DAILY BRIEFING
Unpatched Citrix NetScaler RCE Zero-Days and Lunex Stealer Campaign
Today's briefing covers active exploitation of two unpatched Citrix NetScaler RCE zero-days and the deployment of Lunex stealer via fake Cloudflare CAPTCHA prompts.
5 stories2 min read
Active exploitation of perimeter infrastructure and endpoint credential theft headline today's security developments. Network administrators face immediate risk from two unpatched remote code execution zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances, as reported by watchTowr on September 26.
Security teams responsible for external gateway appliances must review perimeter access immediately, while endpoint defenders should monitor for social engineering tactics delivering malicious MSI installers.
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
Security firm watchTowr reported active exploitation of two unpatched zero-day remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. Citrix has not confirmed or patched the flaws, which are distinct from the previously patched CVE-2026-19490 bypass.
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Researchers uncovered the Lunex malware-as-a-service platform being distributed via ClickFix fake CAPTCHA pages on compromised websites. The attack chain delivers LunexLoader to bypass Windows UAC, siphon browser credentials and crypto wallets, and maintain persistence using a PowerShell-based Native Messaging Host.
- Why it matters
- Attackers can bypass administrative controls to exfiltrate browser credentials and secure persistence inside victim environments.
Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors
The requested article from Bleeping Computer could not be retrieved due to an automated Cloudflare anti-bot verification page.
- Why it matters
- No technical content was accessible in the source material to evaluate security implications.
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks
The requested article from Bleeping Computer could not be retrieved due to an automated Cloudflare anti-bot verification page.
- Why it matters
- No technical content was accessible in the source material to evaluate security implications.
Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer
The requested article from Bleeping Computer could not be retrieved due to an automated Cloudflare anti-bot verification page.
- Why it matters
- No technical content was accessible in the source material to evaluate security implications.
Key takeaways
- Two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances are undergoing active exploitation, watchTowr reported.
- The new Citrix NetScaler RCE flaws are distinct from the previously patched authentication bypass CVE-2026-19490.
- The Lunex malware campaign uses fake ClickFix Cloudflare verification checks to deliver loaders and steal credentials from Chromium browsers.
- Ontinue research shows LunexLoader attempts to bypass Windows User Account Control using CMSTPLUA.