cybr.cx Daily Digest — October 08, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-88779 | Citrix NetScaler ADC & Gateway | CVSS: N/A (KEV listed)
Citrix NetScaler ADC and NetScaler Gateway contain a memory buffer bounds vulnerability enabling denial-of-service attacks. CISA added this to the Known Exploited Vulnerabilities catalogue on October 4th with a remediation deadline that has already passed — if you're running NetScaler infrastructure and haven't patched, you're almost certainly already a target. Treat this as a fire drill.

⚠️ Actively exploited — CVE-2026-102489 + CVE-2026-102490 | Zammad | CVSS: N/A (KEV listed)
Two chained vulnerabilities in the Zammad helpdesk platform are being exploited in the wild right now. CVE-2026-102489 is a session fixation flaw enabling remote code execution as the zammad user; CVE-2026-102490 then escalates that foothold to root via improper privilege management. The combination means an attacker can go from unauthenticated network access to full system compromise in two steps. Both had CISA remediation deadlines of October 5th — patch immediately.

⚠️ Actively exploited — CVE-2026-104286 | Fortinet FortiMail | CVSS: N/A (KEV listed)
An unauthenticated path traversal flaw combined with null byte injection in FortiMail allows attackers to write arbitrary files to the underlying system via crafted HTTP/HTTPS requests — a classic setup for webshell deployment. Active exploitation was confirmed as of October 1st. FortiMail sits at the perimeter of most enterprise email stacks, making this particularly high-value for threat actors seeking initial access.

⚠️ Actively exploited — CVE-2026-76504 | Cisco Catalyst SD-WAN Manager | CVSS: N/A (KEV listed)
A hex encoding / URI handling flaw in Cisco Catalyst SD-WAN Manager allows an unauthenticated remote attacker to authenticate as the admin user. This is essentially an authentication bypass on your network management plane — the blast radius is severe for any organisation running SD-WAN at scale. Exploitation was confirmed in the wild as of September 30th.

CVE-2026-97655 & CVE-2026-97678 | IBM Langflow OSS 1.0.0–1.12.2 | CVSS: 8.8 (HIGH)
Two separate remote code execution vulnerabilities in IBM's Langflow platform: one exploits an incomplete blocklist in the code security scanner (unauthenticated), the other exploits improper input validation (authenticated). AI pipeline tooling like Langflow often runs with broad system privileges and access to sensitive data and model infrastructure — RCE here can be devastating. Upgrade beyond 1.12.2 immediately.

CVE-2026-106059 | GitAhead ≤ 2.7.1 (macOS) | CVSS: 8.8 (HIGH)
A command injection vulnerability in the macOS Git client GitAhead allows an attacker to execute arbitrary shell commands by crafting repository filenames that contain a double-quote followed by an AppleScript do shell script payload. The exploit fires when a victim clicks "Show in Finder" — a completely routine action. This is a supply-chain-adjacent risk: a malicious repository contributor can target any developer who clones their repo with GitAhead. Avoid the app until patched.

CVE-2026-76453, CVE-2026-76458, CVE-2026-76459, CVE-2026-76472 | Cisco NX-OS | CVSS: 8.6–8.8 (HIGH)
Cisco's internal security review has surfaced a cluster of NX-OS vulnerabilities covering improper neutralisation of special elements, out-of-bounds writes, and improper handling of exceptional conditions. NX-OS powers Nexus data centre switching infrastructure, so these warrant urgent attention in any environment running large-scale Cisco fabric. Apply the hardening releases Cisco has issued alongside these disclosures.

CVE-2026-77214 | libexpat (pre-commit 13c5f63) | CVSS: 8.2 (HIGH)
A heap buffer over-read in libexpat's XML_ParseBuffer allows a caller-supplied length value to advance the parse buffer pointer beyond the heap allocation boundary, potentially enabling information disclosure or memory corruption. libexpat is a foundational XML parsing library embedded in an enormous number of applications and Linux distributions — the actual exposure surface here is much wider than a single CVSS score implies. Check your dependency trees.

Headline News

Counterfeit TLS Certificates Issued for Google and Major Services

Threat actors have obtained fraudulent TLS certificates for high-profile domains including Google, in what appears to be a significant failure in the certificate authority trust model. Counterfeit certificates of this nature enable man-in-the-middle attacks that browsers and end users have no reliable way to detect without active Certificate Transparency log monitoring. The incident raises urgent questions about the robustness of CA vetting processes and whether existing controls — CAA DNS records, CT log auditing, and multi-perspective issuance validation — are being consistently enforced. For practitioners, this is a reminder to ensure your Certificate Transparency monitoring is active and alerting on unexpected certificate issuances for your domains. The potential for abuse in targeted intrusion campaigns, credential harvesting, and API interception is substantial.

South Korea Attributes Bank Hacks to AI-Assisted Threat Actors

South Korean authorities have publicly stated that AI agents appear to have been weaponised in cyberattacks against the country's banking sector — one of the first government-level attributions of AI-driven offensive tooling in a financial sector breach. While specific technical indicators haven't been fully disclosed, the implication is that AI was used to automate reconnaissance, adapt attacks in real time, or scale operations beyond what human operators alone could achieve. This matters because it signals a concrete shift from theoretical concern to confirmed operational reality: adversaries are deploying AI as an active component of their attack chains, not just for phishing content generation. Blue teams should be stress-testing detection logic against higher-velocity, more adaptive attack patterns — the assumption that human-paced intrusion timelines still apply may no longer hold. The incident is likely to accelerate regulatory scrutiny of AI-assisted attacks across the financial sector globally.

Schrödinger's Feed

A Government Accountability Office report reviewed in this week's quantum news cycle reveals that none of the 24 major U.S. federal agencies assessed have fully completed the preparation practices recommended for defending against quantum computing threats — despite post-quantum cryptography standards from NIST now being finalised and available. This isn't a distant horizon problem: "harvest now, decrypt later" attacks mean adversaries may already be archiving encrypted government communications to decrypt once capable quantum hardware exists. Separately, a Jülich Supercomputing Centre benchmark found Quantinuum's trapped-ion systems maintaining algorithmic signal clarity on a 91-data-qubit colour code, suggesting error-corrected quantum computing is advancing faster than many migration timelines account for. Practitioners should treat PQC migration planning as an active project, not a roadmap item — the GAO findings suggest most organisations are dangerously behind.

/dev/random

A user on a malware removal forum this week described how a Gemini-generated response pointed them toward a fake GitHub repository impersonating OpenBB — a legitimate open-source terminal project — which promptly infected them with an infostealer upon execution. The specific trick: the malicious repo was surfaced by the AI as a direct link, bypassing the user's usual scepticism about sketchy download sites because it appeared to be an authoritative suggestion from a trusted AI assistant. It's a neat illustration of a new social engineering surface: attackers poisoning AI training data or SEO-optimising fake repos to appear in AI-generated recommendations. The moral of the story — "an AI told me it was legit" is not a threat model.