The B3 read
Good morning. The week opens with deadlines, not headlines. CISA's federal deadline for the two Zammad helpdesk flaws an AI agent chained to root, CVE-2026-102489 and CVE-2026-102490, is today. By Wednesday, October 7, federal agencies must also fix CVE-2026-88779, a Citrix NetScaler SAML flaw CISA added to its Known Exploited Vulnerabilities catalog on Sunday. Citrix says it has seen targeted attacks crash unmitigated appliances, and BleepingComputer reports researchers are still investigating whether the flaw can do more than denial of service.
The NetScaler story is bigger than one CVE. Citrix patched eight flaws on September 27, including two zero-days, CVE-2026-88771 and CVE-2026-88772, that attackers had used to plant web shells. Organizations that patched for those flaws must upgrade again if their appliances use SAML. Citrix lists 14.1-73.41 and 13.1-64.28 as the fixed builds. If your remote access depends on NetScaler, treat this as a Monday morning change, not a Wednesday one.
The clearest warning of the weekend came from South Korea. Shinhan Bank said information on about 25,000 customers was exposed through a service used only by loan brokers. KB Kookmin and Hana reported smaller leaks through an employee mobile work system and a sales support system. Korean outlets, citing investigators and the banks, say AI agents probed the lenders for weak points; Korea Economic Daily counts about 68,000 records across seven financial firms. President Lee Jae Myung ordered a thorough investigation, and regulators told the sector to inspect every externally exposed IT system.
B3 analysis: none of those entry points was the core banking platform. They were side doors, the broker portals, field-sales tools and helpdesks that sit outside the main security program. Automated attackers do not get tired of checking them. The Zammad intrusion, the NetScaler campaign and the Korean breaches share one pattern: an exposed system, probed at machine speed, with an authentication gap behind it.
Agents are also the new inbox risk. Salt Labs showed it could hijack the Manus AI agent with one email. An obfuscated payload ran before the agent's own warning appeared, and from there the researchers could reach the email, cloud storage and code repository accounts the user had connected. The issue has been fixed. The lesson for any connected agent is that warnings that arrive after execution are not controls.
Two more items for the week's agenda. Symantec says the China-linked Warlock ransomware group is still breaking into on-premises SharePoint servers through the ToolShell flaws from 2025, now at a water utility and a telecom provider. And in Washington, the new Super Intelligence Force under DNI Jay Clayton has a reported 120 days to report on AI risks. Monday's executive agenda: verify the Zammad and NetScaler fixes, order an inventory of every internet-facing system with an owner, and require that any AI agent with inbox or code access is reviewed before Friday.
Exploited Vulnerabilities / Edge Access · Oct. 4, 2026 · KEV due Oct. 7
CISA gives agencies until Wednesday to fix an exploited NetScaler SAML flaw
CISA added CVE-2026-88779, a memory overflow in Citrix NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider, to its KEV catalog on October 4 with a federal deadline of October 7. Citrix says targeted attacks crashed unmitigated appliances and lists 14.1-73.41 and 13.1-64.28 as fixed builds. It follows the September 27 fixes for zero-days CVE-2026-88771 and CVE-2026-88772, which attackers used to plant web shells. Organizations that patched those must upgrade again if they use SAML.
The B3 read: Remote access is the front line again. Patch before Wednesday, then hunt for web shells and rogue superuser accounts from the earlier campaign.
Buyer checklist: Questions to ask an MSP about access and response · Ransomware recovery plan checklist and restore tests
Source: Citrix / CISA KEV / BleepingComputer
Citrix bulletin CTX697174: CVE-2026-88779
AI-Assisted Attack / Financial Sector · Oct. 4, 2026
Suspected AI agents breach South Korean banks through broker and sales portals
Shinhan Bank said data on about 25,000 customers was exposed through a service used only by loan brokers. KB Kookmin reported 119 customers affected through an employee mobile work system, and Hana reported 89 through a sales support system. Korean outlets, citing investigators and the banks, say AI agents probed the lenders for weak points. Korea Economic Daily counts about 68,000 records across seven firms. President Lee Jae Myung ordered a thorough investigation, and regulators ordered inspections of all externally exposed IT systems.
The B3 read: The attackers skipped the core platform and found the side doors. Inventory every exposed portal, including the ones run for partners and field staff.
Source: Korea JoongAng Daily / Anadolu Agency
Anadolu Agency: South Korean president calls for thorough probe
Exploited Vulnerabilities / Agentic Attack · KEV due today, Oct. 5
Deadline day: the Zammad flaws an AI agent chained to root are due today
CISA's federal remediation deadline for CVE-2026-102489 (session fixation) and CVE-2026-102490 (privilege escalation) is Monday, October 5. DIVD says an autonomous AI agent chained them on September 21 to go from a hijacked helpdesk session to root in seconds before segmentation stopped it. Zammad recommends version 7.2.0; 6.5 and older no longer receive security fixes.
The B3 read: If a helpdesk you or a provider runs is still on an affected build this morning, take it offline until it is upgraded.
Source: CISA KEV / NVD / BleepingComputer
CISA Known Exploited Vulnerabilities catalog
Prompt Injection / AI Agents · Oct. 1, 2026
One email was enough to hijack the Manus AI agent, researchers show
Salt Labs hid instructions in an ordinary email to a Gmail inbox connected to Manus. Direct prompts and Base64 encoding were blocked, but a JSFuck-obfuscated payload was decoded and run in the agent's cloud sandbox before its warning appeared. From there the researchers could reach the email, cloud storage and code repository accounts the user had connected. Salt says the issue was reported through Meta's bug bounty and is no longer exploitable.
The B3 read: A warning that appears after the code runs is not a control. Limit what connected agents can execute and reach, and review every agent with inbox or code access.
Buyer checklist: AI vendor security checklist and permission tests
Source: Salt Security / TechRadar
TechRadar: popular AI agent could be hacked by a single email
Ransomware / Critical Infrastructure · Oct. 2, 2026
Warlock ransomware is still getting in through unpatched SharePoint servers
Symantec says the China-linked group it tracks as Longlegs, which Microsoft tracks as Storm-2603, used SharePoint flaws to hit a water utility, a telecom provider, a regional government body and a university. The group exploited the 2025 ToolShell chain, including CVE-2025-53770, disabled security tools with a vulnerable signed driver (CVE-2025-1055) and staged ransomware through the domain's SYSVOL share.
The B3 read: A year-old SharePoint chain is still working. Confirm on-premises SharePoint is patched, rotate ASP.NET machine keys and watch SYSVOL for new executables.
Buyer checklist: Ransomware recovery plan checklist and restore tests
Source: Symantec / BleepingComputer
Symantec: Warlock attackers hit water and telecom operators
