The Daily Zero-Day

Date: SEPTEMBER 28, 2026 Editor-in-Chief: Jose Laurentino III Global Threat Intelligence Edition

Executive Summary

Welcome to today's edition of The Daily Zero-Day for September 28, 2026. The threat landscape continues to evolve rapidly, highlighted by critical unpatched remote code execution vulnerabilities in Citrix NetScaler products under active exploitation and severe data breaches hitting millions of records across student loan providers and major databases. At the same time, adversaries are weaponizing advanced techniques, from AMD driver abuse by infostealers like Lunex to autonomous AI command-and-control implants. Security operations must balance these emergent threat vectors with fundamental resilience strategies, ranging from strict multi-factor authentication mandates to robust CISO-CFO financial alignment and forensic readiness for AI sandbox environments.

Top Intelligence Briefings

VULNERABILITIES & EXPLOITS

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

Two critical remote code execution vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway are currently being actively exploited in the wild, posing an immediate danger to enterprise perimeter defenses.

Actionable Takeaway: Review perimeter devices immediately, apply available vendor workarounds or emergency mitigations, and monitor NetScaler logs for unauthorized access or execution attempts.
MALWARE INTELLIGENCE

The Closed Quorum: Inside the first reported autonomous AI C2 implant

Discovered through Cisco Talos’ CAIRN project, the CLOSEDQUORUM malware binary exhibits fully autonomous command and control behavior, representing a significant technological shift in how malicious infrastructure operates.

Actionable Takeaway: Update behavioral monitoring and anomaly detection rules to spot autonomous, non-deterministic C2 traffic patterns and localized threat decision-making.
THREAT ACTORS & MALWARE

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Distributed via compromised Ukrainian websites utilizing ClickFix-style Cloudflare verification checks, the Psychedelic/Lunex Stealer malware abuses legitimate AMD drivers to bypass security controls and harvest sensitive browser information.

Actionable Takeaway: Implement strict driver blocklists (such as Microsoft's vulnerable driver blocklist) and educate users against deceptive web verification prompts.
CYBERCRIME & ENFORCEMENT

U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions

A U.S. Army soldier received a 70-month prison sentence after pleading guilty to hacking multiple major telecommunications companies and illegally extracting sensitive call and text metadata.

Actionable Takeaway: Enforce strict internal access controls, stringent insider threat monitoring, and zero-trust principles across telecommunications and critical infrastructure environments.

Quick Hits & Advisories

Sources & References

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html

U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
https://krebsonsecurity.com/2026/09/u-s-soldier-gets-70-months-in-prison-for-att-verizon-extortions/

Data Broker Radaris Loses Domains in Privacy Fight
https://krebsonsecurity.com/2026/09/data-broker-radaris-loses-domains-in-privacy-fight/

Friday Squid Blogging: Participatory Squid Dissection in October in Tennessee
https://www.schneier.com/blog/archives/2026/09/friday-squid-blogging-participatory-squid-dissection-in-october-in-tennessee.html

On Anthropic’s AI Misuse Report
https://www.schneier.com/blog/archives/2026/09/on-anthropics-ai-misuse-report.html

How the CISO CFO Relationship is a Key to Cybersecurity Success
https://www.darkreading.com/cyber-risk/how-to-manage-ciso-cfo-relationship-cybersecurity-success

AI Sandbox Escapes: Why Forensic Readiness Matters More Than Containment
https://www.darkreading.com/cyberattacks-data-breaches/ai-sandbox-escapes-forensic-readiness

Student Loan Breach Exposes 2.5M Records
https://threatpost.com/student-loan-breach-exposes-2-5m-records/180492/

Watering Hole Attacks Push ScanBox Keylogger
https://threatpost.com/watering-hole-attacks-push-scanbox-keylogger/180490/

Is that vibe coded app safe? 5 checks before you download
https://www.welivesecurity.com/en/mobile-security/is-new-vibe-coded-app-safe-5-questions-ask-first/

Been told to pay at a Bitcoin ATM? Read this first
https://www.welivesecurity.com/en/scams/been-told-pay-bitcoin-atm-read-first/

Trust and the enticing consultancy offer
https://blog.talosintelligence.com/trust-and-the-enticing-consultancy-offer/

The Closed Quorum: Inside the first reported autonomous AI C2 implant
https://blog.talosintelligence.com/the-closed-quorum-inside-the-first-reported-autonomous-ai-c2-implant/

FBI agents’ blood tests and doctors’ notes surface after breach
https://www.malwarebytes.com/blog/data-breaches/2026/09/fbi-agents-blood-tests-and-doctors-notes-surface-after-breach

A week in security (September 21 – September 27)
https://www.malwarebytes.com/blog/news/2026/09/a-week-in-security-september-21-september-27

LimeLeads - 17,838,396 breached accounts
https://haveibeenpwned.com/Breach/LimeLeads

Burger King Russia - 3,155,792 breached accounts
https://haveibeenpwned.com/Breach/BurgerKingRussia

ISC Stormcast For Monday, September 28th, 2026
https://isc.sans.edu/podcastdetail/10112

Wireshark 4.6.9 Released
https://isc.sans.edu/diary/rss/33372

ICYMI: August 2026 @AWS Security
https://aws.amazon.com/blogs/security/icymi-august-2026-aws-security/

Supporting ASD’s multi-factor authentication campaign: Why MFA matters more than ever
https://aws.amazon.com/blogs/security/supporting-asds-multi-factor-authentication-campaign-why-mfa-matters-more-than-ever/

Cofense Expands AI-Driven Phishing Defense Platform to Advance Secure Behavior Management
https://cofense.com/blog/cofense-expands-ai-driven-phishing-defense-platform-to-advance-secure-behavior-management

Beyond Human Risk: A Better Way to Build Secure Behavior
https://cofense.com/blog/beyond-human-risk-a-better-way-to-build-secure-behavior

Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability
https://asec.ahnlab.com/en/95561/

Ransom & Dark Web Issues Week 4, September 2026
https://asec.ahnlab.com/en/95545/

Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums
https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor

Fake shops target shoppers across Europe with fake Samsung deals, counterfeit goods and World Cup scams
https://www.bitdefender.com/en-us/blog/labs/fake-shops-europe-samsung-world-cup-scams

UN Reports Citing Citizen Lab Submissions Published
https://citizenlab.ca/un-reports-citing-citizen-lab-submissions-published/

Submission to the Immigration and Refugee Board of Canada
https://citizenlab.ca/submission-to-the-immigration-and-refugee-board-of-canada/

Vulnerability in WEBCON BPS software
https://cert.pl/en/posts/2026/09/CVE-2026-92419/

Inside a multi stage toll fraud operation targeting Poland
https://cert.pl/en/posts/2026/09/tollfraud-analysis/

CIS Community Defense Model v3.0: Turning Threat Intelligence Into Action
https://www.cisecurity.org/insights/blog/cis-community-defense-model-v3-turning-threat-intelligence-into-action

CIS Benchmarks September 2026 Update
https://www.cisecurity.org/insights/blog/cis-benchmarks-september-2026-update

Multiple Vulnerabilities in ServiceNow's AI Platform Could Allow for Unauthorized Access
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-servicenows-ai-platform-could-allow-for-unauthorized-access_2026-102

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-101

Automatically generated daily, typically between 06:00 a.m. and 06:30 a.m., New York Time.
Web development assisted by:   Gemini AI Chat,  Grok AI Chat, and  Claude AI Chat.
https://buymeacoffee.com/jlaurentino
https://ko-fi.com/jlaurentino
Previous editions:
Fort Lauderdale, FL, November 15, 2026
Visitors since September 18th, 2026: 46,628