Cybersecurity Threat Digest: September 30, 2026

Top Stories#

Bitget reports $387.5 million cryptocurrency theft

Cryptocurrency exchange Bitget said attackers stole approximately $387.5 million after breaching its systems through a zero-day in third-party security products, according to BleepingComputer.

The report does not identify the affected security-product vendors in the supplied information. Organizations operating exchanges, financial platforms, or other high-value systems should review every security product with privileged access, network reach, or access to signing infrastructure. This review should form part of broader risk management procedures.

Defender priorities:

• Build an inventory of third-party security products connected to production, identity, cloud, and transaction systems.
• Verify emergency patches and vendor guidance through trusted support channels.
• Restrict management interfaces to approved administration networks.
• Review privileged service accounts, API tokens, signing keys, and authentication material.
• Preserve endpoint, identity, network, and application logs before making disruptive changes.
• Treat unexplained administrative activity or transaction anomalies as potential compromise indicators.

Citrix NetScaler zero-day exploited to deploy web shells

Security reporting indicates that attackers are exploiting Citrix NetScaler CVE-2026-88772 through a pre-authentication path that can lead to shellcode execution. Reported activity includes web-shell deployment, tunneling malware, root access, credential theft, and movement into internal networks. See BleepingComputer’s report and the exploit-detail report indexed by Google News.

Treat internet-facing appliances as a high priority even when administrators have not observed obvious compromise. A successful edge-device intrusion can provide attackers with a durable foothold and visibility into internal authentication flows, enabling lateral movement into internal networks.

Malicious custom ChatGPTs promote ClickFix malware

Threat actors are using malicious custom ChatGPT variants promoted through sponsored Google results to direct users to ClickFix pages, according to BleepingComputer.

ClickFix attacks typically persuade users to copy and execute commands under the pretext of fixing a browser, security check, or application problem. AI-themed pages make the lure more credible and may bypass a user’s normal suspicion of unsolicited downloads.

Security teams should monitor for:

• PowerShell or scripting-engine execution shortly after browser activity.
• Clipboard-related user reports or browser processes spawning command interpreters.
• New remote-access tools, unauthorized persistence, and outbound connections to unfamiliar infrastructure.
• Sponsored-search destinations and lookalike AI service domains.
• Endpoint alerts involving encoded commands, script interpreters, or unusual child processes from browsers.

FBI urges suspected ShinyHunters members to surrender

The FBI urged suspected members of the ShinyHunters extortion group to turn themselves in after Dutch authorities arrested an alleged group leader, BleepingComputer reports.

The development does not remove the operational risk from prior intrusions. Organizations associated with extortion incidents should continue monitoring for data theft, unauthorized persistence, follow-on extortion, and attempts to re-enter systems using credentials stolen during earlier activity.

Merrimack County contains cybersecurity incident

Merrimack County reported that it contained a cybersecurity incident while its investigation continued, according to the Google News report.

“Contained” should not be treated as equivalent to fully remediated. The county and its responders should preserve evidence, determine the initial access vector, validate eradication, and assess whether personal, operational, or law-enforcement-sensitive information was accessed.

Microsoft rolls out Linux container support for WSL

Microsoft announced general availability of WSL Containers, extending Windows Subsystem for Linux beyond running Linux distributions. BleepingComputer reports that the capability enables Linux container workflows within WSL.

Administrators should update endpoint and developer-platform policies to account for container images, bind mounts, secrets, local registries, and network access. WSL environments can introduce software supply-chain and data-boundary concerns even when they run on managed Windows systems.

Recommended controls include:

• Restrict use of unapproved container images and registries.
• Scan images for vulnerable packages and embedded secrets.
• Define whether WSL containers may access production credentials or sensitive host paths.
• Monitor container processes and network connections on managed endpoints.
• Include WSL and local container data in endpoint offboarding procedures.

Signal completes encrypted local backup rollout

Signal version 8.30 completes the rollout of encrypted local backups across supported iOS and desktop applications, according to BleepingComputer.

Organizations using Signal for sensitive communications should document backup ownership, recovery procedures, device loss scenarios, and the distinction between encrypted backups and centralized enterprise retention. Users should understand where backup material is stored and how recovery keys are protected.

Critical Vulnerabilities#

CVE-2026-88772: Citrix NetScaler pre-authentication exploitation

Reported exploitation of CVE-2026-88772 affects internet-facing Citrix NetScaler appliances and may enable shellcode execution before authentication. Reporting links the activity to web shells, tunneling, root-level access, credential theft, and lateral movement. Review BleepingComputer’s coverage for the available exploitation details.

Priority actions:

1. Identify every internet-facing NetScaler appliance and its software version.
2. Apply the vendor-recommended patch or mitigation as soon as it is available.
3. Restrict management access and remove unnecessary exposure while remediation is underway.
4. Hunt for web shells, unexpected files, modified configurations, new accounts, and unusual administrative sessions.
5. Rotate credentials and tokens that may have been exposed through the appliance.
6. Review authentication, VPN, proxy, DNS, and east-west network telemetry for follow-on activity.

CVE-2023-54400: Fumasoft Fumeng Cloud SQL injection

CVE-2023-54400 is an unauthenticated SQL injection vulnerability in AjaxMethod.ashx in Fumasoft Fumeng Cloud. The supplied record rates it CVSS 9.8 and states that attackers can extract, disclose, or modify Microsoft SQL Server data. Exploitation evidence was observed by Shadowserver on October 18, 2023, but the supplied data does not mark the vulnerability as listed in CISA KEV.

References include the Nuclei detection template, the Goby proof of concept, and the VulnCheck advisory.

Priority actions:

• Locate all Fumeng Cloud deployments and determine whether AjaxMethod.ashx is externally reachable.
• Restrict access through network controls or an authenticated reverse proxy where feasible.
• Apply available product remediation and validate the result with authorized testing.
• Review web-server and SQL Server logs for unauthenticated requests, unusual query volume, data extraction, or modifications.
• Rotate database credentials if application compromise cannot be ruled out.

CVE-2026-77177: Open GenAI Stack server-side expression evaluation

CVE-2026-77177 affects Open GenAI Stack, also known as ogx-ai. The supplied description states that prompt injection using Jinja2 template syntax can achieve unsanitized server-side expression evaluation and code execution. A technical reference is available in this Gist.

Teams operating the stack should audit whether untrusted prompts or user-controlled template content can reach Jinja2 evaluation. Isolate affected deployments, remove unnecessary filesystem and network permissions, and avoid placing cloud credentials or long-lived secrets in the service environment.

Firefox sandbox escape vulnerabilities

Mozilla fixed three Firefox sandbox-escape vulnerabilities:

• CVE-2026-100762
• CVE-2026-100770
• CVE-2026-100778

Mozilla’s MFSA 2026-100 advisory states that fixes are available in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

Patch managed endpoints, prioritizing administrator workstations, systems handling privileged sessions, and endpoints used to access sensitive applications. Verify that automatic update policies are functioning rather than relying solely on user notification.

The supplied vulnerability records mark these three CVEs, CVE-2023-54400, and CVE-2026-77177 as not currently listed in CISA KEV. That status does not eliminate risk. Exposure, exploitability, severity, available fixes, and observed attack activity should drive prioritization.

What Defenders Should Do Today#

1. Remediate Citrix NetScaler exposure

• Inventory internet-facing appliances, including instances owned by subsidiaries and managed-service providers.
• Apply the available vendor-recommended fix or mitigation for CVE-2026-88772.
• Restrict management interfaces to dedicated administration networks.
• Capture forensic images and relevant logs before rebuilding a potentially compromised appliance.
• Check for web shells, tunneling processes, unexpected root changes, unauthorized accounts, and altered authentication settings.

2. Hunt for post-compromise activity

Review NetScaler, identity, VPN, firewall, DNS, proxy, endpoint, and server telemetry for:

• Administrative logins from unusual locations or at unusual times.
• Appliance-to-internal-server connections not present in the normal baseline.
• Outbound tunnels or long-lived encrypted connections.
• New privileged accounts, modified policies, or unexpected scheduled tasks.
• Access to password stores, directory services, cloud consoles, or internal management systems.
• Credential reuse across systems after an appliance compromise.

3. Review third-party security products in high-value environments

For cryptocurrency exchanges, financial platforms, and other high-value systems:

• Map product integrations, service accounts, API permissions, and network paths.
• Confirm current patch levels and security advisories through authenticated vendor channels.
• Remove unnecessary privileges and isolate management planes.
• Rotate secrets after suspected exposure, including API keys, signing credentials, certificates, and administrator passwords. An approved password manager such as Try 1Password → can help centralize credential rotation and access controls.
• Compare transaction, identity, and security telemetry for activity outside established baselines.

4. Protect Fumeng Cloud and database systems

Inspect deployments for public exposure of AjaxMethod.ashx, review database access logs, and apply available remediation. Look for unusual SELECT, INSERT, UPDATE, or bulk-export activity associated with unauthenticated application requests.

A basic, defensive web-log review can help identify candidate requests:

# Adapt the path and log location to the deployment.
grep -Ei 'AjaxMethod\.ashx|Fumeng|Fumeng Cloud' /var/log/nginx/access.log \
  | tail -n 200

This is only a triage step. Absence of a matching string does not establish that the system was not exploited, particularly when logs were rotated, normalized, or stored elsewhere.

5. Patch Firefox across managed endpoints

Deploy the fixed Firefox releases through the organization’s endpoint-management platform. Confirm the resulting version inventory and prioritize:

• Privileged administrator workstations.
• Developer and security-analysis systems.
• Endpoints used for cloud administration.
• Devices that access regulated or confidential data.
• Shared systems where browser isolation is limited.

6. Harden Open GenAI Stack deployments

Audit templates, prompt-processing paths, and API exposure. A safer deployment pattern is to keep untrusted content separate from server-side template evaluation and to run the service with narrowly scoped permissions.

Example container hardening settings should be adapted to the deployment:

services:
  genai:
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp

These settings do not remediate unsafe template evaluation. They reduce the impact of a successful compromise and must be tested against application requirements.

7. Block ClickFix execution paths

User awareness should explicitly cover fake AI assistants, sponsored search results, and pages that instruct users to paste commands into a terminal or run scripts. Technical controls should include:

• Application control for PowerShell, command shells, scripting engines, and unsigned binaries.
• Browser and DNS filtering for newly registered or suspicious domains.
• Endpoint detections for browsers spawning command interpreters.
• Monitoring for remote-access software installation and persistence.
• Clipboard and process telemetry where supported by endpoint tools.

A useful hunting pattern is browser-to-shell process creation. In KQL-style syntax:

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, FileName,
          ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Field names vary by telemetry platform. Treat the query as a starting point and tune it against normal browser and enterprise-application behavior.

8. Preserve evidence during containment

For county, exchange, and other critical-system incidents:

• Record the time and scope of containment actions.
• Preserve volatile and persistent evidence where practical.
• Maintain chain-of-custody documentation for collected data.
• Separate confirmed facts from working hypotheses in incident updates.
• Validate eradication before reconnecting systems.
• Continue monitoring after restoration for re-entry attempts and delayed extortion activity.

Technical Notes#

NetScaler investigation checklist

Collect appliance configuration, authentication, system, and network telemetry before rebuilding when possible. Look for unexpected changes in:

• Administrator accounts and authentication policies.
• Virtual servers, responder policies, rewrite policies, and routing.
• Startup or scheduled tasks.
• Files outside expected appliance paths.
• DNS, proxy, or tunnel configuration.
• Connections from the appliance to internal directory, database, or management systems.

A simple network review can identify unusual outbound destinations:

# Replace interface and time range as appropriate.
sudo ss -plant
sudo journalctl --since "24 hours ago" | \
  grep -Ei 'sshd|login|user|sudo|curl|wget|nc|socat'

These commands are for local triage and are not a substitute for appliance-specific forensic procedures.

SQL Server review for suspected Fumeng exploitation

Review application and database audit logs for:

• Requests to AjaxMethod.ashx without an authenticated session.
• Repeated parameters or unusually long request values.
• Bulk reads from sensitive tables.
• Unexpected updates or schema changes.
• Database access from application hosts at unusual times.
• New database users, permission changes, or credential resets.

Example query review should be performed against a sanitized copy of logs where possible:

-- Illustrative query. Adapt table and column names to the audit schema.
SELECT event_time,
       server_principal_name,
       database_name,
       statement
FROM dbo.database_audit_events
WHERE event_time >= DATEADD(hour, -24, SYSUTCDATETIME())
  AND (
       statement LIKE '%SELECT%'
    OR statement LIKE '%UPDATE%'
    OR statement LIKE '%INSERT%'
    OR statement LIKE '%DELETE%'
  )
ORDER BY event_time DESC;

WSL Containers governance

WSL Containers can change the endpoint’s software and data boundary. Before enabling broad deployment, define:

• Approved container registries and image-signing requirements.
• Whether host directories may be mounted into containers.
• Rules for secrets and cloud credentials.
• Network egress restrictions.
• Logging and incident-response ownership.
• Removal procedures for departing users and compromised devices.

Do not assume that a containerized development workflow is isolated from the Windows host or enterprise network.

Bottom Line#

Identify and remediate exposed Citrix NetScaler appliances first, then investigate them for persistence and credential access; patching alone does not close a suspected intrusion. Review privileged third-party security integrations in parallel, and use endpoint controls and user training to address ClickFix delivery while Firefox and GenAI deployments are brought to their fixed or hardened states.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.