Threat Brief — 2026-10-04 — Citrix KEV addition and crypto-theft ultimatum

CISA has added Citrix NetScaler CVE-2026-88779 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, giving organisations a firm remediation deadline. Separately, the NEAR Intents platform has publicly identified a thief who stole $3.8M in cryptocurrency and issued a 48-hour ultimatum for return of the funds. Two remaining feed items (a methane-detection satellite and a Hubble supernova observation) are not security-relevant and are excluded.

Top items

• Citrix NetScaler CVE-2026-88779 added to CISA KEV — active exploitation confirmed. CISA added this improper-bounds vulnerability to its Known Exploited Vulnerabilities catalog, meaning there is evidence of exploitation in the wild. NetScaler appliances are widely deployed at network edges; exposed instances should be treated as priority remediation targets. (src: CISA Current Activity)

• NEAR Intents identifies crypto thief, issues 48-hour ultimatum for $3.8M return. The platform states it has identified the attacker responsible for stealing $3.8M through its intents system. According to the report, the attacker began with two small test transactions before rapidly escalating to multimillion-dollar transfers — a pattern consistent with probing a vulnerability before maximising exploitation. The 48-hour deadline suggests potential escalation to law enforcement or public doxing if funds are not returned. (src: SecurityLab)