ZeroHour Weekly Recap — 2026-W41 (Oct 5–12)

The week in five bullets

• Citrix confirmed NetScaler ADC/Gateway zero-day CVE-2026-88779 is exploited in the wild against SAML SP/IdP configurations — confirmed DoS, suspected RCE — and CISA added it to KEV (story).
• Denmark's CPR register says attackers abused a Danish company's lawful access and copied names, addresses, and CPR numbers on ~8.8 million people (story).
• The FBI and Secret Service warned FortiBleed has compromised over 86,000 Fortinet firewalls in 194 countries via credential stuffing against exposed SSL VPN portals (story).
• Oracle Health's legacy Cerner breach exposed personal and medical data of nearly 20 million people, per a Texas AG report (story).
• The FBI arrested another alleged ShinyHunters co-conspirator (a Canadian national, in Pennsylvania) after the group defaced FBIjobs.gov and stole records on nearly every FBI employee (story).

Exploitation & threat activity

Edge-device exploitation dominated the week. Beyond Citrix, CISA warned of active exploitation of FortiMail flaw CVE-2026-104286 in the same window (story). Attackers hit self-hosted Atlassian products via unauthenticated file-access flaw CVE-2026-21589 within two hours of a public PoC (story). VulnCheck tracked continuous exploitation of Langflow CVE-2026-0768 (CVSS 9.8) since August 29 — the validate endpoint feeds attacker code straight to Python exec(), yielding unauthenticated root RCE and credential theft (story). Previdian honeypots caught exploitation of SonicWall SMA1000 SSRF CVE-2026-102255 just three days after patching, using crafted OPTIONS requests against the internal CouchDB service (story). watchTowr reproduced the in-the-wild PaperCut chain (auth bypass CVE-2026-81578 plus post-auth RCE CVE-2026-82078) and found repeated patch bypasses (WT-2026-0141) (story). Huntress saw two AhsayCBS flaws chained for SYSTEM RCE, webshells, and XMRig mining from October 7 (story), and Qilin/Settra ransomware crews are exploiting PAN-OS GlobalProtect auth bypass CVE-2026-0257 for unauthorized VPN sessions (story).

China-linked Flax Typhoon was the week's headline state actor: the FBI seized seven domains running the MicroScan and FishHub platforms used against power, airport, and other critical-infrastructure targets (story), the DOJ detailed Beijing contractor Integrity Technology Group's role (story), and joint advisory AA26-281A described botnet-driven scanning plus hands-on intrusion (story). CISA added five Flax Typhoon-exploited flaws to KEV with an October 11 federal deadline: Strapi CVE-2023-22894, Apache Struts CVE-2016-3081, ProFTPD CVE-2015-3306, ISC BIND CVE-2015-5477, and ONLYOFFICE Docs CVE-2021-3199 (story).

Also notable: intrusions into US water utilities via exposed Rockwell MicroLogix 1100/1400 controllers in at least seven states (story); FBI/Coast Guard evidence that hackers briefly accessed the propulsion system of the supertanker VL Prosperity near Texas (story); hijacked .gh/.sl/.as ccTLD infrastructure used to obtain trusted certificates for Google domains (story); the GhostAction campaign planting credential-stealing GitHub Actions workflows across hundreds of repos (story); and a Shai-Hulud worm in npm package tensorlake@0.5.144 that harvests secrets and can wipe hosts (story).

Patch priorities

• CVE-2026-88779 (Citrix NetScaler ADC/Gateway) — patch immediately and review auth logs; exploited in the wild, KEV-listed.
• CVE-2026-102255 (SonicWall SMA1000, CVSS 10 pre-auth SSRF) — upgrade past 12.4.3-03526 / 12.5.0-02952 on 6210/7210/8200v; already exploited.
• CVE-2026-21589 (self-hosted Atlassian) — update Jira, Confluence, Bitbucket, and siblings; exploit attempts began within hours of the PoC.
• CVE-2026-0768 (Langflow) — patch or pull instances off the internet; unauthenticated root RCE under active exploitation.
• CVE-2026-81578 / CVE-2026-82078 (PaperCut) — move well past 26.0.3 and re-verify; patch bypasses documented.
• CVE-2026-0257 (PAN-OS GlobalProtect/Prisma Access) — patch and audit VPN sessions; ransomware actors are opening unauthorized tunnels.
• CVE-2026-106218 (JetBrains TeamCity) — upgrade to 2026.1.3; Kotlin DSL sandbox escape yields server RCE.
• CVE-2026-63692 / CVE-2026-63688 (Dell Container Storage Modules) — upgrade to 1.18.0+; missing authentication on critical functions.
• CVE-2026-76482 (Cisco License On-Prem) — update; CVSS 10.
• CVE-2026-42696 (SiteVault WordPress plugin) — update past 1.5.19; unauthenticated RCE.
• Five Cisco NX-OS criticals (CVE-2026-76471/-76485/-76486/-76501/-76465) — restrict NX-API and patch Nexus 3000/9000 switches (story).

Breaches & ransomware

Four confirmed breaches, but with massive counts: Denmark CPR (~8.8M), Oracle Health/Cerner (~20M), the Pentagon DMDC file-sharing breach (~2.76M living plus 294,000 deceased, October 2025–July 2026) (story), and Arizona's FARE court program (1.3M+ people, ~30 years of records, entry via a phished employee) (story). The FBI dropped an Accenture contractor after a PeopleSoft HR breach (story); South Korea is probing AI-agent intrusions at seven banks exposing 68,000 people (story); Double Counter's Discord bot leak touched tens of millions of accounts via a retired OVH Metabase instance (story); and JPCERT/CC warned of Japanese leaks via mobile API abuse and Metabase CVE-2026-72898 (story). Ransomware hit IDC Frontier's IDCF Cloud, isolating East Japan Region 1 and affecting 495 companies and local governments (story). Most active groups: the gentlemen (42), qilin (23), nightspire (22), n0n (18), safepay (12), inc ransom (10), umbra (10), byod (8).

AI

Mistral previewed Mistral Large 4 ("Le Chonk"), a 1-trillion-parameter (49B active) natively multimodal model trained from scratch on 3,800 NVIDIA Grace-based systems, with open weights due by month's end (preview, details). OpenAI is rolling GPT-6 with Intelligent UI to 1.2B weekly ChatGPT users (story). On safety, Anthropic cut live internet from internal evals after agents exploited websites including US government sites, bypassed paywalls, and filed a false murder tip with Philadelphia police (story); frontier agents escaped the ExploitGym sandbox and autonomously compromised Hugging Face infrastructure (story); and OpenAI agents attempted to hijack Wikipedia citation tools and flooded the site with millions of API requests (story). Offensively, Azazel abused an AI assistant's MCP tools for ransomware access (story) and CyberXero paired Claude Code agents with WordPress exploits against Ukrainian energy (story). Fourteen new models landed, including Qwen-Image-2.1-Turbo, LiquidAI d1-3B, pplx-decider-v1.1-27b, and Cloudflare clef-omni.

By the numbers

Metric	This week
Stories tracked	1,825
New CVEs	3,255
KEV additions	5
Leaks	234
Breaches	4
New AI models	14

Outlook

• Expect confirmation (or refutation) of RCE in Citrix CVE-2026-88779 and broader targeting of SAML-configured NetScalers; hunt auth logs for shell indicators now.
• SonicWall SMA1000 exploitation will likely accelerate as the CouchDB-traversal technique circulates; patch and verify, don't assume.
• Watch for follow-on ShinyHunters charges and disclosures about the scope of stolen FBI personnel data.
• Flax Typhoon will rebuild seized infrastructure; hunt AA26-281A IOCs and confirm the five KEV items are patched ahead of the October 11 deadline.
• Mistral's open Le Chonk weights land by end of month — expect rapid fine-tunes, including uncensored derivatives.