Today’s stories share a theme: the weak point wasn’t the technology vendors sell, it was the trust decisions sitting on top of it — a support call someone answered, an MFA push someone approved, an image someone let a server process. Here’s what’s new since yesterday’s digest.
Vulnerability watch: A Citrix NetScaler flaw patched as “just a DoS bug” turns out to be unauthenticated RCE — and it’s already being exploited
Citrix patched CVE-2026-8452 back on June 30, describing it as a high-severity memory overflow that could cause unpredictable behavior or denial of service. Researchers at WatchTowr have now shown it’s exploitable for full unauthenticated remote code execution against NetScaler appliances configured as an AAA virtual server or a Gateway VPN server. CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 26 and gave federal agencies until August 29 to patch or disconnect affected appliances. In the wild, attackers have been dropping web shells named x.php and z.php and running basic discovery commands to map compromised systems. Fixes are available in 14.1-72.61 (FIPS), 13.1-63.18, and 13.1-37.272. Help Net Security · SecurityWeek
If you run NetScaler as a VPN gateway or AAA front door, treat “patched months ago” as no signal at all — confirm the current build against Citrix’s advisory and check for those web shell filenames now, not after the next scan cycle.
Social engineering watch: ShinyHunters talked its way into a security vendor’s own identity dashboard
On August 22, attackers linked to ShinyHunters ran a vishing campaign against ReliaQuest, calling multiple employees while impersonating named members of the company’s own security team. One employee approved an MFA push during the call, and the attacker used it to reach a view-only session on an internal identity dashboard — nothing more, thanks to device-trust policies that confined the session to that single login. ShinyHunters posted a leak-site listing the next day claiming a bigger breach; ReliaQuest says no other systems, applications, or customer data were reached, and no validated stolen data or ransom demand has surfaced. The attackers had also stood up a spoofed domain and a fake SSO portal hosted on a CDN to make the call feel legitimate. ReliaQuest · SecurityWeek · The Register
A security vendor getting vished by “its own security team” and holding the line on one contained session, not zero incidents, is the realistic outcome to design for: assume someone will approve a push they shouldn’t, and make sure device-trust and session scoping are what stop it from going further.
Vulnerability watch: Next.js patches two unauthenticated RCE bugs in one release
The Next.js team shipped fixes on August 25 for two critical, unauthenticated remote-code-execution bugs. The first is in the underlying image library used for AVIF optimization — an attacker-controlled AVIF image processed by Next.js’s image optimizer could trigger RCE, so the patched releases disable AVIF optimization entirely until an upstream fix lands. The second affects apps using both the Pages Router and the App Router without Cache Components, and only triggers when the Next.js server runs on a Windows filesystem. Both are fixed in 15.5.24 (Maintenance LTS) and 16.3.3 (Active LTS) — upgrade with npm install [email protected] or npm install [email protected] depending on which line you’re on. Next.js Security Release · Netlify
Unauthenticated RCE in a framework this widely deployed is worth an out-of-cycle deploy rather than waiting for your next sprint — check whether image optimization is exposed to untrusted uploads and whether your build targets Windows before assuming you’re unaffected.
Also noted
Boston Scientific disclosed on August 26 that a cyberattack detected the day before is causing a “global disruption” to its operations, including its ability to process and ship customer orders; the medical device maker — which makes pacemakers, defibrillators, stents, and catheters across 127 countries — sent employees at its Cork, Ireland manufacturing site home while it investigates with outside help. No confirmed attribution has been established yet. TechCrunch · The Register
Nutex Health, a Texas-based healthcare operator running 28 facilities across 12 states, disclosed in an SEC 8-K filing on August 24 that an unauthorized third party accessed and exfiltrated data from its network. The exact data types and number of affected people haven’t been confirmed, but the company has flagged that patient, employee, and provider information may be involved. No group has claimed credit yet. SecurityWeek
Final thought
None of today’s incidents started with a novel exploit technique — a memory-safety bug misjudged as low-severity, a phone call that sounded like the right department, an image format nobody thought to distrust. The pattern worth taking from all three: known-good software and known-good coworkers are still an attack surface, and the controls that held (device-trust scoping at ReliaQuest, a fast KEV response window at CISA) are the same kind any team can put in place today. If you want a second set of eyes on where your own environment still has a gap like these, see our how-to guides or book a discovery call.