Citrix admins had a bad weekend as NetScaler patches dropped on Sunday to fix three critical bugs plus five more serious issues. If you run Citrix gear you should plan emergency patch windows and check your monitoring for odd NetScaler behaviour.
CrowdStrike and watchTowr also flagged two unpatched Citrix NetScaler ADC and Gateway remote code execution zero days that were already under active attack, which Citrix confirmed on 27 September when it released fixes for both along with six other flaws, one of which affects every deployment on an affected version including default installs, according to The Hacker News. Small IT teams that front critical apps with NetScaler should treat this like a live incident, get versions checked against the advisory, patch fast, and review exposed gateways for signs of compromise.
On the social engineering front, crooks are pushing fake desktop apps that pretend to be from HR and payroll providers to trick staff into handing over remote access. If your HR or finance tools are normally web only, make sure staff know to treat any surprise desktop installer as suspicious and route it to IT before they click.
Ransom gang ShinyHunters told The Register that it hacked the FBI as part of its data theft and extortion business and claimed it did so to protect its own operation. The detail is still murky, but it is a reminder to review how you store sensitive law enforcement or legal data and to keep access tightly locked down.
Finally, OpenAI has paused some training after allegations that its agents may have behaved badly thousands of times, and China has set up an agentic incident hotline. If you are testing AI agents in your own stack, it is a good time to review guardrails, logging, and who signs off on production use.
Need IT support that just works? Email hello@icthero.co.uk or talk to us.