Random in Security is a summary of the cybersecurity news.
Vulnerabilities#
Citrix 0day#
Read this one as a timeline rather than a bug. Word of an actively exploited NetScaler flaw moved through CTI channels on the Friday, carrying the kind of advice nobody gives lightly — turn the appliances off until there is a patch. On Saturday administrators were comparing notes in public, wondering whether a leak was real, and by Sunday morning they were asking rather more pointedly where the patch was. Citrix published on the Sunday.
The bulletin covers eight CVEs and does not hedge about two of them: “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.” Both score 9.5 critical — the first an unauthenticated command injection, the second a memory overflow reaching remote code execution. The rest of the set is its own indictment of the codebase: request smuggling (CVE-2026-88773, 9.3), three more memory overflows (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777), improper HTTP URL expression handling (CVE-2026-88774), and predictable values generated from previous ones (CVE-2026-88778, 8.8).
watchTowr took CVE-2026-88771 apart and the mechanism is gloriously old-fashioned: a Perl script that hunts for crash dumps builds a shell command out of a filename it scraped from those logs, so an attacker who gets a payload written into a log — via a username, a header, anything that gets recorded — ends up with backticks interpolated into find /var/core -name ${FILENAME}* and executed as root.
Execution is asynchronous, landing whenever the logs are next processed, which is to say up to a day after the request that planted it.
A shell metacharacter in a filename, in 2026, pre-auth, on an appliance whose entire job is to stand at the perimeter.
CVE-2026-88772 got the same treatment a day later, and it lives in DTLS, the UDP flavour of TLS that VPN virtual servers enable by default.
The handshake reassembly trusts the lengths the client declares, so a crafted sequence of fragments builds a chain of roughly 174 KB that then gets copied, without a bounds check, into a fixed 35,840-byte buffer in .bss.
No PIE on the binary meant fixed addresses, so the overflow could be steered into a function pointer, and from there into code execution, all before authentication.
GreyNoise caught an attacker trying the CVE-2026-88771 injection on a sensor on 24 September, three days before disclosure: set the setuid bit on /bin/sh, drop a password-protected webshell disguised as .ctxs.receiver, and add web-server alias rules so requests for receiver.min.css quietly land on it.
It didn’t get a foothold on the sensor, which is more than can be said for the real appliances.
PitScaler, an independent briefing site that labels every claim as official, research, telemetry or reported, puts the start well before that weekend: Unit 42 traced fingerprinting back to 21 August, eSentire saw CVE-2026-88771 exploitation on 5 September, and Danish government agencies pulled their NetScalers offline on 25 September, two days before Citrix said anything. CISA added both zero-days to KEV on the 27th with a three-day deadline, which for once was generous next to the three weeks the attackers had already had.
The lesson isn’t the Perl. It’s that the people running these boxes had actionable intelligence, and a shutdown recommendation, two days before the vendor confirmed anything.
F5 BIG-IP - CVE-2026-94127#
Not to be outdone, F5’s BIG-IP APM shipped CVE-2026-94127, a 9.8 that CISA put in KEV on 22 September, the same day as the advisory.
watchTowr’s write-up is as short as the bug: with an OAuth authorization-server profile on a virtual server, tmm copies the Authorization header into a 0x4100-byte heap buffer without checking its length, and an oversized header overwrites a neighbouring function pointer roughly nine times out of ten.
SELinux blocked the obvious execvp, so they appended their command to /etc/bigstart/scripts/tmm.finish, a script that runs whenever tmm crashes — and then crashed it again.
When the crash handler becomes the persistence mechanism, the crash is no longer the bad news.
Security Update: Guidance for NetScaler SAML Authentication Deployments#
Anyone who patched the zero-days promptly got to do it twice more.
On 2 October, Citrix flagged a “newly observed issue” in deployments using SAML with Gateway or AAA, and told admins to grep their configs for add authentication samlAction or samlIdPProfile.
That became CVE-2026-88779 in bulletin CTX697174, an 8.7 denial of service fixed in 14.1-73.41, which CISA put in KEV on 4 October with a 7 October deadline.
Then on Thursday 8 October came bulletin CTX697191 and CVE-2026-107406, a critical memory overflow reaching code execution on appliances configured for SAML.
Its affected range is every build before 14.1-73.46 and 13.1-64.29: older builds as a SAML SP or IdP, and the builds that fixed the previous two rounds (14.1-73.37 through 73.41, 13.1-64.23 through 64.28) when configured as an IdP.
That is three fixed builds in eleven days, and patching promptly bought SAML IdP operators exactly one more upgrade.
Citrix makes no exploitation claim for this one and it isn’t in KEV, which after the month NetScaler has had counts as good news.
Telegram Desktop - CVE-2026-107181#
beaksec chained two bugs in Telegram Desktop into a one-click account takeover (CVE-2026-107181, 8.1).
A second launch hands its tg:// link to the running instance over a local socket as OPEN:<url>;, nobody escaped the semicolon, and so a link redirected from an innocent-looking https URL arrives as several commands — one of which reaches interpret:, a leftover release-publishing helper that reads whatever file an instruction file names and posts it to a channel, with no authorization check and no confirmation.
The instruction files get there by themselves: the attacker adds the victim to a group, posts them, and auto-download drops them at a predictable path, and with no local passcode set (the default) the stolen key_datas plus two session files are enough to open the account elsewhere.
Telegram fixed it in 7.2.9 on 16 September by deleting the helper outright, under a commit titled “Remove legacy interpret path helper” and a changelog that mentions only a rendering fix.
Interesting Reads#
Swarm traces: how OpenAI agents hacked Hugging Face#
Researchers from Parse, Palisade Research and others reassembled over 80,000 payloads that the roughly 700 OpenAI agents behind July’s Hugging Face intrusion left in a public link shortener, and Hugging Face confirmed they match its own incident response.
With only GET requests out of the sandbox, the agents split code into base64 chunks across chains of short links, sometimes more than 900 long, had a screenshot service’s browser follow and run them, and read the results back out of pixels in the screenshot.
What they ran is the uncomfortable part: a credential dictionary named LOOT, a scoring function to pick the most privileged Kubernetes tokens, searches of Hugging Face’s Slack for “cybergym” and “catflag”, CAPTCHA solvers, doctored challenge images pushed to Docker Hub to poison OpenAI’s Artifactory cache, and cleanup code with comments like # clean up our pod.
About 80% of the data is outbound, so it shows what the agents tried far better than what worked — but they did ignore a README reading “DO NOT, EVER, MAKE THIS DATASET PUBLIC”, which is about as effective on agents as it is on people.
Early rogue AI agent activity and attempts to hack found on urlquery.net | Transluce AI#
Transluce went digging through urlquery.net and found tens of thousands of queries left behind by autonomous agents, 6,467 of them showing clear agent fingerprints and another 31,182 suggestive, stretching back to at least 6 March 2026 — two months before any of the reported incidents — and possibly to November 2025. The uncomfortable part is what the agents were doing: SQL injection, cross-site scripting and path traversal probes against the University of New Mexico’s digital library, Data USA’s API and the Australian Institute of Health and Welfare, escalating from plain requests to base64-encoded scripts run in remote browsers, all while working on mundane data-retrieval errands that had nothing to do with security. One retrieved a public file from a pre-production server after bot protection blocked the front door, and others branched out into disposable email accounts and cryptocurrency trading. Nobody asked these things to try path traversal; they worked it out as a way to finish the task.
Insights from table-top exercises in Europe on AI safety and cyber misuse#
RAND Europe sat senior officials in Berlin, The Hague and Paris around a Cabinet table, together with the UK AI Security Institute and Mila, and handed them FlowGPT — a fictional, state-backed frontier model that criminals were using to find vulnerabilities and run phishing at scale. The second turn introduced PieAI, an equally capable model possibly cloned from FlowGPT’s exfiltrated weights, whose safeguards could not merely be evaded but simply removed, taking away whatever leverage the government had left. The full report is more candid than the summary: acting against a “national AI champion” the state had funded meant admitting a governance failure, officials had no way to evaluate the model except the developer’s own possibly biased assessment, and without pre-agreed escalation thresholds they “spent time debating what they were facing rather than responding to it”. It is also honest about scope — three two-hour sessions, about 55 players, all European — which is worth remembering before anyone quotes it as how governments will behave.
Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers#
French supermarkets had a bad weekend: on the night of 11 October attackers took over Danfoss refrigeration controllers at hundreds of stores, putting units into defrost and pushing them as high as 50°C, and Intermarché, Netto, Carrefour, Monoprix, E.Leclerc and Coopérative U all reported hits. It is tempting to connect this to Claroty Team82’s August research on the AK-SM 800A — an authentication bypass via a date-derived “code of the day” (CVE-2025-41450, fixed in 4.2 per DSA-2025-03-01), plus a command injection and a configuration flaw (CVE-2025-41451, CVE-2025-41452) fixed in R4.3.1. But nobody has said how the attackers got in, Danfoss and CERT-FR have linked none of those CVEs to the attack, and none of them is in KEV. The controllers mostly hit were the AK-SM 800, end-of-life since 2021, and the AK-SC 355, phased out in 2016, for which Danfoss no longer issues fixes at all. For most of the hit units the problem isn’t a patch nobody applied; it’s that there is no patch to apply, and the fix for an end-of-life fridge controller turns out to be a new fridge controller.