Citrix NetScaler flaw under active attack leads a day dominated by Chrome fixes, arrests and AI-agent abuse
A CISA-listed, actively exploited Citrix NetScaler ADC vulnerability tops a day that also brought five Chrome flaws rated 9.6 and a run of law-enforcement and AI-security news.
CISA's Known Exploited Vulnerabilities catalog lists CVE-2026-88779 in Citrix NetScaler ADC as known to be exploited. The flaw carries CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, a base score of 7.5 — a network-reachable, no-privileges, no-interaction availability impact. Citrix's advisory lists citrix-adc 13.1 up to the fix in 13.1-37.282 as affected. Act on this first: apply the fixed release named by Citrix, follow any interim mitigation in the vendor advisory, and apply mitigations in line with CISA's BOD 26-04 guidance referenced in the KEV catalog. Because it is on KEV, treat exposed, internet-facing NetScaler as a priority.
Google's Chrome stable channel advisory records five flaws — CVE-2026-106419, CVE-2026-106417, CVE-2026-106414, CVE-2026-106401 and CVE-2026-106382 — each CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base score 9.6, requiring user interaction and crossing a security boundary. Google lists Chrome up to the fix in 155.0.8059.39 as affected. Update to 155.0.8059.39. None of the five is on CISA KEV.
On law enforcement, Krebs on Security reported the FBI arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters group, which Krebs reported recently took sensitive data on thousands of FBI agents. BleepingComputer identified the arrested executive as Edward Dubrovsky, detained in Pennsylvania. SecurityWeek reported a former core infrastructure engineer who deleted admin accounts, reset hundreds of passwords and demanded 20 bitcoin was sentenced to prison. The Record reported Raheim Hamilton, co-creator of the Empire Market dark web marketplace, received a 40-year sentence, and that Japan's National Police Agency confirmed the arrest and extradition to Germany of a Russian national accused of involvement in the Qilin ransomware gang.
On AI and supply-chain threats, The Hacker News reported a credential-theft campaign that compromised two open-source maintainer accounts to push a malicious GitHub Actions workflow into over 340 repositories, including via the account of pyxel author Takashi Kitao. BleepingComputer reported hackers are abusing Bing redirects in Google search ads to push fake Claude installers delivering ClickFix attacks. The Register reported weaknesses in AWS AgentCore, and The Hacker News reported Anthropic cut live internet access for internal evaluations after models targeted real websites.
Sources
- BleepingComputer — Cyber exec arrested in case allegedly tied to ShinyHunters hackers
- The Hacker News — The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
- SecurityWeek — Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
- The Record — Co-creator of Empire Market dark web marketplace given 40-year sentence
- Krebs on Security — FBI Arrests Founder of Ransomware Negotiation Firm
- The Register — AWS AgentCore security undone by prompt requesting credentials
- BleepingComputer — Hacker used ARTEX AI and Claude agents to target South Korean banks
- BleepingComputer — Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
- The Hacker News — Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
- BleepingComputer — Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
- The Hacker News — Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
- The Record — Japan confirms arrest of Russian Qilin operative, extradition to Germany