TerminalFix and Lorem Ipsum Loader enable covert tunneling

2026-09-30T20:51:32Z•647a0067401bfda6c9f3a8e5ca821636c092db34e77da3f39577bf20d4c120a6

CVE-2026-76461CVE-2026-88771CVE-2026-88772AI securityCisco Secure Email GatewayCitrix NetScalerKiteworksLorem Ipsum LoaderPatch TuesdayTerminalFixactive exploitationcovert tunnelingdeepfakesmalware loadervulnerability management

Open source link →

What happened

Sophos security news highlights active exploitation of Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772, and a Cisco Secure Email Gateway vulnerability CVE-2026-76461. It also reports a covert-tunneling campaign involving TerminalFix and Lorem Ipsum Loader, a potential Kiteworks attack prompting server-shutdown guidance, and a September 2026 Patch Tuesday release containing 973 CVE fixes.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: sophos_news
Record identifier: 647a0067401bfda6c9f3a8e5ca821636c092db34e77da3f39577bf20d4c120a6
Enrichment time: 2026-09-30T20:51:32Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records