Almost every security programme in the world rests on one instruction: apply the update. Budgets are built on it, audits measure it, regulators write deadlines around it. September tested that instruction at both ends and it gave way at both. At one end, the fixes for the month's most serious flaws arrived after the attacks did — and did not remove the attackers. At the other, Microsoft shipped the largest single batch of patches in its history, a volume no organisation on earth can absorb inside the window anyone has set for it. The two failures are opposite in shape and identical in consequence: patching stopped being a sufficient answer to the question of whether you are compromised.
The clearest case is Citrix. On 27 September — a Sunday, two days after unofficial reports began circulating — Citrix published a bulletin covering eight flaws in NetScaler ADC and Gateway and acknowledged that two of them were already being exploited. Fixes shipped the same day, and both landed in CISA's catalogue of known exploited vulnerabilities that week, with a 30 September deadline for United States federal civilian agencies. Three days after the bulletin, Mandiant Consulting and Google Threat Intelligence Group published what they had found: exploitation of CVE-2026-88772, which bypasses authentication and deliberately crashes the NetScaler Packet Processing Engine to obtain root, in a campaign they described as ongoing since at least early September. Mandiant's earliest known case is dated 3 September. The bulletin, in other words, trailed the attack by more than three weeks. Mandiant's chief technology officer, Charles Carmakal, wrote that the firm was aware of dozens of affected organisations and attributed the intrusions to "advanced and suspected state-sponsored threat actors" — a formulation worth reading precisely, because the published Mandiant and GTIG analysis names no actor and no country at all. The victims it describes are in North America and Europe, in government, financial services, technology, education, and legal and professional services. Exploitation of the second flaw, CVE-2026-88771, broadened sharply from 28 September once a proof of concept appeared, and on 4 October a third NetScaler flaw, CVE-2026-88779, was added to the same catalogue with a three-day deadline.
What makes this more than another bad month for an edge appliance is the second half of Mandiant's guidance. The investigators name two custom tools — WHIPSHOT, a PHP web shell that hides its command traffic inside HTTP headers, and SLAPSHOT, a Python tunneller used to reach into internal networks and collect credentials — and then describe how the intruders stay: handler directives added to the web server's configuration, and the set-user-ID bit flipped on the system shell. None of that is removed by installing a fixed build. The hunting instructions are for artefacts a patch leaves behind, and the remediation advice is to rotate credentials and certificates and revoke active sessions afterwards. The pattern repeated at Cisco three days later. Its 30 September advisory described CVE-2026-76504, an authentication bypass in the login code of Catalyst SD-WAN Manager's API, scored 9.8: a crafted request, mishandled because of how URI-encoded input is read, walks past the access check and arrives with the privileges of the default administrator. Cisco's responders had seen the activity during September, before a fix existed, and offered no interim mitigation. A Cloud Security Alliance research note drew the only safe conclusion available — that any Manager reachable from an untrusted network during September should be treated as already compromised, because closing the hole evicts nobody.
Then the other end. On 8 September Microsoft published the largest security update it has ever shipped. Counting it is itself instructive: Microsoft's own list ran to 974 entries, of which ten concern cloud services the company fixes itself, and the trade press settled on figures between 964 and 972 depending on what each outlet excluded. By BleepingComputer's count, 966 flaws, 105 of them rated critical — against 570 in July and 400 in August. Two were already being exploited, and both were privilege escalations rather than the remote-code-execution headlines: CVE-2026-81963 in the Windows Update Stack, found by Microsoft's own threat intelligence centre and an outside researcher, and CVE-2026-85880 in Advanced Local Procedure Call, a heap overflow used in attacks to reach SYSTEM, credited to Volexity and researchers at Proofpoint. Among the rest sat CVE-2026-69730, a DNS flaw described as the successor to 2020's SigRed, in a cluster of about twenty bugs across most supported Windows versions that could in principle be classified as wormable. Dustin Childs of the Zero Day Initiative put the risk plainly: "We haven't seen a global worm in years." Nobody patches 966 things in a week. And in the month's two worst cases, patching the three that mattered would still have left the attacker inside.
$387.5 million, and the security product was the door
The cryptocurrency exchange Bitget lost about $387.5 million, in what trackers have called the largest single crypto theft of 2026 and part of the year's worst month for such losses, estimated at roughly $768 million in all. The theft is dated 24 September in UTC, 25 September in Bitget's own time zone. The company's account of how it happened, given on 30 September, is the part that belongs in this issue: the attackers exploited a zero-day in third-party security products, with Mandiant pointing to two compromised appliances, and the intrusion's earliest traces run back to 31 August. Private keys and cold storage were not broken; the route in was software bought to protect the place. Bitget's initial estimate of $351.6 million was revised upward as the investigation continued, and withdrawals were restored in stages from 28 September. Chief executive Gracy Chen has attributed the attack to North Korean operators; that is the company's attribution, not an independent finding, and no indictment or government statement has yet tested it.
543,699 keys, still working
Truffle Security published a count of credentials sitting in public GitHub repositories that were still valid when tested: 543,699 unique live secrets as of July 2026. The supporting figures are worse than the headline. The median exposed credential had been sitting on a public default branch for 784 days — more than two years, in the open, in the first place an attacker looks. The oldest was committed in 2009. And just under 200,000 of them were pushed after GitHub turned secret-scanning push protection on by default, which is to say after the guardrail existed. This is a vendor's own study and has not been independently reproduced, but it explains something about the month's larger stories. The remediation advice attached to both the NetScaler and the Cisco intrusions ends in the same place — rotate the credentials — and an industry that leaves half a million working keys in public repositories for two years at a stretch is not an industry that rotates credentials well.
The agent that picked its own next step
The month produced the first widely reported claim of an AI agent driving an intrusion rather than assisting one — and it is a claim, carefully labelled. On 21 September the Dutch Institute for Vulnerability Disclosure, an organisation whose whole purpose is reporting other people's flaws, was itself breached through two zero-days in the open-source Zammad ticketing system, CVE-2026-102489 and CVE-2026-102490, chained to hijack a session, run code and escalate from an ordinary Zammad account to root. DIVD says the evidence indicates the attack was AI-driven, and bases that on the pattern by which each next step was chosen. That is the victim's own reading of its own logs rather than an independent finding, and the distinction is harder to close than it sounds: in a log, an agent choosing its next step and a competent operator working quickly look much the same, and telling them apart means showing the reasoning, which nobody has. Elsewhere, Pillar Security described a flaw of the kind this desk keeps returning to: in Unsloth Studio, a tool for fine-tuning language models, merely selecting a model in the picker caused the backend to fetch and execute Python from that model's repository. Reading the model's configuration file was enough. The weights were never loaded and no inference ever ran. It was fixed in version 2026.6.9, released on 18 June. As in last month's cover story, the dangerous surface was not the model. It was the plumbing that reads the file.
The client side had its own month
While the appliances burned, the software on everyone's desk had a worse September than usual. Apple shipped fixes on 28 September for an out-of-bounds write in CoreGraphics — a crafted file is enough to run code — reaching iOS and iPadOS 26.7.1 and macOS Tahoe 26.7.1 and Sequoia 15.8.1, and credited the discovery to Meta's product security team. Apple's own language is deliberately narrow: it says only that the flaw may have been used in an extremely sophisticated attack against specific targeted individuals. Outlets do not even agree on which identifier belongs to it, so we have not printed one. Google patched an actively exploited flaw in Chrome's V8 engine alongside eleven others. Microsoft's researchers reported that an already-patched Zimbra Collaboration Suite flaw had been weaponised to plant web shells and read mailbox data — the familiar interval in which a fix exists and the installation does not. And SonicWall, whose two chained SMA 1000 zero-days this desk reported last month as unfixed and under attack, has since shipped updates for both. One resolution, in a month that mostly produced the opposite.
🔍 How this issue was reported
Aegis Sentry does not have reporters in the field. This issue was assembled on 10 October 2026 from the disclosing parties' own material wherever it exists — the joint Mandiant and Google Threat Intelligence Group analysis of the NetScaler campaign, Citrix's bulletin, Cisco's advisory, Apple's release notes, Microsoft's September security update, Bitget's statements, and Truffle Security's and Pillar Security's published research — supported by trade reporting, principally BleepingComputer, The Hacker News, Help Net Security and CyberScoop. Where a count, an attribution or a timeline comes from one party rather than from independent confirmation, we have named that party in the text: the "dozens" of NetScaler victims and the state-sponsorship language are Mandiant's, the North Korean attribution is Bitget's, the AI-driven characterisation of the DIVD intrusion is DIVD's, and the credential figures are Truffle Security's. Dates given for first exploitation are the earliest that a named party claims to have observed, not the earliest that occurred. Where later reporting corrects any of this, we will correct it here.