For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems. The new THOR Preview signature set currently includes: - EXPL_CVE_2026_88772_POC_Sep26 Detects artifacts related to the public CVE-2026-88772 PoC - LOG_SUSP_EXPL_CVE_2026_88771_Sep26 Detects potential CVE-2026-88771 exploitation traces in NetScaler logs - WEBSHELL_CSS_PassThrough_Sep26 Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise We also released a new IOC set: - NetScaler ADC suspicious file artifacts It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories. The Preview signatures are already available with: ./thor-util update --sigdev We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers. Details: nextron-systems.com/2026/09/… And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here: nextron-systems.com/2023/07/…

Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering malware or redirecting auth flows at their discretion, globally. Since early May 2026, we saw this subcluster manipulate DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. We’re calling the campaign CaptiveCrunch. “We have observed notable commonalities in the equipment and management systems used across multiple affected networks.” We break down the malware & techniques, but the most important part is how dynamic all of it is: Midnight Blizzard is using AI to support a significant portion of these operations. They are moving and changing quickly. Feedback welcome on the suggested mitigations: microsoft.com/en-us/security… Help spread the word to VIPs in governments, diplomatic entities, non-governmental organizations (NGOs) in the US and Europe (probably also those traveling to Black Hat)

🚨 The "𝙼𝚎𝚐𝚊𝚕𝚘𝚍𝚘𝚗" Campaign is live... 𝟻,𝟽𝟷𝟾 malicious commits to 𝟻,𝟻𝟼𝟷 GitHub repositories in a six-hour window. Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected 𝙶𝚒𝚝𝙷𝚞𝚋 𝙰𝚌𝚝𝚒𝚘𝚗𝚜 workflows containing 𝚋𝚊𝚜𝚎𝟼𝟺-𝚎𝚗𝚌𝚘𝚍𝚎𝚍 bash payloads that exfiltrate: - CI secrets, - cloud credentials - SSH keys - OIDC tokens - source code secrets Check your repo / Technical details: safedep.io/megalodon-mass-gi…

We released first detection rules for Copy Fail / CVE-2026-31431. YARA rules by me: github.com/Neo23x0/signature… It covers public PoC artifacts, including known payloads, exploit code fragments and URLs seen in shared material. More generic rules for customer environments are still in testing. Sigma rules by @_swachchhanda_: github.com/SigmaHQ/sigma/pul… They cover suspicious Copy Fail-related exploitation patterns, including setuid binary execution behavior and NULL argv shell execution. More updates soon.

You probably already heard about Copy Fail - the Linux LPE that affects basically every current distro and shared-kernel/container environment I’ll post a few updates here soon copy.fail/