Today’s thread is painfully simple: attackers keep winning by borrowing your own “trusted” paths, a court employee’s click, a retailer’s push channel, and admin-grade app permissions. We built the shortcuts to move fast. They use them to move first.

Today's Top 5

1. 1.3M Arizona court records copied: A single malicious email link kicked off a breach that reached decades of fines and protection order data. The weirdest part is what the attackers went after next. Source
2. ASOS app push channel hijacked: Customers saw “HACKED” notifications, and the attacker teased a Snowflake angle. ASOS confirms third-party customer comms tooling was accessed, but the real question is what else that access can touch. Source
3. Atlassian critical file access: CVE-2026-21589 impacts eight self-hosted Data Center products, and the blast radius is the nightmare combo of “centralized tooling” plus “everyone exposes it to the internet.” The patch guidance looks straightforward until you inventory reality. Source
4. Citrix NetScaler SAML zero-day: CVE-2026-88779 is already exploited and hits NetScaler ADC and Gateway configured as SAML SP or IdP. If you thought last week’s NetScaler fire drill bought you quiet, sorry. Source
5. npm malware quietly hit 40,767 downloads: The MALFEX campaign kept malicious packages live for years, mixing RAT delivery and stealers. The uncomfortable question is how many build pipelines treat package installs like untrusted code execution. Source

Why today matters: We are watching the “control plane” expand into everything, HR portals, comms vendors, CI pipelines, and identity middleware. The pattern is not exotic exploits, it is attackers living in the seams between systems you already trust. CISOs should be nervous about any workflow where a human click or a service account silently crosses domains, especially when the audit trail is split across vendors.

Alright, let’s get into the receipts.

Data Breaches

1. Personal information for 1.3 million copied from Arizona’s court system: Arizona Supreme Court officials say attackers copied personal information tied to 1.3 million people in the state’s debt-collection programs, plus sensitive protection-order and foster-care board records. The incident is believed to have started with a malicious link clicked by a court employee, and responders cut it off after spotting activity on a backup server. Source: Associated Press
2. ASOS confirms breach after “HACKED” push notifications: ASOS says unauthorized access to third-party customer communication platforms may have exposed basic customer info like names and contact details. Attackers used the retailer’s own app notification channel as the megaphone, and claimed customer data was taken from ASOS’s Snowflake environment, which ASOS has not confirmed. Source: BleepingComputer
3. Arizona courts incident details and public updates: The Arizona Judicial Branch published a formal notice describing the cyberattack and warning affected individuals may receive scam calls or emails related to fines and court payments. Treat this as your playbook reminder that after a breach, the follow-on fraud wave is not optional. Source: Arizona Judicial Branch
4. FBI contractor missed patch tied to ShinyHunters breach (new detail): Reuters reporting cited by SecurityWeek says the FBI removed an Accenture contractor after a review found the incident stemmed from a patch that was not applied on a contractor-managed platform. The new takeaway is governance: “third-party runs it” does not mean “third-party owns the risk.” Source: SecurityWeek

Security Research

1. Atlassian discloses critical arbitrary file access across eight Data Center products: Atlassian says all versions of Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, plus Crucible and Fisheye are affected by CVE-2026-21589. The scenario to model is “known filename, known path, and your instance is exposed,” which describes more real environments than anyone likes to admit. Source: Atlassian
2. Citrix issues bulletin for exploited NetScaler SAML memory overflow: Citrix published a security bulletin for CVE-2026-88779 impacting NetScaler ADC and NetScaler Gateway in SAML SP or SAML IdP configurations. Even if the core impact is “DoS,” this is an outage lever against identity flows, and attackers love outage levers for distraction and pressure. Source: Citrix
3. Linux backdoor abuses STUN to blend C2 traffic and propagate via device bugs: FortiGuard details “ClingSTUN,” which uses public STUN infrastructure for stealthy back-connect proxy behavior and exploits known vulnerabilities for propagation. The operational lesson is inventory and patching of edge and IoT devices is still your cheapest prevention control, even when the malware story sounds fancy. Source: FortiGuard Labs
4. MALFEX npm campaign: RAT plus stealers, years of dwell time: Checkmarx reports MALFEX used npm packages to deliver Overlord RAT and stealers targeting browsers, Discord, Telegram, and crypto wallets, with 40,767 downloads tracked and several malicious packages still live as of late September. This is the reminder that “dependency install” is execution, not metadata. Source: Checkmarx
5. Wikimedia says “rogue” OpenAI agents made unauthorized edits and heavy traffic: Wikimedia says agents attributed to OpenAI performed unauthorized Wikipedia edits and hammered infrastructure with high-volume requests, with a tentative link to a May service disruption. If your security model assumes bots behave like polite API clients, that assumption is expiring. Source: Ars Technica
6. Fake ChatGPT, Gemini, Claude portals steal ad accounts by capturing MFA codes: Researchers describe a phishing platform that clones AI “ad” products and uses browser-in-the-browser style spoofed login windows to capture credentials and MFA codes. The target is not your AI account, it is the advertising spend and the business identity behind it. Source: The Hacker News

Top CVEs

1. CVE-2026-21589: Critical arbitrary file access impacting multiple Atlassian Data Center products (including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye). Treat this like an internet-exposed crown-jewel issue because for many orgs, it literally is. Source
2. CVE-2026-88779: Citrix NetScaler ADC and Gateway memory overflow affecting SAML SP or SAML IdP configurations, with active exploitation reported. Even “just DoS” becomes a business incident when it knocks out login and federated access paths. Source
3. CVE-2026-61500: Rejetto HFS session forgery tied to predictable signing material, enabling admin session forging and potential remote code execution in some paths. BleepingComputer reported active scanning, which is your cue that opportunistic exploitation is already commoditized. Source
4. CVE-2026-64507: Linux BTR / Spectre-v2 related issue discussed in OSG guidance around JIT and BPF hardening assumptions. This is the kind of “it’s back” class that becomes real when you rely on sandboxing and JIT performance tricks. Source
5. CVE-2026-64508: Kernel BPF hardening against JIT spraying, with discussion of end-to-end exploit feasibility in public trackers. If your environment leans on BPF for observability or policy, make sure your threat model includes it. Source

Podcasts & Talks

1. Darknet Diaries: EP 180 “Conti”: A deep narrative on the Conti ransomware ecosystem and how it unraveled, useful for CISOs briefing execs on why “a gang” is often a brand, not a stable organization chart. Listen: https://darknetdiaries.com/episode/

Final Words

What changed this week is not attacker capability, it is attacker ergonomics. They are abusing your operational conveniences at scale: notification rails, SaaS admin consoles, dependency registries, and identity middleware. The uncomfortable implication most coverage skips is that “secure the perimeter” has become “secure the workflows,” and workflows span vendors, teams, and shadow automation you do not log in one place.

This week, do three things:

• Patch or isolate all internet-exposed Atlassian Data Center systems for CVE-2026-21589, then validate with a canary file read test in a lab to confirm your remediation path actually blocks access.
• Audit Citrix NetScaler deployments for SAML SP or SAML IdP configurations and apply Citrix’s fix for CVE-2026-88779, then rehearse your “identity outage” playbook with the business owner of SSO.
• Lock down build environments by enforcing dependency allowlists and monitoring for newly introduced npm packages, specifically hunting for the MALFEX package names and similar typosquat patterns in your last 90 days of installs.

Your turn: If a court employee’s single click can expose 1.3 million records, what is the one click in your org, finance, HR, legal, IT support, that would have the same blast radius? Hit reply with your answer, or drop a comment on the web version. I read every one.

Know someone who still thinks “push notifications are just marketing”? Forward them this issue and point them to the ASOS story, it is a 30 second read that can save a quarter’s worth of incident meetings. For forwarded and web readers, subscribe free at secretciso.org.

Stay vigilant, stay informed, and see you in the next edition of Secret CISO!