# IT Daily Roundup – October 5, 2026

> Oct 5, 2026 · #security #phishing #ai #cloud

Citrix patches NetScaler SAML zero-day with CISA deadline October 7, China-aligned TA419 bypasses MFA via AitM session hijacking, and OpenSSL patches 14 flaws including a DTLS memory disclosure.

## 1. Citrix Patches NetScaler SAML Zero-Day CVE-2026-88779: CISA Deadline October 7

Citrix released emergency updates on October 4 for CVE-2026-88779 (CVSS 8.7) in NetScaler ADC and NetScaler Gateway. The flaw resides in the memory handling layer of SAML authentication: an unauthenticated attacker can send specially crafted requests to trigger a denial-of-service condition; researchers are also investigating whether the vulnerability enables remote code execution. Citrix confirmed active exploitation on unpatched deployments, and CISA immediately added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 7, 2026. Fixed versions are 14.1-73.41 and 13.1-64.28; FIPS deployments require 14.1-73.41 FIPS or 13.1-37.282. Importantly, organizations that recently patched other NetScaler vulnerabilities must upgrade again — this fix is separate and is not covered by previous updates.

> **Why it matters:** Citrix NetScaler is one of the most widely deployed VPN and remote access solutions for business networks, from enterprise down to SMB. The vulnerability affects appliances configured with SAML authentication — precisely the configuration businesses use for SSO integration with Microsoft Entra ID (Azure AD) or Google Workspace. The combination of active exploitation, CVSS 8.7, and a CISA deadline of October 7 leaves no room for delay: patching must happen before Tuesday. If your organization runs NetScaler, contact your IT partner today — deferring to the next maintenance window is not an acceptable option in this case.

## 2. TA419: China-Aligned Hackers Bypass MFA via Session Hijacking — Only FIDO2/Passkeys Protect

Proofpoint researchers documented a campaign by TA419, a group aligned with Chinese intelligence interests, targeting AI policy researchers, law firms, defense contractors, and academic institutions in the United States. Attackers combine thorough reconnaissance with a "Frameless BitB" (Browser-in-the-Browser) technique: after establishing initial contact via seemingly legitimate email, victims receive a shortened URL that routes them through multiple redirects and a Cloudflare Turnstile check to a phishing page mimicking Microsoft OneDrive. A convincing fake login window — built from pure HTML/CSS/JavaScript without iframes — is presented to the victim. When they enter their credentials and MFA code, these are immediately relayed in real time to the actual Microsoft server via the attacker's proxy, which captures the resulting session cookie. The attacker gains an active authenticated session — without ever needing the password or MFA code again.

> **Why it matters:** This attack directly challenges the "we have MFA, we're protected" assumption. AitM (Adversary-in-the-Middle) phishing doesn't steal passwords — it steals the authenticated session after MFA has already been satisfied. SMS codes, TOTP apps (Google Authenticator, Microsoft Authenticator), and push notifications offer no protection against this technique. The only reliable defense is phishing-resistant authentication: FIDO2 hardware keys (e.g., YubiKey) or passkeys tied to a specific device, which cannot issue a session token without physical access to the key. For SMBs, the minimum step is configuring Conditional Access in Microsoft 365 to block sign-ins from unknown devices and unfamiliar locations; for high-privilege accounts (CEO, CFO, system administrators), deploying FIDO2 keys is worth serious consideration. The TA419 campaign targeted AI policy experts — but the same technique is actively used in commercial phishing campaigns against businesses of all kinds.

## 3. OpenSSL Patches 14 Vulnerabilities: CVE-2026-84782 Leaks Server Memory in Plaintext via DTLS

The OpenSSL Foundation released patches on September 30 for 14 security vulnerabilities. The most severe, CVE-2026-84782 (CVSS 8.2), affects the Datagram TLS (DTLS) implementation: when retransmitting a message while sending another message is stalled, OpenSSL can inadvertently send heap memory contents to the remote party in plaintext. If the process accesses unmapped memory, the application crashes, causing a denial-of-service condition. The attack requires no authentication or user interaction and is exploitable remotely over the network. DTLS is the TLS variant for UDP — used by VPN software, VoIP telephony, real-time communications platforms, and some IoT devices. OpenSSL is present on virtually every Linux server and in a vast array of network appliances, NAS devices, and cloud-based solutions.

> **Why it matters:** OpenSSL is a foundational cryptographic library for modern IT infrastructure — servers, network appliances, and cloud environments alike. A plaintext memory leak is a particularly dangerous scenario: an attacker on the network can passively harvest fragments of server memory that may contain cryptographic keys, session tokens, or other sensitive data from active sessions. Patching priority depends on how OpenSSL is used in a given environment: VPN servers communicating over DTLS (including some IPSec implementations), IP telephony systems (PBX), and IoT devices are directly at risk. For Linux server administrators, updating the `openssl` package to the latest version is a routine operation — add it to your patch management cycle as soon as possible.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-05-it-daily-roundup.html