A Chinese-speaking threat actor used DeepSeek and the open-source Hermes Agent to run autonomous attacks against exposed servers with minimal human involvement. Unit 42 found the campaign showed a functional end-to-end AI offensive workflow, even though the observed exploit attempts failed to compromise the targets. #DeepSeek #HermesAgent #Unit42 #FOFA #Langflow #n8n #CVE-2026-33017 #CVE-2026-21858 #CVE-2025-68613 #CitrixNetScaler #ApacheTomcat #MarimoNotebook #WindowsIKEVPN

Ontdek hoe hackers kwetsbaarheden in Microsoft SharePoint en Citrix NetScaler misbruiken voor cyberaanvallen op bedrijven en overheden. Leer over de risico's, impact en beveiligingsmaatregelen.

Malicious actors have commenced active attacks against Citrix NetScaler infrastructure. They are exploiting the critical vulnerability designated as CVE-2026-19490. This severe flaw enables remote adversaries to circumvent authentication protocols entirely. Consequently, they gain illicit access to corporate VPN gateways and AAA servers. The inaugural exploitation attempts materialized on September 3. Strikingly, this occurred merely twenty-four hours after the publication of a public Proof of Concept (PoC).

Cet article présente une analyse technique approfondie d'une vulnérabilité heap overflow pré-authentifiée affectant Citrix NetScaler ADC et NetScaler Gateway, corrigée dans un récent bulletin de sécurité Citrix. La vulnérabilité, supposée être CVE-2026-8452, réside dans le binaire nsppe (moteur de traitement de paquets NetScaler) lors du traitement SAML.

CISA ordered U.S. federal agencies to patch Citrix NetScaler appliances by April 2 to address CVE-2026-3055, an actively exploited input-validation flaw that can expose sensitive SAML IDP data. Security firms reported in-the-wild exploitation soon after Citrix released fixes, warning attackers can steal admin session IDs and potentially fully compromise unpatched NetScaler/ADC and Gateway appliances. #CVE-2026-3055 #CitrixNetScaler

A critical CVE-2026-3055 vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances is being actively exploited to extract sensitive authentication and administrative session IDs. Researchers from watchTowr confirmed in-the-wild exploitation starting March 27 and released detection scripts while Citrix's bulletin did not acknowledge active exploitation. #CVE-2026-3055 #CitrixNetScaler

Researchers have released proof-of-concept (PoC) exploits for a critical Citrix NetScaler vulnerability, tracked as CVE-2025-5777 and dubbed CitrixBleed2, warning that the flaw is easily exploitable a...

world that pass for real consumer ISP addresses read more about Wave of Citrix NetScaler scans use thousands of residential proxies