Iris
← Keeping up with Cybersecurity - Monthly Roundups by Iris
September 2026 roundupPeriod scanned: 1 September – 1 October 20264 min listen

CISA confirms global exploitation of Citrix NetScaler flaws

Audio briefing

4 min

Iris monthly roundup · September 2026 · 44 scanned · 41 usable (7 research · 34 news)
In this report
September's reporting points to simultaneous exposure across edge infrastructure, identity systems, browsers and software supply chains, alongside more adaptive state-linked operations.
  1. CISA confirmed global exploitation of two Citrix NetScaler zero-days, with Citrix patches and indicators available.
  2. Cisco's CVSS 10.0 ISE flaw enables full device control and has entered CISA's KEV catalogue.
  3. Shai-Hulud reached more than 1,000 organizations through exposed credentials and permissive CI/CD paths.

Exploited vulnerabilities

CISA confirms global NetScaler zero-day exploitation

General
CISA confirmed active global exploitation of CVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler ADC and Gateway. For security teams, the issue is not only patch availability but the possibility that an appliance was accessed before remediation.
  • Both vulnerabilities allow remote code execution and were added to CISA's Known Exploited Vulnerabilities catalogue.
  • Citrix released patches and indicators of compromise; updates may require downtime, and CISA advises preserving evidence while checking for compromise.
What this means for you
Internet-facing access infrastructure now sits alongside identity systems as a live incident boundary, so remediation status alone does not establish that exposure has ended.

Cisco ISE zero-day permits full device control

General
Cisco disclosed active exploitation of CVE-2026-76460 in Identity Services Engine, a maximum-severity flaw that can let an unauthenticated attacker take control of an affected device. The report puts identity policy infrastructure, rather than only the endpoint, at the centre of the exposure.
  • The flaw carries a CVSS score of 10.0 and can allow changes to network access policies, credential extraction, log deletion and lateral movement.
  • Cisco confirmed exploitation through a technical support case, while the number of affected organizations remains undisclosed; CISA added it to KEV.
What this means for you
Security architecture assumptions that separate network access control from incident containment are under pressure when the policy engine itself is compromised.

Supply chain and AI-enabled operations

TeamPCP's Shai-Hulud worm reached 1,000 organizations

General
The arrest of two TeamPCP members exposed the scale of Shai-Hulud, a supply-chain worm that compromised more than 1,000 organizations and exposed 500,000 credentials. The case shows how modestly resourced actors can turn weak package and CI/CD controls into broad downstream exposure.
  • The campaign exfiltrated 300 GB of data after using phished maintainer credentials and permissive CI/CD configurations across npm, GitHub and cloud environments.
  • Open-sourcing of Shai-Hulud tooling enabled copycat campaigns, while large language models helped narrow the gap between attacker resources and operational reach.
What this means for you
Software supply-chain exposure now includes the reuse and redistribution of attack tooling, not just the integrity of an individual package or maintainer account.

Anthropic reports Claude-assisted malware evasion

General
Anthropic said a Russia-linked Midnight Blizzard operation used Claude to monitor malware detection and modify the malware's behaviour. The account is a reported incident, not a general measure of how often attackers use AI, but it gives defenders a concrete example of automation being applied to evasion.
  • Anthropic said the operation targeted more than 20 organizations, including government ministries, defence bodies and think tanks in Ukraine and Europe.
  • The group also reportedly exfiltrated proprietary drone-vision software development kits and compromised hotel Wi-Fi vendors; the report does not disclose the full targeting scope.
What this means for you
AI security now intersects with defensive telemetry and response economics: faster attacker iteration can shorten the useful life of static detection assumptions.

Browser and nation-state exposure

Google patches Chrome's seventh exploited zero-day

General
Google patched CVE-2026-87491, an actively exploited out-of-bounds write in Chrome's V8 engine. It is the seventh Chrome zero-day reported in 2026, making browser exposure a recurring operational concern rather than an isolated patch event.
  • The flaw can enable arbitrary code execution through a crafted HTML page; Google has not identified the actor or disclosed the targeting scope.
  • Four of the seven Chrome zero-days reported this year have affected V8, and CISA set a September 23 remediation deadline for federal agencies.
What this means for you
Browser and JavaScript engine exposure remains a persistent part of endpoint risk, with Chromium-based coverage relevant well beyond Google's own managed fleet.

Research maps six North Korean cyber clusters

General
New research describes Lazarus as an umbrella for six North Korean cyber clusters with differentiated roles in espionage, cryptocurrency theft and sanctions evasion. The classification is useful for understanding operational variety, while frequent renaming still limits confidence in fixed actor labels.
  • The clusters identified are TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima.
  • Moonstone Sleet spans espionage and financially motivated activity; CryptoCore and Jade Sleet focus on cryptocurrency and blockchain operations, while fake IT workers provide access and revenue.
What this means for you
Threat-intelligence models that treat Lazarus as one uniform operating unit can obscure materially different access, objectives and attribution signals.
How Iris covered your topics this month
Every topic you track was searched over the last month.
TopicSources foundIn this briefing
General416 stories
Appendix: all 44 sources Iris scanned
General · 41
140+ Data Breach Statistics & Trends From 2026 Reports b… — secureframe.com · 2026-10-01News
Zero-Day Statistics 2026: Exploitation and Patch Windows — stingrai.io · 2026-10-01News
Listen to GNN Daily News Podcast — radio-philippines.com · 2026-10-01News
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-202… — unit42.paloaltonetworks.com · 2026-09-30News
(PDF) Containment Failure The OpenAI-Hugging Face Incident a… — researchgate.net · 2026-09-29Research
The Developer is the New Perimeter: How Supply Chain Attacks… — blog.qualys.com · 2026-09-28News
Warning: Citrix NetScaler ADC & NetScaler Gateway RCE ... — ccb.belgium.be · 2026-09-28News
Critical Zero-Day Vulnerabilities Exploited in Citrix NetSca… — content.govdelivery.com · 2026-09-27News
What Is Nation-State Attacker? Definition & Examples — nhimg.org · 2026-09-27News
Security Data Breaches Tracker: Latest Major Hacks — kiuwan.com · 2026-09-24News
CISOs can no longer ignore the nation-state threat | CSO Onl… — csoonline.com · 2026-09-22News
Software Supply Chain Security for CDEs | InfraGap — infragap.com · 2026-09-22News
Live updates: World leaders gather at UN General Assembly - … — bbc.com · 2026-09-22News
PBS News Hour | Trump defends Iran war at UN General Assembl… — pbs.org · 2026-09-22News
Middle East wars loom over UN General Assembly, and other Mi… — local10.com · 2026-09-22News
Up First briefing: CNN, MS Now and Politico; UNGA speech; Pa… — npr.org · 2026-09-22News
Officials describe a world in turmoil as UN opens annual mee… — apnews.com · 2026-09-22News
World leaders convene for UNGA. And, Trump says D.C. arch wi… — gpb.org · 2026-09-21News
What Is Cloud Security? Components, Risks & Responsibili… — cloudsek.com · 2026-09-21News
Exploited vulnerabilities & zero-days · ZeroHour — zerohour.day · 2026-09-18News
Cisco alerts customers to second actively exploited zero ... — cyberscoop.com · 2026-09-17News
3 Layers of a Mature Software Supply Chain Security Program — veracode.com · 2026-09-17News
Cisco warns customers of actively exploited zero-day in emai… — cyberscoop.com · 2026-09-15News
Are We Exposed? Turning Threat Intelligence Into Action with… — paloaltonetworks.com · 2026-09-15News
Seventh Actively Exploited Chrome Zero-Day Hits V8 — labs.cloudsecurityalliance.org · 2026-09-15News
The New Chinese Way of Cyberwar | Foreign Affairs — foreignaffairs.com · 2026-09-15News
Anthropic Says Russian Hackers Used Claude AI to Automate Ma… — securityweek.com · 2026-09-11News
A Comprehensive Analysis of Machine Learning-Based File Trap… — dl.acm.org · 2026-09-10Research
For North Korea, AI is a cybercrime force multiplier | The S… — aspistrategist.org.au · 2026-09-10News
AI Is Giving Lesser-Resourced Attackers Nation-State-Level R… — securityweek.com · 2026-09-09News
Cascaded Vulnerability Attacks in Software Supply Chains | P… — dl.acm.org · 2026-09-09Research
A Data-Driven Analysis of Infostealer Malware Victims | Zenodo — zenodo.org · 2026-09-08Research
Mitigating third-party cyber risk by managing service accoun… — tenchisecurity.com · 2026-09-08News
Most Flaws Exploited This Week Already Had a Fix — suriq.io · 2026-09-08News
North Korea’s Lazarus Operates Through Six Distinct Cyber Cl… — infosecurity-magazine.com · 2026-09-07News
A Survey on Cybersecurity Threats in Industrial and Informat… — dl.acm.org · 2026-09-04Research
Item - Abeysekera, I. (2026). The Mercer Advisors Data Breac… — figshare.com · 2026-09-03News
Supplier Breaches and the Risk-Dependence Trade-Off: Journal… — doi.org · 2026-09-02Research
How China industrialized the infrastructure behind state hac… — csoonline.com · 2026-09-02News
Evaluating the characteristics and impacts of cyberattacks o… — sciencedirect.com · 2026-09-02Research
The Shai-Hulud Playbook: TeamPCP and Supply-Chain ... — labs.cloudsecurityalliance.org · 2026-09-01News
Low signal — scanned and set aside · 3
General News Archives - Goal Poacher News — goalpoachernews.com · 2026-09-24Low signal
Supply Chain Security Market Size, Share, Growth | Industry … — fortunebusinessinsights.com · 2026-09-21Low signal
General News - My World News Era — myworldnewsera.com · 2026-09-08Low signal
Tell Iris what to cover more, less, or differently. It shapes your next briefing.
This briefing was generated by Iris Briefings.
Iris uses artificial intelligence to synthesise recent developments in your field. It can make mistakes, so please verify anything critical against the linked primary sources before acting on it. Thank you for supporting Iris.

Want this for your field?

Iris builds a briefing agent around your own profile: your field, your focus areas, your context. Delivered on your schedule.

Get your own briefing

Iris is a tool that uses AI to find publicly available information and extract the insights that matter for you. Iris Briefings have taken precautions to ensure our systems are robust but these are not infallible. Nothing in your briefings should be taken for medical, legal or professional advice and Iris cannot take responsibility for your decisions. We encourage you to do your own due diligence on the primary sources that Iris references for critical decisions.