New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

thehackernews.com Oct 5, 2026

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Curated by Shubham · TechCapsules · Oct 5, 2026

AI-summarised brief · reviewed before publication

Citrix issued patches for a high‑severity memory‑overflow flaw (CVE‑2026‑88779) in NetScaler ADC and Gateway that can trigger denial‑of‑service when the appliance is configured as a SAML service provider or identity provider. The vulnerability, rated 8.7/10, has been actively exploited in targeted attacks, with attackers using AI‑driven reconnaissance to identify vulnerable deployments. Citrix credited Bishop Fox and watchTowr for discovery, and the U.S. CISA has added the flaw to its Known Exploited Vulnerabilities list, mandating federal fixes by October 7, 2026.

💡 Why It Matters

· The flaw exposes a critical attack vector that can cripple SAML‑based authentication, a cornerstone of enterprise single‑sign‑on.
· Prompt patching is essential to prevent widespread service outages and protect sensitive identity data.

Capsules Cybersecurity

Read full article on thehackernews.com

Hackers steal 8 million citizens’ records from Danish government database

The Danish government confirmed a breach of its Central Person Register (CPR), exposing personal data of roughly 8 million citizens and residents, including those abroad and deceased. Hackers accessed names, addresses, social security numbers, and other sensitive information by exploiting a Danish company’s authorized search privileges. The incident, uncovered on October 2 after occurring in September, is considered Denmark’s largest data breach to date. The CPR holds records for about 11 million people, spanning several decades. The authorities have not identified the perpetrators.

💡 The breach threatens national security by compromising a critical identity infrastructure, exposing citizens to identity theft and undermining trust in digital governance.

egamers.io · Oct 5

Hackers Seize Microsoft’s X Account to Promote Fake $Clippy Crypto Token

Microsoft’s official X account was hijacked by attackers who promoted a counterfeit cryptocurrency called $Clippy, named after the nostalgic Office assistant. The scammers posted a fabricated apology claiming Microsoft had regained control, then urged followers to like a post 500,000 times to “bring back” Clippy. They falsely claimed the token was paired with Microsoft stock (MSTF), a non‑existent link. The X team later suspended the fraudulent account. Microsoft has not disclosed how the breach occurred or the financial impact, and the incident follows a similar June 2024 hack targeting its India account.

💡 The attack exposes how easily corporate social media can be weaponized to defraud users, underscoring the need for vigilant verification of token claims.

infoq.com · Oct 4

New Archestra’s OpenAPPA Saturates Two Major Security Benchmarks with a 0% Attack…

New Archestra has launched OpenAPPA, an open‑source security engine that operates outside an AI agent’s prompt and execution loop to prevent data exfiltration from prompt injection and model hallucination. The system defines data sources, audiences, trust levels and authorities, then enforces deterministic security rules. In benchmark testing, OpenAPPA achieved a 0 % attack success rate on the Bench‑Corp suite of 20 multi‑step enterprise workflows and on the AgentThreatBench, outperforming Claude Code’s auto mode (10 % success) and Microsoft FIDES (31 %). The developers argue that stochastic, classifier‑based approaches suffer from approval fatigue and cannot reliably track data across tool calls, leading to breaches even at high accuracy levels. OpenAPPA’s deterministic model aims to eliminate these gaps while preserving agent utility.

💡 By demonstrating flawless defense in leading security benchmarks, OpenAPPA proves that deterministic policy enforcement can reliably safeguard AI agents without the false‑positive overload that hampers current probabilistic solutions.

sundayguardianlive.com · Oct 4

The dangers of ‘Max’: Why you should be concerned about such apps

Russian authorities have launched MAX, a state‑backed “super‑app” created by Kremlin‑linked VK and pre‑installed on all new devices sold in the country. Marketed as a domestic counterpart to China’s WeChat, MAX bundles messaging, banking, government services, shopping, payments and digital identity into a single platform. Independent cybersecurity analyses allege the app contains hidden code that can capture screenshots, access device data and monitor users’ financial transactions and communications, providing unprecedented surveillance capabilities. The Russian government, which has tightened control over media and internet access since the 2022 invasion of Ukraine, denies the accusations, claiming the app complies with law and is secure. Critics warn that the convenience of MAX may come at the cost of widespread privacy erosion for Russian citizens.

💡 MAX could transform everyday digital interactions into a state‑run data collection network, giving the Kremlin real‑time insight into the personal and financial lives of millions.

edexlive.com · Oct 3

96% Indian firms hit by cyber incidents in past year: Report

Nearly all Indian companies—96 percent—experienced a material cyber incident in the past year, Cisco’s Relentless Defense Report shows. More than one‑third of those breaches involved attacks enhanced by artificial intelligence. The study, based on a double‑blind survey of 1,000 Indian security professionals, gave Indian firms an average security score of 66 out of 100, just above the global 64, while only 8 percent reached the best‑performing tier. Respondents cited internal friction—bureaucratic approvals, fragmented data and siloed teams—as a larger obstacle than technology gaps. Only 40 percent said security, networking and IT operate as a unified unit, and 49 percent reported metrics are too technical for executives. Data‑access delays cost 44 percent of teams valuable response time and hindered overall resilience.

💡 Operational silos are turning AI’s defensive promise into a bottleneck, leaving most Indian firms exposed despite rising cyber‑spending.

thehackernews.com · Oct 3

The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations

The 2026 cybersecurity report outlines how expanding cloud, AI, and distributed systems are reshaping security priorities. It highlights identity security’s rise as a critical boundary, the need for controlled telemetry, and continuous endpoint patching across platforms. Human risk intelligence and exposure management shift focus from discovery to mitigation, while AI‑driven social engineering demands personalized, ongoing training. Integrated domain, DNS, and certificate oversight is essential to counter sophisticated impersonation attacks. The report underscores the necessity of scalable, real‑time visibility and automated response.

💡 By treating identity, telemetry, and human factors as continuous, interconnected layers, organizations can preempt multi‑vector attacks that bypass single‑point defenses. This holistic approach transforms reactive patching into proactive, data‑driven risk reduction, setting a new standard for enterprise resilience.