⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
Weekly recap: NetScaler and FortiMail 0-days exploited, AI coding leaks, Spectre v2, and ransomware arrests.
This week's security recap highlights actively exploited vulnerabilities in NetScaler ADC/Gateway (CVE-2026-88779) and FortiMail (CVE-2026-104286). Law enforcement made significant arrests, including two members of the ShinyHunters group and the suspected teenage mastermind behind the KillSec ransomware operation, which saw its leak site seized. The article also touches on broader themes of overlooked security basics and the increasing capability of some attacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Citrix?
Get an email when a new story names Citrix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonActively exploited zero-day vulnerabilities in widely deployed products like NetScaler ADC/Gateway and FortiMail highlight the persistent danger of unpatched internet-facing infrastructure. Zero-days leave organizations with little to no window to react, making proactive defense layers — such as virtual patching, network segmentation, and anomaly detection — critical compensating controls. The concurrent ransomware arrests (ShinyHunters, KillSec) demonstrate that threat actors can be young, globally distributed, and highly capable, reinforcing that no organization is too small to be targeted. Overlooking security basics — timely patching, asset inventory, and monitoring — continues to be the primary enabler of these breaches.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-88779
- cve — CVE-2026-104286