Today’s stories trace three different failure points — a verification vendor’s data ending up on a dark-web marketplace, a patched appliance bug that attackers weaponized anyway, and a filter-evasion trick borrowed from AI prompt-injection research. Here’s what’s new since yesterday’s digest.
Breach watch: 153 million driver’s licenses tied to IDScan.net turn up on a dark-web marketplace
A dark-web identity-theft service calling itself “Nexus” advertised more than 153 million U.S. and Canadian driver’s license scans, over 10 million ID cards, 3 million travel documents, and roughly 580,000 medical cards for sale. Brian Krebs first reported the listing on September 1 and traced the source to IDScan.net, an identity-verification vendor, after verifying sample records — including his own — against the database. Nexus claimed in its own forum post that it had been “exfiltrating new data for over a year” from a “major identity verification company.” The exposed records reportedly include a driver’s license belonging to U.S. Defense Secretary Pete Hegseth, which was listed for sale at $100. IDScan.net says it’s investigating; the FBI’s New Orleans field office has opened a formal probe, and multiple law firms have since filed or announced class-action investigations against the company. The dark-web listing disappeared shortly after Krebs’ report went public. Krebs on Security · SecurityWeek · BleepingComputer
If your onboarding or KYC flow depends on a third-party identity-verification vendor, this is a case worth walking through with them directly: ask how long they retain the documents they scan, whether that retention period is actually necessary for your use case, and what their own breach-detection timeline looks like. A vendor claiming exfiltration went unnoticed for a year is a data point about their monitoring, not just their luck.
Vulnerability watch: Critical Citrix NetScaler auth bypass moves from “patch it” to “it’s being exploited”
CVE-2026-19490, a critical authentication bypass in Citrix NetScaler ADC and NetScaler Gateway (CVSS v4 9.3), is now under active exploitation after a “credible” proof-of-concept exploit began circulating publicly. The flaw lets an unauthenticated, remote attacker bypass authentication entirely on NetScaler appliances configured as an AAA virtual server or as a Gateway — covering SSL VPN, ICA Proxy, CVPN, and RDP Proxy configurations — with no user interaction required. Citrix disclosed and patched the bug on August 21; the Centre for Cybersecurity Belgium has since warned of exploitation attempts and urged administrators to prioritize patching. Shadowserver tracks more than 22,000 NetScaler ADC appliances and nearly 1,700 Gateway instances still reachable from the internet. BleepingComputer · SecurityWeek · Help Net Security
Two weeks between disclosure and confirmed exploitation is a fairly typical window for a bug this severe on internet-facing VPN infrastructure. If you’re running NetScaler as an AAA virtual server or SSL VPN gateway and haven’t confirmed your build against the fixed versions, that’s today’s task — an unauthenticated bypass on remote-access infrastructure is exactly the kind of foothold that turns into a full network compromise before anyone notices.
Threat watch: Phishing campaign hides lure words inside invisible Unicode characters to dodge filters
Microsoft’s security team detailed a phishing campaign that inserts invisible Unicode “tag” characters — a character block that recently drew attention in AI prompt-injection research — inside financial lure words like “funding” to split them apart and slip past filters that scan for those terms as plain text. Weekday volumes are estimated to have reached as high as 2.37 million emails at their February 2026 peak, using hundreds of disposable, finance-themed sender domains with lures mimicking business loans, lines of credit, and advance-funding offers. Researchers assess the campaign is connected to an earlier operation, first detailed by Fortra’s threat intelligence team, that weaponized the ActiveCampaign marketing platform to send AI-generated phishing emails targeting Small Business Administration loan applicants. Microsoft Security Blog · The Hacker News
This is a good prompt to check what your own email security stack actually does with invisible or zero-width Unicode characters in message bodies — if filtering logic strips them before keyword matching runs, this evasion technique doesn’t work against you. If it doesn’t, this is the kind of gap that’s cheap to close once you know to look for it.
Also noted
HPE patched 34 CVEs in Aruba Networking’s ArubaOS-CX switch operating system, including two independent, unauthenticated remote-code-execution paths — one a buffer overflow (CVE-2026-73749, CVSS 9.8) reachable by sending crafted packets to an affected daemon. More than 150 issues in total were resolved across the 10.10 through 10.18 branches. HPE says it has no evidence of exploitation in the wild, but with no authentication required for the RCE paths, patching ahead of a public proof-of-concept is the safer bet. BleepingComputer · SecurityWeek
Final thought
Three stories, three different origins for the same outcome — data or access ending up somewhere it shouldn’t. A verification vendor that didn’t catch a year of quiet exfiltration, a VPN gateway bug that went from patch to active exploit in two weeks, and a filter-evasion trick that only works because most keyword scanning never accounts for invisible characters. None of these require a novel defense — they require someone checking the boring thing today instead of next sprint. If you want a second set of eyes on whether your own logging would catch something similar moving through your environment, see our how-to guides or book a discovery call.