Mandiant's write-up on the NetScaler campaign describes what attackers did after exploiting CVE-2026-88772. Its web shell, WHIPSHOT, and companion tunneller, SLAPSHOT, are disguised as .deb and .sig files rather than the .php extensions defenders typically monitor. Confirmed victims span government, financial services, education and legal organisations across North America and Europe. Mandiant places the start of exploitation in early September, around three weeks before Citrix's advisory, providing a clearer picture of what a compromised appliance can look like on disk.

Apple's CoreGraphics fix follows a familiar pattern in the company's zero-day advisories: a reference to "specific targeted individuals", a tip from another security company, and little detail about the attacks themselves. Meta's involvement echoes last year's WhatsApp-Apple case, which also affected a small number of targets. CVE-2026-86950 appears to fit the same limited-target profile rather than widespread exploitation.

The FBI has also released a public video message aimed at ShinyHunters, with Leatherman telling the group, "we know how to find you". The message follows reporting that internal leadership friction is driving some of the group's more aggressive recent activity. It is an unusual public response to an active extortion campaign against the bureau itself, particularly for a group that has continued operating despite arrests and other disruption.

Microsoft's RedFlick report documents a year of changes to Star Blizzard's intrusion chain. Mass-mailing infrastructure has replaced spear-phishing, compromised WordPress and cPanel sites have replaced free email accounts, and payload delivery has moved from ClickFix prompts to VHDX files and then PDFs. The targeting has remained focused on Ukraine throughout, while the delivery mechanisms have continued to change.

Mandiant and Google Threat Intelligence Group identified active exploitation of Citrix NetScaler zero-day CVE-2026-88772 since early September, affecting government, financial services, technology, education and legal sector organisations in North America and Europe. The exploit bypasses authentication and crashes the appliance's packet processing engine to gain root access, after which attackers deploy a custom PHP web shell called WHIPSHOT and a Python tunnelling tool called SLAPSHOT. Attackers disguised the web shells using file extensions such as .deb and .sig and set the setuid bit on /bin/sh to maintain root-level persistence.

Apple patched CVE-2026-86950, an out-of-bounds write flaw in CoreGraphics that can be exploited for arbitrary code execution when processing a specially crafted file. Apple said the flaw may have been exploited in an extremely sophisticated attack against specific individuals on iOS versions before iOS 27, and credited Meta's product security team with reporting it. Fixes are available in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1, while the latest iOS 27 and macOS Golden Gate 27 are unaffected.

The FBI publicly urged remaining ShinyHunters members to turn themselves in after Dutch police arrested an alleged leader of the group on 15 September, whose laptop reportedly contained details of two planned murders abroad. Dutch authorities ordered the 24-year-old suspect held for at least 90 more days and said further arrests have not been ruled out. The FBI says ShinyHunters and its co-conspirators have breached more than 140 organisations and collected at least $70 million in extortion payments since last year.

Microsoft observed Russian state actor Star Blizzard shift from targeted spear-phishing to large-scale campaigns since January 2026, using a new technique called RedFlick that requires only a single user interaction to install its CosmicPulse backdoor. The group now creates accounts on compromised WordPress and cPanel websites to send phishing emails, and has affected over 100 organisations primarily in the US and UK, largely NGOs, think tanks and governments linked to Ukraine policy. Delivery methods have evolved from malicious VHDX files to payloads hidden inside PDFs, with scheduled tasks used to install the backdoor while masquerading as legitimate system components.

Akamai identified a campaign of nearly 30 browser extensions that impersonate well-known financial figures, including Warren Buffett and John Paulson, to build false credibility with cryptocurrency users. The extensions share nearly identical underlying code and infrastructure despite presenting as distinct products, and use locale checks and anti-analysis techniques to selectively redirect non-English-speaking users to phishing pages. Victims are directed to fake wallet verification pages designed to steal cryptocurrency recovery phrases.