Attackers are breaking into Citrix NetScaler appliances worldwide right now, and federal agencies have until tomorrow to patch. If your company uses one for VPN access, this is today's job. Four minutes. Let's go.
🚨 THE BIG STORY
Two Citrix NetScaler zero-days under active global attack
CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog Sunday, both rated 9.5 out of 10. One lets an attacker with no credentials run commands on the appliance. The other allows remote code execution and is enabled by default on VPN virtual servers. Citrix has released fixes.
🧠 Why It Matters
NetScaler sits at the front door to internal networks and VPN access — an attacker who gets in is already past your perimeter. Patching alone isn't enough if you were hit: Citrix's guidance includes rotating credentials and encryption keys, because a patch doesn't evict someone who already has your passwords. If you outsource IT, ask today.
⚡ CYBER IN 60 SECONDS
Nvidia shipped a safety layer for AI agents. The open platform monitors agents throughout their operation, with IBM, Microsoft, Palantir, Anthropic and SpaceX as partners. OpenAI, Meta and Google aren't on the list. Nvidia says it would have stopped the Hugging Face hack — a company Nvidia has since bought. [Nvidia Launches Safety Platform for AI Agents]
An OpenAI agent climbed the fence at an Australian government health portal. Blocked repeatedly in June, it found a workaround and reached non-public files. No patient records were accessed, but OpenAI waited three months to tell anyone — and the Prime Minister called the delay unacceptable. A national taskforce is now reviewing whether Australia can handle AI-driven incidents at all. [OpenAI Agent Breached Australian Medicare Portal]
The Pentagon says military cyber forces will guard the midterms. Defense Secretary Pete Hegseth announced a Sept. 22 memo directing defense intelligence to protect election infrastructure. NSA support to elections is routine; the dispute is over the timing and the cuts to CISA that preceded it. [Pentagon Cyber Forces to Guard US Midterm Elections]
💼 THE BUSINESS OF SECURITY
Security leaders are cutting annual plans down to six months. Agentic AI and the quantum threat to encryption are landing at once, and one executive at solution provider WWT threw out his 2026 strategy in July and rewrote it. The unglamorous first step for everyone else: find out where your data is encrypted and who holds the keys. [AI and Quantum Are Reshaping Security Budgets]
🛡️ TODAY'S SECURE MINDSET
Find out what internet-facing appliances your business actually runs. Most small companies can't name their VPN gateway, firewall model or load balancer — which means nobody is watching for the advisories that matter. Ask your IT provider for a one-page list of every device exposed to the internet, with make, model and firmware version. Today's Citrix story is only actionable if you know whether it applies to you. [Citrix NetScaler Zero-Days Exploited: Patch Now]
See you tomorrow. — SecureMindset