Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. Apply vendor mitigations. Check the NVD record and the vendor advisory for affected versions and the patch.
BleepingComputer (4 October 2026) reports Anthropic has begun prompting Claude voice-feature users to voluntarily share voice conversations for model training. The in-product prompt asks: “Allow us to use your voice data to improve our AI models,” stating audio recordings and voice chat data help speech understanding/response, with opt-out and deletion via settings. Voice training is a separate control from Anthropic’s existing option to use chats and coding sessions for training — users can allow one path and refuse the other. Settings > Privacy shows “Allow us to use your voice data” described as applying only to approved sessions; Bleeping says the toggle appears disabled by default (not auto-enrolled). (source: BleepingComputer)
BleepingComputer — Anthropic asks Claude users to share voice data for training (4 Oct 2026)
Have I Been Squatted researchers Ian Muscat and Leanne Briffa published research on 3 October 2026 showing two edge cases in the internationalised domain name (IDN) spoofing checks used by Chromium-based browsers such as Chrome and Edge. First, Chromium's whole-script confusable check only shows the encoded Punycode form when every character in a single-script Cyrillic label is on its list of Latin lookalikes; Cyrillic ө (a Kazakh, Mongolian and Tatar letter) is not on the list, so аррӏө.com, a lookalike of apple.com that Verisign's .com Cyrillic table allows to be registered, displays in Unicode. Other 'breaker' characters such as ү also work. Second, the top-domain comparison reduces names to a 'skeleton', but a hooked letter such as ƙ, and the bar on ө, survive as combining marks, so oƙta.com does not reduce to okta.com and no match is found. Chromium's navigation-time Safety Tips only fire for matches within one edit and for targets of five or more characters, so short brands such as Okta, Nike, Sky and VK get no near-match protection. The researchers registered 20 lookalike domains (including Cyrillic versions of openai.com, skype.com, sharepoint.com, shell.com and kaspersky.com) and say all showed in Unicode in the Chrome 154 address bar with valid certificates. They found 161,894 lookalike pairs among 733,509 IDNs in the .com zone, which are possible imitations, not confirmed typosquats. In webmail tests Gmail showed all 20 IDN sender domains in Unicode, while Outlook Web showed all of them as Punycode, even harmless ones. Chromium added one more Cyrillic character (м) to its list on 11 September, after Chrome 155 branched; earlier, Chrome 148 closed the ҏ and ӿ breakers. No CVE or Google fix for ө or ƙ has been announced, and no in-the-wild abuse is reported in the research. (source: The Register)
Have I Been Squatted — Turning IDN edge cases into typosquats (3 Oct 2026)
Microsoft Threat Intelligence reported on 3 October 2026 a cluster of compromised websites that show a fake CAPTCHA or repair prompt telling visitors to open the Windows Run box, paste a copied command and press Enter. Unlike typical ClickFix lures, the page has already pre-fetched the main VBScript payload into the browser cache as a PNG-like file, so the pasted command can be short: it searches cache folders such as the Firefox profile for a file of an expected size, copies it to a temporary .vbs file and runs it through Windows Script Host with output hidden. The script gathers device details over WMI and pulls a PowerShell stage; later steps invoke .NET compilation tools, inject code into a legitimate Windows utility to steal browser-stored and device credentials, set the user's PowerShell execution policy to Bypass, unpack Python components and add a scheduled task that runs a Python payload windowlessly. Microsoft did not give victim numbers or name an operator. (source: Cyber Security News)
Microsoft Threat Intelligence on X — ClickFix with browser-cache pre-fetched payload (3 Oct 2026)
NVD record CVE-2026-71885 (published 3 October 2026; CNA CVSS 4.0 9.2 Critical; CWE-287 / CWE-295) and the Legion of the Bouncy Castle advisory page: the Messaging Layer Security (MLS, RFC 9420) implementation in Bouncy Castle for Java before 1.86 never tied an X.509 credential to the LeafNode signature_key. LeafNode.verify() checked the leaf's signature against the key carried in the leaf itself, and the credential's certificate chain was stored but never parsed or compared, so RFC 9420 section 5.3's binding was not enforced. A party could present someone else's certificate as its credential and sign the leaf and KeyPackage with an unrelated key, and be accepted under that person's identity. Where a deployment publishes GroupInfo and the ratchet tree for external joins and passes external commits to Group.handle() without its own credential-admission check, an unauthenticated attacker could join as the victim, evict them, derive the current epoch, read later group messages, and send messages accepted as the victim. Deployments using only basic credentials are unaffected. Fixed in 1.86 (commit 77632a57ed; bcmls-jdk18on 1.86 on Maven Central): the leaf is rejected unless the end-entity certificate's public key equals signature_key; chain and identity validation to a trust anchor remain the application's job. Credit: Joshua Rogers and Khaled Suliman (AISLE Research). No exploitation reported; no Australian-specific notice found.
BleepingComputer (3 October 2026), citing TestingCatalog on X, reports Google is testing desktop-control capability in the Gemini Desktop macOS app, including a hidden “Additional sandbox options” setting. According to BleepingComputer, when enabled, Gemini could read/create/modify/delete files outside explicitly connected folders, open apps, browse the web, and act through Mail/Safari/Messages without asking permission every time; UI copy says expanded access may allow actions without prior permission depending on settings. Feature is not live and Google has not publicly confirmed the rollout. BleepingComputer says Gemini would still prompt before purchases, money transfers, creating accounts, accepting legal terms, or modifying sensitive personal information. Context: Apple’s 2 Oct Full Disk Access hardening for AI-agent risk (see /n/apple-macos-fda-ai-agents-20261002). (source: BleepingComputer)
BleepingComputer — Gemini Desktop Mac full-access sandbox options under test (3 Oct 2026)
Update 16 Oct: the guest-to-host escape Vercel's CEO confirmed on 3 October now has a CVE and a public write-up. Researcher Paulos Yibelo of pwn.ai published 'PwnEscape' on 15 October and the Linux kernel CNA assigned CVE-2026-99999, rated 9.3 Critical (CVSS 3.1, local attack vector, scope changed); NVD had received but not yet analysed it. The bug is not in KVM or Firecracker but in the host kernel's IPv4 networking code: checksum metadata supplied by a guest could point into the IPv4 header, so skb_checksum_help could rewrite the header after the kernel had already validated it. Vercel's own findings post (14 Oct) says the host-memory leak was demonstrated against its production Sandbox: each packet a guest sent could carry back about 32 bytes of host memory, repeatably. Crashing the host with two crafted packets and getting root on the host were shown only on the researcher's own machines built to match Vercel's; he stresses this is not a claim of root in any provider's production. Vercel says no report showed anyone reading customer files, secrets or app data, and called it the challenge's only Critical finding. Because most clouds isolate tenants on the same Linux host networking layer, the exposure is broad for anyone running untrusted guests. The fix is a single commit (6785011f8b16) by Red Hat's Michael S. Tsirkin, which its author calls a defence-in-depth check; fuller input validation is still being worked on. An attacker must already run code inside a guest; it is not reachable from the open internet, and, as of 15 October, there was no known in-the-wild use or CISA KEV listing (source: The Hacker News). pwn.ai says the research used its Omega-Pwn harness with an AI model as the main reasoning engine. Earlier reporting (Rauch X post 3 Oct, Tech Insider and CSN 4 Oct) said Vercel paid US$50,000. UPDATE (20 Oct): Red Hat rates CVE-2026-99999 Important, CVSS 3.1 8.8 (it scores privileges required as low, unlike the CNA's 9.3), lists every tracked RHEL stream from 6 to 10 (kernel and kernel-rt), RHEL for NVIDIA and OpenShift 4 CoreOS as affected with fixes still in progress, and says no acceptable mitigation exists. WA's Cyber Security Unit issued advisory 20261019001 on 19 October and has seen no exploitation on WA Government networks. (sources: pwn.ai write-up; Vercel; The Hacker News) UPDATE (29 Oct 2026): Red Hat has now shipped fixed kernels. Its CVE page lists RHEL 10 first (RHSA-2026:85321, released 06:09 on 20 October, Perth time), then RHEL 9 (RHSA-2026:86033, 21 October), RHEL 8 (RHSA-2026:89083, 25 October), RHEL 7 extended lifecycle support (22 October), RHEL 6 extended lifecycle support (28 October) and OpenShift Container Platform 4.12 to 4.22 CoreOS (27 to 28 October), along with EUS, SAP and NVIDIA streams. This supersedes the 20 October line saying fixes were still in progress. (source: Red Hat) UPDATE (29 Oct 2026; Red Hat and CISA KEV): Red Hat's CVE page, read on 29 October, says: 'Red Hat tracks this flaw as a KEV active-exploit case.' (source: Red Hat) CVE-2026-99999 is not in CISA's Known Exploited Vulnerabilities catalog as of 28 October 2026 (catalog version 2026.10.28). (source: CISA KEV) Correction (29 Oct 2026): an earlier version stated in the present tense that there is no known in-the-wild use of this flaw; that reflected reporting as of 15 October, and the sentence now says so. The Hacker News article is dated 15 October, not 16 October as previously shown. (source: The Hacker News)
pwn.ai — PwnEscape: guest-to-host KVM escape (CVE-2026-99999) (15 Oct 2026); fix: Linux commit 6785011f8b16
Reuters (3 October 2026; Jana Winter / Raphael Satter / AJ Vicens) reports Jordanian authorities detained Saif al-Din Khader — alleged ShinyHunters / Scattered Lapsus$ Hunters handle “Rey” (also “Hikki-Chan”) — this week; two of three sources said custody began Tuesday (~30 Sep). Two sources say he is cooperating with the FBI and international partners to locate other group members, including walking investigators through devices and digital communications. Reuters could not determine detention circumstances or current whereabouts; attempts to reach Khader/family unsuccessful. FBI declined to comment on any specific arrest abroad but said it “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects.” Context: group’s claimed FBI PeopleSoft / AWS GovCloud intrusion (see /n/shinyhunters-fbi-peoplesoft-20260922); Dutch detention of Pepijn van der Stap / Umbreon (see /n/shinyhunters-dutch-arrest-20260928). BleepingComputer (3 Oct) reports: temporary DLS/messaging disruption mid-week then a new leak site online Thursday; main ShinyHunters channel stopped answering media. Krebs (Nov 2025) had previously identified Khader as Rey and quoted him claiming prior law-enforcement contact — treat as background, not confirmation of this week’s custody terms. Distinct LE action from the Dutch arrest card. (sources: Reuters exclusive; BleepingComputer)
Reuters (via StreetInsider) — ShinyHunters Rey / Saif al-Din Khader detained in Jordan; FBI cooperation (3 Oct 2026)
Citrix Security Bulletin CTX697174 (published 3 Oct 2026; re-verified 5 Oct) assigns CVE-2026-88779 to the NetScaler SAML authentication crash/DoS tracked separately from CVE-2026-88771/88772. Description: memory overflow (CWE-119) leading to denial of service when NetScaler ADC or Gateway is configured as a SAML SP or SAML IdP. CVSSv4 base 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N). Affected: NetScaler ADC/Gateway 14.1 before 14.1-73.41; 13.1 before 13.1-64.28; ADC FIPS before 14.1-73.41 FIPS; ADC FIPS/NDcPP before 13.1-37.282. Patch to: 14.1-73.41+, 13.1-64.28+, 14.1-73.41 FIPS+, 13.1-37.282+. CISA added CVE-2026-88779 to KEV on 4 Oct 2026 (due 7 Oct; forensic triage Yes; BOD 26-04). ASD's ACSC Critical alert (last updated 3 Oct) already flagged the SAML issue as separate from 88771/88772 and reported impacts to Australian organisations — confirm whether SAML Gateway/AAA config is present, apply CTX697174 builds, preserve ns.log/core/support bundle if crashed, and report to ASD's ACSC if impacted. Press context (Cryptika/Heise 3 Oct): nsaaad crashes and pitboss reboots under crafted SAML traffic after 14.1-73.37 / 13.1-64.23. Distinct /n/citrix-netscaler-unpatched-rce-20260926 covers 88771/88772. UPDATE 5 Oct (SecurityWeek report): researcher Kevin Beaumont, who calls the bug “PitScaler 2”, reports exploitation attempts against already-patched honeypots and says one honeypot ran a downloaded malware binary. Admins on Reddit shared logs showing SAML authentication requests with shell commands hidden in the username field that try to fetch and run a script; one admin who obtained the script says it tries to plant web shells, survive reboots and upload the appliance configuration and backups, but there is no proof it ran. SecurityWeek notes some indication the flaw may be usable beyond DoS; Citrix still says it has seen availability impact only and no data-integrity impact. Citrix credits Bishop Fox and watchTowr, and watchTowr says it reproduced the issue within hours of seeing honeypot activity (The Hacker News, 5 Oct).
Citrix Security Bulletin CTX697174 — CVE-2026-88779 NetScaler SAML memory-overflow DoS (3 Oct 2026)
OFX Group Limited, the Sydney-based ASX-listed money transfer and financial operations company, first advised the market on 2 October 2026 that it was investigating a cybersecurity incident involving unauthorised access to data, including data relating to some clients, and that it had notified the Australian Cyber Security Centre, the OAIC and other global regulators. Its 15 October 2026 update says the investigation has confirmed that the databases supporting its client platforms were not accessed; based on the investigation to date, OFX has not identified any unauthorised access to client accounts or funds, or any financial loss to clients arising from the incident; and services and systems have continued to operate normally. Analysis of the data found some personal information in the affected files; the files did not contain copies of identity documents, and none of the accessed data can be used to make a payment on the OFX platform. OFX says it has implemented containment actions and additional monitoring of client accounts, is communicating with affected clients and individuals (including recommended protective steps), and is arranging specialist identity and cyber support services where available. The investigation remains ongoing; OFX does not anticipate further market updates unless material developments require continuous disclosure. UPDATE 15–16 October: OFX's incident page (last updated 15 October) says it is moving into a 'next phase' of communications in which affected clients and individuals are told exactly what information about them was accessed, and it has set up incident phone lines in each region (Australia 1800 524 924) plus questions@ofx.com for account enquiries. BeyondMachines (16 October), reporting on those notifications, says the unauthorised access happened on 28 September and that the files exposed names and usernames, contact information, dates of birth, occupation details, answers to secret questions, details of selected transfers and payment recipients, some customer communications, IP addresses and device information, and social media URLs. OFX has not said how many people are affected; BeyondMachines says the New Zealand Privacy Commissioner was also notified. OFX warns the data could be used for scams and impersonation, and says its staff will never ask for passwords, one-time codes or security details. (sources: OFX ASX announcement; OFX incident page) Correction (23 Oct 2026): the headline stated the exposed-data list as OFX's own; it comes from BeyondMachines' reporting on OFX's notifications. Removed 'identified and contained the next day', which only an unreadable source carried. (source: BeyondMachines)
OFX Group — Update on cybersecurity incident (ASX, 15 Oct 2026)
IBM, which now acts as CVE numbering authority for Langflow OSS, published security bulletin 7290694 on 2 October 2026 covering 25 vulnerabilities in Langflow 1.0.0 through 1.12.2, the open-source visual builder for AI agents and workflows. The CVE records went public on 6 and 7 October. The two worst, CVE-2026-104334 (code injection) and CVE-2026-93674 (OS command injection), are rated 9.8 by IBM and need no login. Most of the rest need an authenticated user, which in Langflow usually means anyone who can build flows: several sandbox escapes and code-security-scanner bypasses that run code on the server (CVE-2026-97676, 97678, 97673, 97655, 97679, 88962, all 8.8), an OS command injection (CVE-2026-97674, 8.1), path traversal that writes files anywhere the service account can and reads configuration, secrets or database files (CVE-2026-97677, 8.1; CVE-2026-103360, 8.1), cross-user access to cached component results (CVE-2026-97680, 8.3), poorly protected stored credentials (CVE-2026-101331, 7.7), authorization bypasses (CVE-2026-93678, 7.6) and a ZIP extraction denial of service (CVE-2026-93679, 4.3). IBM lists no workarounds. This is a separate set from the Langflow MCP stdio flaws already on Cyberstack (fixed in 1.10.3), so a 1.10.3 install is still exposed. IBM does not report exploitation, but earlier Langflow code-injection flaws were exploited within days of disclosure. (source: IBM)
IBM — Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (2 Oct 2026)
Rapid7 published research on 2 October 2026 on Linux backdoors aimed at telecom and network-edge systems in South Korea and Taiwan that disguise themselves as the email security products in use locally. Against South Korean systems, a new BPFDoor variant impersonates the PID file of SpamSniper, a Korean anti-spam product, rotates through ten Linux daemon names, and in some builds names itself ora_ppmond to look like an Oracle database process; Rapid7 says operators now wrap the BPFDoor magic packet inside ordinary HTTPS POST requests so that SSL offloading at telecom edge proxies delivers the trigger past deep packet inspection, after which a TinyShell session gives shell, upload and download. A BPF backdoor built on Rekoobe watches traffic on port 25 and also uses SpamSniper component names. In Taiwan, a dropper planted in the add-on package directory of ShareTech appliances, keyed off the string "ShareTech", installs AVERAT, a previously unreported modular implant that uses SMTP on TCP port 25 for command and control, checking in every 600 to 699 seconds (about 10 to 11.7 minutes), with commands for file transfer, process control, up to 10 concurrent shells, proxying and loading extra modules; the payloads run from memory after their files are deleted. Rapid7 says the C2 infrastructure resembles an operational relay box network and treats attribution as ongoing; BPFDoor has previously been linked to the China-nexus group Red Menshen. (sources: Rapid7; The Hacker News) Correction (27 Oct 2026): AVERAT's check-in interval is now given as Rapid7 states it, every 600 to 699 seconds; the card had said 10 to 11.5 minutes. (source: Rapid7)
Rapid7 — SMTP is the key: BPFDoor and AVERAT hitting the network edge (2 Oct 2026)
