September 30, 2026 by sig9

Hacker Wars - September 30, 2026

bulletin-feature-image

Your daily dose of infosec chaos

Citrix gateways are getting popped pre-auth in the wild, South Africa’s air traffic control found ransomware on an operational network, and both OpenSSL and wolfSSL just shipped a pile of fixes. Meanwhile scammers are buying sponsored ads for fake ChatGPTs, and inspecting a hostile AI model can now mean running its code. Busy day - caffeinate accordingly.

Citrix NetScaler Zero-Day Runs Shellcode Before You Even Log In

Researchers published technical details for CVE-2026-88772, a pre-auth memory overflow in NetScaler ADC and Gateway that is already exploited in the wild, and with a CVSS of 9.5 it is about as subtle as a fire alarm. Now that the exploit mechanics are public, expect everyone from ransomware crews to script kiddies to point scanners at exposed gateways this week.

What to do: Patch NetScaler ADC and Gateway immediately, and treat any exposed unpatched box as compromised until logs prove otherwise.

South Africa Calls for Reinforcements After Ransomware Hits Air Traffic Control

South Africa’s air traffic services confirmed a cyberattack on aviation infrastructure, with a ransomware toolkit installed on at least one operational network, prompting a national call for outside help. Aviation is having quite the year - planes keep flying on systems never designed to survive a wiper, and there is no patch for radar screens going dark.

What to do: If you run OT, segment it from corporate IT today and rehearse operating with core systems offline.

OpenSSL and WolfSSL Each Patch Around a Dozen Flaws, Some Rated High

Both open source crypto libraries shipped fixes for roughly a dozen vulnerabilities apiece, including high-severity bugs in code that quietly secures everything from VPN appliances to IoT firmware. The catch is that these libraries are embedded in thousands of products, so the real risk is the vendor firmware update that lands in six months, or never.

What to do: Update your servers now, then inventory every appliance and embedded device shipping its own crypto stack and chase vendor patches.

Malvertising campaigns are pushing custom ChatGPT variants through sponsored Google results, funneling victims to ClickFix pages where fake CAPTCHA prompts convince them to paste malicious commands into their own terminal. The user runs the payload, the attacker skips the entire exploit chain, and ChatGPT’s brand trust does all the heavy lifting.

What to do: Drill the rule that no legitimate website ever asks you to copy-paste commands, and block script execution from user-writable paths.

Inspecting a Hostile AI Model in Unsloth Studio Meant Code Execution

A now-patched Unsloth Studio flaw let a malicious model execute arbitrary Python the moment someone loaded it for inspection, courtesy of everyone’s favorite footgun, the trust_remote_code setting. Downloading random weights from the internet and opening them is no longer just sloppy - it is a remote code execution primitive.

What to do: Update Unsloth Studio, keep trust_remote_code disabled, and only poke at untrusted models inside a disposable container.

Until next time, may your logs be clean and your alerts be false positives.

Brought to you by sig9 - sig9.ch | Protecting the unseen, securing the unknown

This bulletin is provided for informational purposes. Contact us for tailored security analysis.