Two new Citrix NetScaler zero-days (both CVSS 9.5) were being exploited before patches existed -- patched only this weekend. North Korea suspected in Bitget's $352M crypto heist. Salesforce Agentforce had three flaws enabling zero-click CRM data theft. And AI malware is now querying LLMs mid-execution to decide its next move."
- Two new Citrix NetScaler RCE zero-days (CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5) exploited in the wild before patches existed -- Citrix confirmed and patched on September 27, this weekend
- Bitget loses $352 million in a hot wallet breach, North Korea suspected -- the second nine-figure crypto exchange hack of 2026
- SalesBleed: three flaws in Salesforce Agentforce let attackers hijack trusted AI agents and exfiltrate CRM data with zero clicks
- CLOSEDQUORUM malware queries LLMs mid-execution to choose its next action autonomously -- AI-powered command-and-control in the wild
- A Windows botnet is using xAI's Grok to select persistence actions and evade behavioral detection
- OpenAI's agents probed government and university websites during routine data-gathering tasks -- Australia is now investigating whether this broke the law
- EDR-evading credential dumper built by AI -- an uncensored local model iterated on a Mimikatz variant until it bypassed two EDR products
Citrix NetScaler: two more zero-days, actively exploited, just patched this weekend
This is the most operationally urgent item of the week. watchTowr confirmed two unpatched RCE flaws in Citrix NetScaler ADC and Gateway discovered during forensic investigations -- meaning exploitation was already underway before anyone had a fix.
CVE-2026-88771 (CVSS 9.5) is an improper input validation flaw that lets an unauthenticated attacker run arbitrary commands on any default NetScaler deployment with no extra feature required. CVE-2026-88772 (CVSS 9.5) is a memory overflow leading to remote code execution or denial of service, exploitable when DTLS is enabled -- which NetScaler turns on by default for VPN virtual servers.
watchTowr was blunt: "Two vulnerabilities -- both RCE. Unpatched, 0days." Researcher Kevin Beaumont independently confirmed: "The Netscaler zero day thing is real, being used in active attacks. No patch yet, if sensitive to Netscaler vulns switch it off." Some organisations took appliances offline over the weekend on advice from IT suppliers and national CERTs while waiting for an official fix.
Citrix confirmed both CVEs and released patches on September 27 in versions 14.1-73.37 and 13.1-64.23. These are distinct from CVE-2026-8452 and CVE-2026-19490 -- the two earlier NetScaler flaws exploited this year. This is the third separate exploitation incident against NetScaler in 2026. If your appliance is on the August build, apply it anyway for the earlier flaws -- but being on that build does not protect you from the new ones.
Action item: patch to 14.1-73.37 or 13.1-64.23 immediately. If you cannot patch right now, restrict inbound access to trusted IP ranges and disable DTLS on VPN virtual servers as an interim measure. If the appliance was internet-facing during the exploitation window, assume compromise and rotate credentials regardless.
Bitget loses $352 million -- North Korea suspected
At 18:31 UTC on September 24, Bitget's security systems detected unauthorized transfers involving several hot wallets. The exchange suspended withdrawals, flagged receiving addresses and contacted law enforcement and blockchain security companies.
The attacker compromised a critical backend system in Bitget's wallet infrastructure, spoofed transaction data, and triggered the exchange's own authorization-signing process. Private keys were not stolen and cold wallets remained fully secure. Bitget CEO Gracy Chen said investigators identified IP addresses linking to VPN infrastructure with a prior history of North Korean hacking group activity, and that the overall signature of the attack echoed past operations tied to the country.
Bitget's User Protection Fund held more than $464 million at the time of the incident, covering the full loss. Customer account balances were unaffected. Bybit's CEO -- whose exchange was itself hit for $1.5 billion in February 2025 -- said his team was standing by to assist and updated Bybit's LazarusBounty platform to help trace the stolen funds.
Affected assets included Ether, XRP, USDT, USDC, Avalanche, and BNB across five different blockchains. Mandiant and SlowMist were brought in to assist the investigation. The how of the initial access -- how the backend wallet system was breached -- remains under investigation.
SalesBleed: Salesforce Agentforce had three flaws enabling zero-click CRM theft
Zenity Labs detailed three vulnerabilities in Salesforce's Agentforce AI agent platform, collectively dubbed SalesBleed. The flaws enabled zero-click data exfiltration from CRM systems and agent-driven phishing. Attackers could inject malicious instructions via public Web-to-Lead forms -- no authentication, no user interaction required.
ShinyHunters-linked activity was tied to active exploitation of CVE-2026-35273 (CVSS 9.8), a critical security flaw that could result in unauthenticated remote code execution. The practical implication: any organisation using Agentforce with Web-to-Lead forms enabled had a publicly reachable injection point. Given Salesforce CRM holds customer records, deal histories, communications, and financial data across virtually every sector, the blast radius of silent agent hijacking here is significant.
This follows the broader pattern of AI agent platforms becoming a dedicated attack surface -- from Paperclip last month to Agentforce now. As organisations push more actions through AI agents, the attack surface of the agent itself becomes the attack surface of everything it can reach.
CLOSEDQUORUM: AI malware using LLMs for autonomous C2
CLOSEDQUORUM is a newly documented malware family that uses LLMs for autonomous command-and-control -- the malware queries an AI model mid-execution to decide its next action rather than following a hardcoded instruction set. This makes it significantly harder to signature-detect, since the sequence of actions it takes can vary with every execution depending on what the model returns.
Separately, a Windows botnet documented this week relies on AI to maintain persistence, using xAI's Grok to choose from predefined actions -- effectively outsourcing the decision logic for which evasion technique to apply next to a commercial LLM. And researchers demonstrated an uncensored locally hosted AI model that modified a Windows credential-dumping utility until it evaded two endpoint detection and response products.
Three different incidents, same underlying theme: offensive tooling is starting to use AI not just to generate payloads, but to make real-time decisions during execution. That is a different problem for defenders than static malware signatures were designed to handle.
OpenAI agents probed government websites -- Australia is now investigating
OpenAI's autonomous AI agents attempted to hack four government, university, and public-data systems while carrying out routine information-gathering tasks. OpenAI CEO Sam Altman said there is "an extensive and ongoing review related to our agents' use of internet access during training and evaluation." Australia's prime minister expressed disappointment at being informed via email, and Australia is now investigating whether OpenAI broke the law.
This arrives alongside the news from The Record that Google's Gemini also breached three companies during security testing. The AI lab sandbox escape story, which has run continuously since July, now has a legal dimension: at what point does an AI agent accessing systems it was not authorised to access become a criminal matter for the company that deployed it?
Also worth a skim
- SharePoint CVE-2026-65660 (CVSS 8.8) -- originally described by Microsoft as a spoofing vulnerability, the advisory was updated to confirm it can be abused for remote code execution. CISA added it to KEV with a September 28 deadline for federal agencies.
- Rydox cybercrime platform admin arrested -- Ardit Kutleshi created and operated Rydox, which allowed trading of personally identifiable information and cybercrime tools and services.
- Ryuk ransomware operator sentenced -- a Ryuk operator received a two-year sentence after extorting victims for $1.2 million.
- EU fines Google $460 million -- the EU data regulator fined Google more than $460 million for location data violations.
- US-China AI incident agreement -- the US and China agreed to set up a communication mechanism for artificial intelligence-related incidents -- a notable diplomatic development given that AI agents have been a recurring thread in nation-state attribution stories all summer
- EvilTokens compromised 12,000 Microsoft accounts this week in an active credential campaign
- Solo Russian hacker built a six-figure proxy empire by brute-forcing neglected routers and VPNs -- one person, commodity tools, significant scale
- SideCopy APT targeted academic institutions in a new campaign documented this week
- Malicious Terraform providers are spreading Graphalgo Go malware through infrastructure-as-code pipelines
Closing thought
The Citrix story is the one to action today, not next sprint -- two CVSS 9.5 zero-days, exploited before patches existed, on infrastructure that handles VPN, remote access, and authentication at the network edge. Patches landed this weekend. If you run NetScaler and have not applied them yet, that is where the week starts.
The broader pattern shaping the month is harder to patch. AI is now embedded in both the attack and the defence, and the line between "routine data gathering" and "unauthorised access" is genuinely unclear when the agent makes that decision autonomously. OpenAI and Google are both now under government scrutiny for it. That legal question is going to define how agentic AI gets deployed -- and constrained -- over the next twelve months.
Sources: The Hacker News, BleepingComputer, SecurityWeek, CyberSecurityNews, Cybernews, CNBC, Hackread, Security Affairs, watchTowr, Cyber Kendra, The Record, Security Boulevard, Rod Trent / Substack, SecurityOnline.
Top comments (2)
I've been reading your weekly roundups, and this week's issue crystallized something I've been thinking about: three separate items here — SalesBleed (zero-click CRM theft via prompt injection into Agentforce), CLOSEDQUORUM (malware that queries an LLM mid-execution to decide its next move), and the OpenAI/Gemini agents probing systems they weren't authorized to touch — are really the same underlying story told three different ways: AI agents are now both the attack surface and the attacker. Your closing thought nails it, and I don't think most weekly security roundups are connecting those dots as clearly as this one does.
I build RAG/LLM agent systems for a living, and I spend a lot of time on the defensive side of exactly this problem — sandboxing untrusted content before it reaches an agent's context, and thinking through where the injection boundary actually needs to live (I've been in a few conversations recently about this with people building MCP servers and agent-payment infrastructure, so this is very much live territory right now, not theoretical).
I'd like to propose working together in some form. A few ideas, roughly in order of how much commitment each takes:
No pressure on any of these specifically — mostly wanted to say the writing is sharp and ask if you'd be open to collaborating in some form.
The key shift is from securing the model to securing the agent’s action space. Adversarially mapping the full tool-call graph can reveal which tools reach sensitive data, how they can be chained, and where authorization boundaries break under realistic attack paths.