Citrix Addresses Two Zero-Day Flaws; Third-Party ICS Integrator Guidance from CISA & FBI

Over the weekend, Citrix published an advisory addressing eight vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. Two of the flaws are confirmed to be actively exploited: CVE-2026-88771, CVSS score 9.5, an improper input validation leading to remote code execution, and CVE-2026-88772, CVSS score 9.5, a memory overflow vulnerability leading to remote code execution or denial of service. Citrix made available a list of indicators of compromise for the advisory, which is accessible through NetScaler Console. The US Cybersecurity and Infrastructure Security Agency (CISA) has added these CVEs to the Known Exploited Vulnerabilities (KEV) catalog with mitigation deadlines of Wednesday, September 30 for Federal Civilian Executive Branch (FCEB) agencies. Other vulnerabilities addressed in the advisory include CVE-2026-88773, CVSS score 9.3, an HTTP request smuggling issue; CVE-2026-88774, CVSS score 7.0, a feature policy bypass due to improper HTTP URL-based expression usage; CVE-2026-88775, CVE-2026-88776, and CVE-2026-88777, all memory overflow vulnerabilities leading to unpredictable or erroneous behavior or denial of service, all carrying CVSS score 8.8; and CVE-2026-88778, CVSS score 8.8, a TCP Initial Sequence Number prediction issue.

The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have published a joint Fact Sheet containing advice for critical infrastructure entities working with third-party industrial control system (ICS) integrators. According to the document, critical infrastructure owners and operators should "ensur[e] the principle of least privilege (PoLP), is applied, as third-party ICS integrators "may inadvertently introduce security issues to a customer environment by exposing systems and services not pre-configured to the customer’s security requirements." FBI technical analysis revealed that in March and April of 2025, "malicious foreign cyber actors gained access to the network of a U.S. industrial automation solutions company that offered services—such as system integration, engineering consulting, and SCADA programming—for industrial customers, including power utilities and transportation entities," conducted searches, and readied hundreds of files "for presumed exfiltration." The document lists recommendations to reduce risk and provides resources for guidance on asset inventories, SBOMs, and supply chain risk management.

A coalition of 44 US state attorneys general has settled a lawsuit against Labcorp, fining the company $2.3 million and requiring it to adopt measures to improve its data security posture. The suit was filed over a 2019 breach at American Medical Collection Agency (AMCA), a third-party debt collection company and subsidiary of Retrieval-Masters Creditors Bureau (RMCB), which detected the breach on March 19, 2019. A subsequent investigation determined that the intruder had access to AMCA's network between August 1, 2018 and March 30, 2019, and exfiltrated names, Social Security numbers, financial data, medical test data, and other information. According to the HIPAA Journal, "the AMCA data breach was the largest data breach reported in 2019 by a HIPAA-regulated entity, affecting more than 27.5 million individuals, including more than 10.2 million Labcorp patients." The settlement requires that Labcorp include cybersecurity requirements in vendor contracts, create a response plan for security incidents affecting vendors, limit the data it shares with its vendors, and establish a risk management team that will ensure vendors' compliance with data security requirements.

Following claims of a September 22 data breach affecting the FBI (described in NewsBites 28.71), additional information has emerged on the alleged perpetrators and on possible related exploitation. About one week before the purported theft of two terabytes of agents' personal information and the defacement of the FBIjobs[.]gov website, Dutch authorities arrested 23-year-old Pepijn van der Stap "on suspicion of aiding in data thefts and extortions" with ShinyHunters. Van der Stap was previously convicted of data theft and extortion in 2023 and served a prison sentence that ended in December 2025. Brian Krebs described this latest arrest alongside information about Dutch authorities' pursuit of a ShinyHunters-linked perpetrator of the February data breach at Dutch telecom provider Odido. The FBI is continuing to investigate the claimed breach and has reportedly issued an internal memo confirming to bureau employees that personally identifiable information (PII) was stolen in a cybersecurity incident, according to Ken Dilanian at MS NOW (formerly MSNBC). Meanwhile, Google Threat Intelligence Group (GTIG) published threat intelligence on September 25 warning of "renewed mass exploitation" of CVE-2026-35273, a critical missing authentication flaw in Oracle PeopleSoft that was disclosed and fixed in June. The latest wave of activity seems to involve using URL encoding to bypass web application firewall (WAF) rules that mitigate the flaw. The renewed campaign, which GTIG assesses is linked to ShinyHunters, has been "deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government." GTIG urges users to apply Oracle's fix; ensure PeopleTools is on a supported version; disable EMHub service or remove the PSEMHUB application; conduct log and endpoint monitoring for specific requests; conduct host-level auditing for unexpected files and unauthorized content; hunt for evidence of data theft; and prepare for possible extortion communications and public exposure of stolen data.

On September 28, 2026, Apple released an emergency patch to address a high-severity vulnerability in iOS and macOS before version 27 that may be under targeted exploitation. CVE-2026-86950, CVSS score 8.8, allows an attacker to achieve arbitrary code execution by exploiting an out-of-bounds write issue that occurs when CoreGraphics processes a maliciously crafted file. Meta Product Security is credited with the report of this flaw. Apple has fixed the issue with improved bounds checking in iOS and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1, and notes that the company has received a report that the flaw may be under exploitation "in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27."

The District of Columbia Department of Health Care Finance (DHCF) has begun sending notifications to individuals whose personal information may have been compromised. The data were exposed via "two reports on DHCF’s website [which] contained hidden personal information that could be accessed by people who did not have permission to view it." DHCF has removed the reports from the website, launched a review to determine how the situation came to be, and started enhancing practices to prevent a recurrence. The compromised data include Medicaid ID numbers, dates of birth, provider names, race, gender, and ethnicity. The incident affects roughly 400,000 individuals who were enrolled in the Medicaid or Alliance programs between 2023 and July 2026. DHCF has reported the incident to the Department of Health and Human Services Office for Civil Rights.

On September 25, 2026, Dyfed-Powys Police in Wales issued a statement confirming that the force suffered a cyber incident that was detected on September 14. The nature of the incident has not been publicly specified, but some systems were shut down as a precaution during investigation and restoration. Cybersecurity specialists are assisting to understand the circumstances and determine whether there was unauthorized access to staff data. Dyfed-Powys Police have not found evidence of unauthorized access or compromise for any information belonging to members of the public. The force has remained fully operational, including emergency response and telephone services, but non-emergency systems including online and email contact were temporarily disrupted and/or unavailable; these have now been restored. Tarian, the regional organized crime unit (ROCU) for southern Wales, has a regional cybercrime unit managing the investigation, and systems are under close monitoring. The UK Information Commissioner’s Office (ICO) has been notified, and the force promises further updates when appropriate. The four counties served by Dyfed-Powys Police account for about 500,000 people.

Two Japanese railway operators have reported recent cybersecurity incidents. Tokyo Metro, which operates subway trains, said that email addresses of approximately 59,000 rewards program members may have been compromised after an intruder gained unauthorized access to a company server. The server in question does not contain any other data. The incident was detected while the company was investigating email delivery errors earlier this month; the breach was determined to have originated overseas. Keio Corporation, a private railway operator, said that its network was the target of a ransomware attack over the weekend. The incident resulted in a "system failure," which has disrupted some of Keio's business systems. Keio has reported the incident to police, shut down its network "to prevent further damage," and launched an investigation.

A US District Judge in the state of Washington sentenced former Army soldier Cameron John Wagenius to nearly six years in prison for breaking into databases at multiple telecommunications companies, stealing data, and threatening to release the data unless extortion demands were paid. According to court documents, Wagenius and co-conspirators targeted at least 10 organizations between April 2023 and December 2024. They accessed the companies' networks using stolen credentials and shared those credentials over Telegram group chats, where they also discussed their activities. Wagenius and his co-conspirators threatened to expose the stolen data if demands for payment were not met; they also offered stolen data for sale on cybercrime forums. The intrusions, data theft, and other related activity occurred while Wagenius was on active duty. In March 2025, Wagenius pleaded guilty to two counts of unlawful transfer of confidential phone records information, and in a separate case in July 2025, Wagenius pleaded guilty to conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft. Wagenius has also been ordered to pay nearly $300,000 in restitution.