Inside the Citrix NetScaler Zero Day Saga
This case is yet another reminder just how important vendor communication is in such incidents and how much uncertainty can hamper security.
Archives for September 2026
All topics
Articles
22 Posts
The Malware That Asks AI What to Do Next | Ryan Fetterman
Ryan Fetterman from Cisco Talos sits down with Decipher’s Lindsey O’Donnell-Welch to talk about ClosedQuorum, the first reported malware binary with an autonomous command-and-control. They talk about the wide range of ways threat actors are using AI, and useful detection strategies for AI-assisted attacks.
Researchers Warn of Citrix NetScaler Exploitation
On Saturday, researchers from watchTowr Labs said they had credible information that attackers were exploiting an unknown RCE vulnerability in Citrix NetScaler boxes.
FBI Hack Fallout, EvilTokens Takedown, and the F5 Zero Day
This week we dig into the ShinyHunters hack of the FBI and what it means not just for the FBI personnel but for the attackers, then we discuss the disruption of the EvilTokens phishing operation by Microsoft, and finally we talk about the F5 BIG-IP zero day and some odds and ends from LabsCon. Note: […]
F5 CVE-2026-94127 Targeted in Active Attacks
This vulnerability allows for unauthenticated remote code execution and shows how a missing bounds check—a classic programming error.
Researchers Find Windows Malware With Autonomous C2 Functionality
Cisco Talos researchers identified ClosedQuorum, a Windows implant that uses multiple LLMs to autonomously select attack actions. The catch: there's no confirmation that it’s actually been deployed in the wild.