In partnership with
100+ ChatGPT Prompts to Revolutionize Your Day
Supercharge your productivity with HubSpot's comprehensive guide to Chat GPT. This free resource is your fast track to AI mastery:
Industry-Specific Use Cases: 15+ real-world applications across various sectors
Productivity Guide: 21 best practices to 10x your efficiency with AI
Prompt Powerhouse: 100+ ready-to-use prompts for immediate implementation
Challenge Buster: Overcome common AI hurdles with expert strategies
Plus, in-depth sections on email composition, content creation, customer support, and data analysis.
Happy Monday. If you run edge appliances for clients, your weekend probably wasn't restful. Citrix wants you to patch NetScaler again, Fortinet's FortiMail fix still isn't out, and tomorrow is Patch Tuesday. Here is what actually matters.
Alternate subject line: "Patch NetScaler twice, FortiMail's open door, ransomware negotiator arrested"
1. NetScaler is exploited again, and yes, you have to re-patch
Citrix shipped fixes for a NetScaler ADC and Gateway flaw (CVE-2026-88779) in SAML-configured appliances, and it is being exploited in the wild. CISA added it to the KEV catalog on October 4. Citrix confirms targeted attacks leading to denial of service, while researchers are still digging into whether remote code execution is possible. Fixed builds start at 14.1-73.41 and 13.1-64.28.
Why it matters: anyone who just upgraded to fix the last two exploited NetScaler bugs has to upgrade again. Put every NetScaler client on your list today, and check for odd authentication usernames in logs while you are there.
Sources: BleepingComputer | Sophos | CISA alert
2. FortiMail's 9.8 is being exploited, and the patch isn't here yet
Fortinet disclosed a critical FortiMail path traversal flaw (CVE-2026-104286, CVSS 9.8) that lets an unauthenticated attacker write arbitrary files with crafted HTTP(S) requests, which can lead to code execution. It is already exploited and on the CISA KEV list. Affected: 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, 7.2.0 to 7.2.9. Fixes are planned for 8.0.2, 7.6.7 and 7.4.9, and per reporting had not shipped at last check.
Why it matters: the interim move is to disable IBE via CLI and keep the management interface off the internet. Fortinet has published indicators of compromise, so hunt for them now rather than waiting on the patch. Confirm status in Fortinet advisory FG-IR-26-175.
Sources: eSecurity Planet | Help Net Security | BleepingComputer
3. FBI arrests a ransomware negotiation firm co-founder
Federal agents arrested Edward Dubrovsky, founder and former COO of CYPFER, a firm that helps breached companies negotiate with ransomware crews, in Pennsylvania on October 8. He faces conspiracy charges tied to threatening to impair the confidentiality of information to extort money. Reports connect the case to the ShinyHunters probe and the FBIjobs.gov breach. These are allegations, not convictions.
Why it matters: if you resell or refer incident response and negotiation services, expect clients and insurers to ask hard questions about vendor vetting. Time to document how you pick your IR partners.
4. Police take down KillSec, allegedly run by a 16-year-old
Europol and Eurojust announced Operation KillSwitch on October 1. Three suspects were provisionally arrested across Greece, Romania, Spain and the UK, the leak site and servers were seized, and at least 110 TB of stolen data was recovered. Authorities suspect the main operator is a 16-year-old.
Why it matters: a teenager allegedly running an extortion crew is a reminder that the barrier to entry is low. It also means seized data may now be in investigators' hands, so watch for victim notifications.
Sources: BleepingComputer | The Hacker News
5. Anthropic launches OSS Scanner, free AI vuln scans for open source
Anthropic opened an opt-in service that gives open-source projects periodic security scans from its strongest models, including Claude Mythos, run inside an air-gapped VM. Maintainers enroll with a pull request to anthropics/oss-scanner. Reports are model-generated with no human triage, so expect some false positives. Anthropic says that in an early run, pen-testers cleared 85 of 97 critical and high findings across 48 projects for disclosure (vendor-reported).
Why it matters: expect a wave of AI-found open-source CVEs and a heavier patching workload downstream. If you manage dependencies for clients, start tuning your triage process.
Sources: The Hacker News | BetaNews
Heads up
Microsoft's October Patch Tuesday lands tomorrow, October 13. September's release fixed roughly 970 flaws with two exploited zero-days, so clear some calendar space.
That's the signal for today. Patch the edge first, argue about AI later. See you tomorrow.
The ChannelBytes crew
