On 5 October 2026 Citrix disclosed CVE-2026-88779 (CVSS 8.7), a memory overflow that causes denial of service on NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider, and confirmed targeted exploitation. Bishop Fox and watchTowr identified it, and watchTowr reportedly reproduced it within hours of seeing honeypot activity. It follows CVE-2026-88771 and CVE-2026-88772, which Google's threat intelligence group reported were exploited from early September, roughly three weeks before the 27 September disclosure; CISA set a federal remediation deadline of 7 October for the new flaw.

The exposure is the edge appliance fronting your identity federation: where it acts as a SAML provider, an outage is also a login outage for every application behind it. The pattern matters more than the single CVE: three separate flaws in one product line inside eight days of the first two being disclosed, with the first pair exploited for about 24 days before anyone could patch.

CAISI's assessment, dated 17 September 2026, calls GLM-5.3 "the most cyber-capable open-weight model released to date" while finding it "significantly lower" than current US frontier models, lagging about four months in aggregate. Scores for GLM-5.3 against the US frontier: SEC-Bench Pro 40.4% vs 90.2%, ExploitGym 9.4% vs 44.4%, OSS-Fuzz 7.7% vs 23.2%. CAISI notes it ran US models with cyber safeguards disabled and excluded unreleased models from the comparison.

This is a government-run measurement, separate from the provider-published assessment CSA covered on 1 October, and it puts a number on the diffusion interval: capability that needed gated access four months ago is now downloadable with no access program, identity check or usage monitoring. Adversary tooling and your own self-hosted defensive agents can both draw on it.

ThreatDown researchers, finding an unauthenticated Docker registry in August 2026 (59 repositories, 4.3 GB), documented a botnet that infects Docker daemons exposed on port 2375 and installs Hermes Agent, an MIT-licensed open-source framework, unmodified. All malicious behaviour comes from a 39-line persona file that directs the agent to take Telegram tasks, persist, and harvest credentials, with AI provider API keys ranked ahead of SSH credentials, tokens and databases. The infected host rescans neighbouring networks every five minutes.

The malware is a legitimate agent runtime plus instructions, so signature detection has little to match. The assets at risk are the model-gateway and provider keys that sit in container environment variables, where a stolen key becomes someone else's inference spend and, potentially, someone else's agent.