Cybersecurity
Weekly recap covers NetScaler flaws and AI leaks
The weekly roundup reported exploited flaws in Citrix NetScaler and Fortinet FortiMail, arrests tied to ShinyHunters and KillSec, state-linked malware activity, and screenshots exposed by AI coding agents.
- Citrix said it had issued updates for CVE-2026-88779 after targeted zero-day attacks on NetScaler ADC and NetScaler Gateway.
- CISA warned that CVE-2026-104286 in Fortinet FortiMail was being actively exploited, and Fortinet said crafted HTTP or HTTPS requests could let an unauthenticated attacker write files.
- Spanish police arrested a 16-year-old suspected of leading KillSec, while Europol said three suspects were provisionally arrested and properties were searched in Greece, Romania, Spain and the UK.
- Microsoft said Star Blizzard used phishing emails, RedFlick and CosmicPulse against Ukrainian, NGO and policy-linked targets.
- Glow Labs said AI coding agents exposed more than 13,000 screenshots from 343 companies to public GitHub repositories in research it called PixelLeak.
Citrix said it had released security updates for CVE-2026-88779 after targeted zero-day attacks against NetScaler ADC and NetScaler Gateway. Fortinet also came under notice after CISA warned that FortiMail CVE-2026-104286 was being actively exploited, and Fortinet said the flaw could allow arbitrary file writes through crafted web requests.
Police in Spain arrested a 16-year-old who is suspected of leading KillSec, also known as the Kill Security Ransomware Group. Europol said three suspects were provisionally arrested, eight properties were searched in Greece, Romania, Spain and the UK, and the group’s leak site was taken over on 30 September 2026.
Microsoft said Star Blizzard used phishing emails and a new RedFlick chain to install CosmicPulse against Ukrainian individuals and institutions, NGOs, think tanks and other policy-linked organisations. Microsoft also said NeedyMantis had been seen in limited targeted operations and had been active since at least October 2025.
Cleafty said RatHat had used Google Gemini to estimate victims’ bank balances and sort devices into value tiers. Glow Labs said AI coding agents had posted more than 13,000 sensitive screenshots from 343 companies to public GitHub repositories, which it called PixelLeak.
Named in this story
People
- Pepijn van der Stap
- was believed to be one of the arrested members
- Saif al-Din Khader
- was said to have been detained by Jordanian authorities
Companies
- Citrix
- released updates for the exploited NetScaler flaw
- Fortinet
- said the FortiMail flaw could let attackers write files
- Microsoft
- described Star Blizzard, RedFlick and NeedyMantis activity
- Glow Labs
- reported the PixelLeak screenshot exposures
Organisations
- ShinyHunters
- had two associated members arrested
- KillSec
- had its leak site taken over and members arrested
- Europol
- said authorities seized the leak site and searched properties
- Star Blizzard
- used phishing emails to deliver CosmicPulse
Governments and agencies
- CISA
- warned that the FortiMail flaw was under active exploitation
Products and systems
- NetScaler ADC
- was affected by the targeted zero-day attacks
- NetScaler Gateway
- was affected by the targeted zero-day attacks
- FortiMail
- was the subject of an actively exploited flaw
- CosmicPulse
- was the backdoor Star Blizzard tried to install
- RedFlick
- was the delivery chain used in the phishing campaign
- NeedyMantis
- was used for long-term post-compromise access
- Google Gemini
- was used by RatHat to sort victims by value
- RatHat
- used Gemini in its Android malware operation
How the source tells it
The piece used a brisk, high-alert security-news register, with repeated emphasis on active exploitation and urgent patching, but it mostly stayed with straight incident summaries.
- urgency through recurring patch-now framing and weekly roundup cues
- alarm by foregrounding active exploitation, arrests and leak exposure as the headline items