Loki Intelligence — Security Briefs · Published
Daily Security Brief: NetScaler SAML Zero-Day, AitM Phishing and SharePoint Ransomware
Identity infrastructure is the common target today, from a newly exploited NetScaler SAML zero-day to adversary-in-the-middle phishing that captures Microsoft sessions and SharePoint intrusions that end in ransomware. Teams should re-patch SAML-enabled NetScaler appliances, move high-risk users to phishing-resistant authentication, and close remaining on-premises SharePoint exposure.
Signal 01 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-88779 to the KEV catalog, a Citrix NetScaler vulnerability described as improper restriction of operations within the bounds of a memory buffer. The catalog entry describes a denial-of-service impact on NetScaler ADC and Gateway, and the listing reflects evidence of active exploitation.
Why it matters: Inventory NetScaler ADC and Gateway appliances and install Citrix's newest fixed builds, even where earlier NetScaler patches were just applied, while watching for unexplained appliance reboots.
Source: CISA
Signal 02 · BleepingComputer
Citrix patches NetScaler SAML zero-day exploited in attacks
Citrix released emergency NetScaler ADC and Gateway builds 14.1-73.41 and 13.1-64.28 for CVE-2026-88779, a CVSS 8.7 memory flaw exploited against SAML-enabled appliances. Citrix rates the impact as denial of service, but administrators and researchers are examining crash and payload-download activity that may point to code execution.
Why it matters: Check for samlAction or samlIdPProfile configuration, upgrade again even if you just patched the prior NetScaler flaws, and investigate repeated nsaaad crashes or unexpected reboots.
Source: BleepingComputer
Signal 03 · The Hacker News
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations
This sponsored report from multiple security vendors outlines trends across ten segments, from identity and endpoint management to human risk, connected devices and cloud. Recurring themes include managing growing numbers of non-human identities, countering AI-enabled social engineering, and shrinking the gap between finding a weakness and enforcing a control.
Why it matters: Teams can benchmark their programs against these themes, especially continuous patching, governance of machine identities, and impersonation monitoring across email, domains and DNS.
Source: The Hacker News
Signal 04 · BleepingComputer
Anthropic asks Claude users to share voice data for AI model training
Anthropic has begun prompting Claude users to opt in to sharing voice conversations for AI model training. The setting is separate from the existing chat and coding-session training option, appeared off by default in the interface BleepingComputer reviewed, and can be turned off later with stored voice data deletable from settings.
Why it matters: Organizations allowing AI assistants at work should cover voice and data-sharing settings in their AI usage policies, since audio may capture sensitive business conversations.
Source: BleepingComputer
Signal 05 · The Hacker News
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
Proofpoint attributes credential phishing campaigns against U.S. AI policy experts at think tanks, universities and legal organizations to TA419, a China-aligned espionage group. After trust-building outreach, targets are routed to a OneDrive-themed adversary-in-the-middle page that captures Microsoft session data while the sign-in appears to succeed normally.
Why it matters: Deploy phishing-resistant authentication such as passkeys for policy, research and legal staff, and verify unsolicited expert outreach through a separate channel before following links.
Source: The Hacker News
Signal 06 · The Hacker News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
Warlock, also tracked as Longlegs and Gold Salem, hit at least four organizations in two months, including a water utility, a telecom provider, a regional government body and a university. In one intrusion, the actors pushed a security-disabling tool to at least 40 hosts in about two hours before deploying ransomware through SYSVOL.
Why it matters: Rapid domain-wide deployment demands fast detection: alert on security-tool tampering, unusual SYSVOL changes and VS Code tunnel use, and patch exposed SharePoint farms.
Source: The Hacker News
Signal 07 · The Hacker News
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
Reuters reported, citing sources, that a suspected ShinyHunters member known as Rey was detained in Jordan in late September and is cooperating with the FBI to identify other members. The report follows a recent arrest in Amsterdam, and the FBI alleges the group's members breached more than 140 organizations.
Why it matters: Arrests rarely stop extortion crews quickly, so keep hardening third-party and cloud platform access, verify identities rigorously in support workflows, and monitor for bulk data exports.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.