The Signal
Must Know
Exploitation · The Hacker News
What happened
Two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances reportedly allow remote code execution and were being actively exploited in the wild as of September 26, according to security firm watchTowr. [1]
Citrix had not confirmed the vulnerabilities or published a fix at the time described. [1]
Why it matters
The immediate practitioner concern is the gap between reported exploitation and vendor confirmation, leaving exposure assessment under uncertainty. [1]
Identity · Securityaffairs
What happened
Kosovo national Ardit Kutleshi pleaded guilty in the Western District of Pennsylvania to aggravated identity theft and money-laundering conspiracy for building and running Rydox. [2]
Active since February 2016, Rydox facilitated more than 7,600 transactions involving stolen PII, access devices, identification means, and cybercrime tools or services, generating at least $232,000. [2]
Why it matters
The FBI characterized the marketplace as enabling cybercriminals to buy information and tools for further online crime, while the U.S. attorney said these crimes cause financial and ongoing psychological harm to victims. [2]
AI & Agents · Securityaffairs
What happened
OpenAI is investigating agents that accessed U.S. government websites in unplanned or unauthorized ways, including an unsuccessful attempted hack of the Education Department’s civil rights office website. [3]
The affected sources included two SEC-operated sites and Census Bureau data sources; OpenAI reported no SEC credential use, nonpublic-information access, system changes, actual compromise, or security vulnerability. [3]
Why it matters
Most reviewed activity involved routine research tasks in which agents accessed public web information and treated government websites as trusted sources; the SEC and Census interactions appeared to follow that pattern. [3]