Morning Review in IT Security — September 30, 2026

The threat landscape remains volatile as multiple zero-day vulnerabilities continue to be weaponized in active campaigns. Today's review highlights critical exposures affecting Apple and Citrix infrastructure, alongside sophisticated nation-state operations targeting organizations across North America and Europe.

Apple Zero-Day Vulnerability Weaponized in Targeted Attacks

Attackers are actively exploiting CVE-2026-86950, an out-of-bounds write flaw in Apple systems, according to recent threat intelligence. The vulnerability is being leveraged in extremely sophisticated targeted attack campaigns, indicating that threat actors have developed reliable exploitation techniques. Organizations running vulnerable Apple infrastructure should prioritize patching efforts immediately to prevent compromise.

Source: Apple Zero-Day Vulnerability Weaponized in Targeted Attacks

Citrix NetScaler Zero-Days Exploited Undetected for Extended Period

Mandiant researchers have identified that attackers exploited Citrix NetScaler zero-day vulnerabilities for at least three weeks without detection across dozens of organizations. The campaigns are attributed to advanced and suspected state-sponsored threat groups, indicating a significant breach of operational security at affected enterprises. Researchers expect additional attacks leveraging these vulnerabilities to emerge as more threat actors gain access to exploitation code.

Source: Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected

Citrix NetScaler Zero-Days Leveraged for Web Shell Deployment

Cybersecurity researchers have documented that attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day vulnerability to deploy custom web shells and tunneling malware into compromised environments. The exploitation chain enabled threat actors to gain root access, harvest credentials, and establish persistence for lateral movement into internal networks. The combination of CVE-2026-88771 and CVE-2026-88772 has proven particularly effective in enabling deep infrastructure compromise across multiple sectors.

Source: Hackers exploit Citrix NetScaler zero-day to deploy web shells

Russia's Star Blizzard Targets Over 100 Organizations With Backdoor Campaign

Russian state-sponsored threat actors known as Star Blizzard have conducted a sustained campaign targeting more than 100 organizations using fraudulent event invitations as delivery vectors. The operation, documented by Microsoft, has primarily focused on entities tied to Ukraine, with victims concentrated in the United States and United Kingdom since January 2026. The campaign successfully deployed backdoors including CosmicPulse and DarkSword malware, with at least one confirmed compromise and potential for additional breached systems remaining under investigation.

Source: Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor

The convergence of zero-day exploitation and nation-state social engineering campaigns underscores the critical importance of maintaining current patch management protocols and implementing robust email security controls. Organizations should review their exposure to affected systems and validate detection capabilities for the indicators of compromise associated with these active threats.