Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain

BleepingComputer reports a broad set of September 2026 cybersecurity developments, including a large ClickFix campaign using more than 5,400 compromised websites and blockchain-hosted payloads, exploitation of a critical Citrix NetScaler authentication bypass (CVE-2026-19490), an actively exploited Chrome zero-day, a CrowdStrike Falcon privilege-escalation zero-day, a supply-chain compromise delivering malicious Terraform modules, and critical ArubaOS-CX remote-code-execution remediation. The feed also covers alleged major data breaches, passkey attack research, AI incidents, and service or IT