⚠️ CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.

CVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.

Citrix has fixes and IoCs.

Read: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html

🚨 JADEPUFFER deleted most targeted Azure Storage accounts in seven minutes.

Microsoft says compromised service principals drove 150+ destructive or credential-collection operations in 35 minutes, while the attack also targeted backup and recovery resources.

Inside the 18-hour attack: https://thehackernews.com/2026/09/jadepuffer-linked-attackers-used.html

⚠️ Carbonato compromises unauthenticated Docker daemons, then deploys Hermes Agent for Telegram-driven, LLM-generated commands.

The botnet persists on infected hosts and scans nearby networks every five minutes for more exposed Docker daemons.

Here's how it works: https://thehackernews.com/2026/09/carbonato-botnet-compromises-docker.html

⚡ WEBINAR — If an AI agent has access to your business systems, who approved it, what can it reach, and does it still need those permissions?

Only 47% of CISOs say they can identify every AI agent in their environment.

Join us to learn how to treat AI agents as first-class identities, with clear ownership, tighter permissions, regular access reviews, and faster revocation when risk changes.

Watch the webinar → https://thehackernews.com/2026/09/webinar-how-to-govern-ai-agents-reduce.html

⚡ THIS WEEK IN CYBER...

> $387M crypto hack
> Citrix flaws exploited
> AI agents hacking sites
> 1.7K-repo domain trap
> 5.7K M365 accounts targeted
> EvilTokens taken down
> TeamCity abused in ransomware
> Git-based C2 campaigns
> Clop leak site hacked
> PamStealer gets stealthier

and dozens more CVEs, campaigns, and attacks.

Full weekly recap → https://thehackernews.com/2026/09/weekly-recap-387m-crypto-hack-citrix.html

AI raised engineering velocity for 93% and governance workload for 97%.

ActiveState's new report, The AI Remediation Bill, surveyed 307 enterprise security, governance, platform, and engineering leaders and found that 93% report increased engineering productivity from AI-assisted development, while 97% report a heavier governance workload.

Join the waitlist → https://thn.news/ai-report-syndicate

⚠️ RatHat, an Android banking trojan, uses Gemini to rank infected phones by estimated bank balance.

Cleafy traced nearly 100 console deployments since April 2026. Gemini helps operators prioritize victims, not move money.

Read: https://thehackernews.com/2026/09/rathat-android-malware-console-uses.html

🛑 Bitget says an attacker exploited a third-party security product flaw, stole high-level internal credentials, and used them in a $388M theft.

The wallet system accepted fraudulent withdrawal commands as legitimate, bypassing risk controls.

Read: https://thehackernews.com/2026/09/bitget-says-attacker-exploited-third.html

🚨 IAM can show what an AI agent is allowed to do. It may miss what the agent actually does.

Agents can chain tools and actions inside applications that authentication logs may not capture. That makes runtime telemetry, scoped delegation, and distinct agent identities part of the control model.

Why traditional IAM falls short: https://thehackernews.com/2026/09/iam-for-ai-agent.html

⚠️ NeedyMantis keeps attackers inside networks they already breached.

Microsoft saw the malware in a small number of targeted intrusions, where it uses DLL sideloading and a WebSocket C2 channel to load additional modules.

Read: https://thehackernews.com/2026/09/hackers-use-needymantis-to-maintain.html

‼️ Apple patched a new CoreGraphics flaw that may have been exploited in targeted iOS attacks.

CVE-2026-86950 can trigger arbitrary code execution when a maliciously crafted file is processed. Fixes are available for affected older iOS, iPadOS, and macOS releases.

Read: https://thehackernews.com/2026/09/apple-patches-coregraphics-flaw.html

OpenAI paused tool use on its most capable models after an RL agent got past internet restrictions and reached a public chatbot.

The gap was insufficient DNS filtering. Monitoring caught the behavior within 15 minutes, and OpenAI added blocking at two separate layers.

Read: https://thehackernews.com/2026/09/openai-pauses-tool-use-after-agent.html

⚠️ OpenAI shelved GPT-6.1 Astra after safety tests found deceptive behavior and actions taken without permission.

In simulations, GPT-6 Astra created fake identities and delivered malicious payloads to open-source codebases.

What the tests found: https://thehackernews.com/2026/09/openai-shelves-gpt-61-astra-after-tests.html

‼️ Malicious MCP servers can steal OAuth credentials from affected MCP Python SDK clients.

The vulnerability can expose the client secret, auth code, and PKCE verifier, letting an attacker request a valid access token from the real service.

Details → https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html

Source code tops the data sent to external GenAI models in Verizon’s DLP dataset.

Shadow AI is also the third most common non-malicious insider action, up fourfold. Teramind Field CISO Pete Hadjigeorgiou details what an IRM platform should be able to see, prove, and stop.

The 8 checks → https://thehackernews.com/expert-insights/2026/09/what-to-look-for-in-insider-risk.html

Dutch police arrested a 24-year-old in a ShinyHunters investigation.

Police have not publicly named the suspect. Independent reports identify him as Pepijn van der Stap, previously apprehended in 2023 over data thefts and extortions.

Read: https://thehackernews.com/2026/09/dutch-police-arrest-24-year-old.html

🚨 101 malicious npm packages can quietly add WhatsApp accounts to groups without consent.

The PhantomSub cluster abuses Baileys forks and has logged 490,000 downloads, including 116,000 in the last 30 days.

Read: https://thehackernews.com/2026/09/101-malicious-npm-packages-add.html

Six days of hands-on training, then NetWars and SANS@Night talks in the evenings. SANS CDI 2026 in D.C., Dec 14-19.

Details and registration: https://go.sans.org/JoHtqR

Kiteworks fixed a critical flaw discovered during its precautionary shutdown, affecting a capability enabled for under 1% of customers.

The company says there is no evidence of malicious exploitation.

Read: https://thehackernews.com/2026/09/kiteworks-fixes-critical-flaw-found.html

‼️ A new Spectre-v2 attack can leak arbitrary Linux memory by reusing stale CPU branch predictions.

VUSec showed Branch Target Reuse working end to end on modern Intel CPUs, bypassing the Spectre defenses enabled in its test setup.

🔗 Here’s how BTR attack works → https://thehackernews.com/2026/09/new-spectre-v2-btr-attack-leaks-linux.html