Oops, all vulns! (Citrix NetScaler problems, the FBI ShinyHunters saga cont’d and MORE)

Welcome to The Low Down, the best show on the internet for hackers Listen on Spotify! https://go.lowdownpod.com/spotify The Low Down is presented by Maze. LinkedIn: https://www.linkedin.com/company/mazehq/ X: https://twitter.com/Maze_Security Follow Us! https://www.instagram.com/lowdown.pod Heading to OneCon 2026? SentinelOne’s cybersecurity conference runs October 20–22 at the ARIA Resort & Casino in Las Vegas. Use code oc26lowdown for a discount on registration. https://www.onecon.io/ 00:00 Coming up 00:33 Intro and Matt’s SecTor keynote 02:52 Citrix NetScaler zero-days and disclosure 09:25 Breaking down the NetScaler exploits 19:04 Sponsor: Maze 20:41 Citrix’s response and responsible disclosure 25:06 Why edge devices are so hard to defend 30:54 MikroTik RouterOS vulnerabilities 35:33 Cisco SD-WAN authentication bypass 38:37 Zimbra command injection 42:22 ShinyHunters arrest and conflicting claims 50:42 Reacting to the FBI’s warning 55:05 Open-weight AI, Anthropic and GLM-5.3 1:07:35 Wrap-up and OneCon Today we're talking about: Your NetScaler Warning Came From Reddit Finding out about NetScaler zero-days through Reddit is not the enterprise support experience Matt had in mind. Ed walks through watchTowr's command injection and memory overflow writeups, including missing protections in the binary they tested. Then we get into Google's hunting guidance and why a patch alone won't kick an attacker out. https://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/ https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/ https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances MikroTik and the User Named -2 MikroTik joins the pile with an HTTP underflow and a separate SSH authentication chain. The username "-2" showing up in attack logs gets our attention. Ed explains how assumptions between different parts of a system can become an exploit. Matt has been saying "don't roll your own crypto" for his entire career. Apparently we still need the reminder. https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ Cisco's Admin API Lets the Wrong People In A specially encoded request can give an unauthenticated attacker admin access to Cisco's SD-WAN Manager API. We talk about what that means for a corporate network, and the difference between connections that need to be public and management interfaces that don't. Cisco patched its managed cloud service. If you run an affected instance yourself, the upgrade is still your job. https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-webauth-xr8beuuU.html Zimbra: An Email Goes In, a Shell Command Comes Out A crafted email can trigger command execution through Zimbra's SNMP notification system on affected configurations, without anyone clicking anything. We trace the route from incoming mail to a shell command and look at Microsoft's account of the attacks. Ed has a fairly blunt suggestion for developers: stop handing user input to Bash. https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/ ShinyHunters Meets the FBI's Camera Dutch police arrest an alleged ShinyHunters leader, and the FBI looks straight into the camera with a message for whoever's left. We untangle the arrest timeline, conflicting gang statements and the Pokémon branding. Matt brings us back to the PeopleSoft campaign and why following a group's methods is useful even when its PR is impossible to trust. https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/ https://www.fbi.gov/video-repository/shinyhunters-arrested-092926.mp4/view https://www.securityweek.com/shinyhunters-defiant-after-fbi-calls-on-members-to-come-forward/ https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft If the Attacker Gets AI, So Do I Anthropic's GLM-5.3 report sets off a disagreement. If attackers get powerful, freely available models, Matt wants to know why defenders don't get the same advantage. Ed thinks the way our systems are built still favors the attacker. We get into reports of safeguards getting in the way of incident response, the incentives behind calls for regulation, and who we'd trust to write the rules. https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities https://huggingface.co/blog/security-incident-july-2026