[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMM2ASlqNsRKD8q9WxADTgUyiWNTK8nUwDqj54436wRQ":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"8b593962-188f-4b26-8562-ef2ee648005f","⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests","weekly-recap-netscaler-and-fortimail-0-days-ai-coding-leaks-spectre-v2-and-ranso-634898","A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others","This week's security recap highlights actively exploited vulnerabilities in NetScaler ADC\u002FGateway (CVE-2026-88779) and FortiMail (CVE-2026-104286). Law enforcement made significant arrests, including two members of the ShinyHunters group and the suspected teenage mastermind behind the KillSec ransomware operation, which saw its leak site seized. The article also touches on broader themes of overlooked security basics and the increasing capability of some attacks.","Weekly recap: NetScaler and FortiMail 0-days exploited, AI coding leaks, Spectre v2, and ransomware arrests.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fweekly-recap-netscaler-and-fortimail-0.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhbylNkbHSjWFkh2Ms0FmUT7jm2Qp-l5l9XwzA-O0LeP6LLE2WY9Z5yTiZ6AjikPfdOuId00XC9R_m_HYap_zbOAxUpLNKMK8UAVGiQHr-1zb_IOLyuhyMo_dhlqB5SM6p9b5qabPdThNFnyaHBznmq3H66qlbHxPAzCSuA_glVaWuKcJy51sOkoZp7BIuf\u002Fs1600\u002Finfosec-recap.jpg","2026-10-05T14:20:43+00:00","2026-10-05T16:01:08.333941+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":19},"FortiMail",{"name":25,"type":26},"Citrix","vendor",{"name":28,"type":26},"Fortinet",{"name":30,"type":31},"ShinyHunters","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-88779","Citrix NetScaler ADC and Gateway vulnerability",{"type":57,"value":61,"context":62},"CVE-2026-104286","Fortinet FortiMail vulnerability",[25,28,18],{"controls":65,"vendors":152},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":36,"name":125,"problem":126,"products":127},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[153,158],{"slug":154,"name":25,"logo_path":155,"roles":156},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[157],"affected",{"slug":159,"name":28,"logo_path":160,"roles":161},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[157],{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":177},"netscaler-fortimail-0-days-exploited-amid-ransomware-arrests","NetScaler & FortiMail 0-Days Exploited Amid Ransomware Arrests","Actively exploited zero-day vulnerabilities in widely deployed products like NetScaler ADC\u002FGateway and FortiMail highlight the persistent danger of unpatched internet-facing infrastructure. Zero-days leave organizations with little to no window to react, making proactive defense layers — such as virtual patching, network segmentation, and anomaly detection — critical compensating controls. The concurrent ransomware arrests (ShinyHunters, KillSec) demonstrate that threat actors can be young, globally distributed, and highly capable, reinforcing that no organization is too small to be targeted. Overlooking security basics — timely patching, asset inventory, and monitoring — continues to be the primary enabler of these breaches.",[167,168,169,170,171,172,173,174,175,176],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST IR-4: Incident Handling","NIST CA-7: Continuous Monitoring","ITIL Change Management: Emergency Change Process","ISO 27001 Annex A.12.6: Management of Technical Vulnerabilities","GDPR Article 32: Security of Processing (breach risk mitigation)",{}]