News

Critical NetScaler Flaws Prompt Urgent Update Advice From CERT-EU

CERT-EU urges NetScaler updates after critical memory flaws, including one affecting default deployments. No exploitation was reported in its November 12 advisory.

Cloud Software Group released security bulletins on November 12 addressing 28 memory flaws in NetScaler ADC and NetScaler Gateway, according to CERT-EU. One issue, CVE-2026-120868, affects all deployments, including systems using default settings.

That flaw sits in the software that processes network traffic and does not require an attacker to log in. CERT-EU rates it 9.3 out of 10. Another issue, CVE-2026-107412, is rated 9.5 and affects appliances configured as a gateway or authentication server.

The vendor describes the impact as unexpected behavior or denial of service—disruption that can make a system unavailable. CERT-EU’s November 12 advisory says Citrix reported no exploitation and that no public proof-of-concept had been confirmed. These are critical patching priorities, not evidence of a confirmed breach.

For organizations running these appliances, CERT-EU recommends upgrading to fixed releases, starting with internet-facing gateways and authentication systems. NetScaler’s own remediation guidance also calls for upgrading affected instances to a release and build containing the fix.

Sources: CERT-EU security advisory, November 12 · NetScaler remediation guidance.

Attacker Uses 4,837 Hijacked GitHub Accounts to Run a Secret Stealer

Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer in repositories those accounts could write to, according to Aikido Security. The stealer ran in at least 1,806 repositories, putting build secrets and cloud keys at risk. Teams should rotate any

SCKit Malware Hits 288 Endpoints Across 48 Organizations Through ScreenConnect

Attackers abused ConnectWise ScreenConnect access to push rogue clients and the SCKit malware onto at least 288 endpoints at 48 organizations. Reporting says the campaign relies on a critical flaw that is already patched, not a new one. As a precaution, ConnectWise disabled five third party extensions in partner environments

New SignDrop Exploit Turns a Windows Logging Feature Into SYSTEM Access

Public exploit code released this week claims a local Windows user can gain SYSTEM privileges by abusing log authentication in the Common Log File System driver. Microsoft has not shipped a fix yet, so the flaw is a zero day. An attacker needs a foothold on the machine first, which

186 Fake AI Domains Push ClickFix Lures and Search Hijacking Extensions

Researchers at Island linked 186 lookalike domains that pose as popular AI tools to a mix of threats. The sites redirect visitors to ClickFix style lures, a browser malware family called Net Guard, and Chrome extensions that hijack searches. Those extensions declare about 972,000 users. Treat any AI tool

Read more

Attacker Uses 4,837 Hijacked GitHub Accounts to Run a Secret Stealer

SCKit Malware Hits 288 Endpoints Across 48 Organizations Through ScreenConnect

New SignDrop Exploit Turns a Windows Logging Feature Into SYSTEM Access

186 Fake AI Domains Push ClickFix Lures and Search Hijacking Extensions