Critical Exploits, Financial Sector Attacks, and Data Breaches Dominate Cybersecurity News

Critical Vulnerabilities Under Active Exploitation:

• Citrix Patches Critical NetScaler Zero-Day Under Active Attack: Citrix has released emergency patches for a critical zero-day vulnerability (CVE-2026-88779) in its NetScaler ADC and Gateway products. The flaw, a memory overflow in SAML components, is being actively exploited in the wild, leading to denial-of-service and potential remote code execution. CISA has added this to its KEV catalog, mandating federal agencies to patch by October 7, 2026.
• Attackers Actively Exploit Critical RCE Flaw in Rejetto HFS: A critical remote code execution vulnerability (CVE-2026-61500) in Rejetto HTTP File Server (HFS) is being actively exploited. The flaw, stemming from a weak random number generator for session cookies, allows attackers to reconstruct the server's secret signing key, forge administrator sessions, and execute arbitrary code. Users of Rejetto HFS versions 3.0.0 through 3.2.0 are urged to update to version 3.2.1.

Data Breaches and Sectoral Threats:

• [UPDATE] South Korean Financial Sector Hit by Coordinated Cyberattacks: Coordinated cyberattacks have impacted at least seven South Korean financial institutions, including Welcome Savings Bank, Hyundai Capital, and BNK Busan Bank, affecting nearly 70,000 individuals. Investigators suspect a single threat actor using an AI-powered penetration testing tool named 'Artex'. The Financial Services Commission has mandated emergency security checks across the industry.
• Frontline Education Breach Exposes School Employee SSNs: Ed-tech vendor Frontline Education confirmed a data breach due to a third-party software vulnerability, exposing sensitive information of school district employees, including names, addresses, email addresses, and Social Security numbers. Affected individuals are being notified, and two years of complimentary credit monitoring are being offered.
• TIAA Discloses Data Breach Exposing Client SSNs: Financial services firm TIAA reported a data breach involving the unauthorized acquisition of client names and Social Security numbers. The company discovered the incident on September 8, 2026, and is notifying affected individuals, offering 24 months of complimentary identity protection services.
• Storm Ransomware Group Claims Attack on Canadian Hospital: The Nipigon District Memorial Hospital in Ontario, Canada, has reportedly been targeted by a ransomware attack attributed to the 'Storm' ransomware group. This incident highlights the ongoing threat posed by ransomware actors to the healthcare sector.

Cloud Infrastructure Security Update:

• Cloudflare Fixes Cross-Tenant Data Leak in Container Service: Cloudflare has patched a cross-tenant data exposure vulnerability in its Containers platform. The flaw, caused by a misconfiguration in the Linux device mapper thin provisioning layer, could have allowed one customer to read residual data from other tenants' containers. Cloudflare found no evidence of malicious exploitation.