] Language, time zone and other clues point to operators in Costa Rica. [24]

Canonical is replacing the separate four-week and two-week update cycles for Ubuntu's kernel, the core of the system, with one two-week cycle. [24] Because the cycles overlap, a new core will be released every week. [24] Canonical also aims to offer workarounds or other guidance within 24 to 48 hours of a flaw going public. [24]

Why it matters. It says the number of reported flaws has risen sharply, partly because AI tools now help find bugs. [24] The kernel's own developers also now give numbers to thousands of bugs themselves. [24]

Ridge Security found a flaw in TDengine, a database that stores readings from machines in industry, energy and utilities. [24] A stranger with no login can crash it with a single malformed message. [24] Versions 3.4.0.0 to 3.4.1.5 are affected, and version 3.4.1.6 fixes it. [24]

Why it matters. The researchers only showed a crash, but they warn the memory damage behind it could allow more. [24]