SOC Analyst: 2026-09-28

1. AL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-88771 and CVE-2026-88772

   Canadian Centre for Cyber Security, 2026-09-27. Read, 5 min.

   The Cyber Centre warns of two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, and says reports indicate they are being exploited across multiple Citrix customer environments worldwide, although the full extent of the activity remains unknown. It asks organizations to review Citrix's September 27 bulletin, prioritize Internet-facing systems, and investigate for signs of compromise.

   Why it matters for this role: When a NetScaler shows outbound connections nobody can explain or unusual administrative access, the Cyber Centre asks for that activity to be investigated, not closed as noise.

2. A Closer Look at Malware From the Macfinger ClickFix Campaign

   SANS Internet Storm Center, 2026-09-25. Read, 6 min.

   SANS ISC handler Brad Duncan examined a September 24 infection from the Macfinger ClickFix campaign on macOS, which he says remains active. He says he does not think the information stealer it delivers is a variant of Atomic macOS (AMOS) Stealer as originally reported, while noting he does not know what to call it and could still be wrong.

   Why it matters for this role: Hold off on the AMOS Stealer label for Macfinger ClickFix alerts on macOS until the family is settled, as the SANS handler who examined a September 24 infection doubts that attribution.

SOC Analyst