AI Weakly #21 - "The AI Security Window Just Collapsed"
AI Weakly is the weekly newsletter for those who make decisions on AI and security without time to waste. Every Tuesday: the facts that matter without the noise.
Issue #21
Top Story —
Week 39 delivers a one-two punch: Citrix NetScaler zero-days (CVE-2026-88771/88772) are actively exploited in the wild with patches just released, forcing emergency patching across internet-facing edge infrastructure. Simultaneously, GitLab's issue email feature leaks private credentials that function as full code-push + CI/CD execution tokens—turning any disclosed email into a supply chain skeleton key. Combined with critical flaws in WSO2 API Control Plane, Bifrost AI Gateway, and Ubuntu containers, organizations face immediate compromise risk spanning perimeter, pipeline, and AI infrastructure layers. The pattern is clear: attackers are hunting for unpatched critical systems and exploiting authentication shortcuts in widely-deployed platforms.
Weakly Digest —
01 —
Citrix NetScaler RCE Zero-Days Under Active Exploitation—Patches Released
🔴 Critical Vulnerability / Active Exploitation
Two critical RCE zero-days (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway are confirmed exploited in the wild. Citrix released patches on September 27 along with fixes for six additional vulnerabilities.
EDITOR’S NOTE
URGENT: Treat NetScaler patching as P0. These are internet-facing appliances with default-config exploitability. Verify all instances in your environment are patched within 48 hours. Implement network segmentation around unpatched systems while patches deploy. Check logs for CVE-2026-88771/88772 exploitation attempts dating back to early September.
02 —
GitLab Issue Email Addresses Weaponized as Supply Chain Credentials
🟣 Supply Chain / Authentication Bypass
GitLab's issue email feature contains a critical authentication vulnerability where leaked private email addresses function as credentials, enabling unauthorized code commits and CI/CD job execution under a victim's identity. Any disclosed email can push code and trigger pipeline jobs.
EDITOR’S NOTE
CRITICAL: Audit your GitLab instance for exposed issue email addresses across commit logs, chat history, and external communications. Regenerate issue emails for high-risk projects immediately. Enforce branch protection rules + code review requirements to catch injected commits. Implement GitLab audit logging alerting on unexpected push/merge events. This is a direct supply chain compromise vector.
03 —
Critical Bifrost AI Gateway RCE—Unauthenticated Command Execution
🔴 Critical Vulnerability / AI Infrastructure
CVE-2026-90898 (CVSS 9.8) in Bifrost AI gateway allows unauthenticated RCE via HTTP requests, affecting all versions before 2.1.0. The gateway routes requests across 20+ LLM providers and is a single point of compromise.
EDITOR’S NOTE
URGENT: If you run Bifrost for LLM orchestration, upgrade to 2.1.0+ immediately—this is unauthenticated RCE on a gateway appliance. Audit all LLM provider API keys that transit Bifrost for unauthorized usage. Implement network-level access controls restricting Bifrost access to internal networks only. Review logs for exploit attempts (malformed HTTP requests to sensitive endpoints).
04 —
WSO2 + Adobe Commerce Flaws Added to CISA KEV—Active Exploitation Confirmed
🔴 Critical Vulnerability / Active Exploitation
CISA added CVE-2026-5430 (WSO2 API Control Plane) and a critical Adobe Commerce/Magento flaw to its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Both carry critical severity ratings.
EDITOR’S NOTE
IMMEDIATE: Prioritize emergency patching for WSO2 API Control Plane and Adobe Commerce/Magento instances. These are actively exploited, meaning your organization is likely in an attacker's targeting scope if unpatched. Verify all instances with security scans; implement WAF rules for known exploit patterns while patches deploy. Monitor for unauthorized API calls or payment data exfiltration.
05 —
Linux Kernel Container Escape—Ubuntu LTS Unpatched Despite Public Exploit
🔴 Critical Vulnerability / Privilege Escalation
CVE-2026-80521 (CVSS 7.8) use-after-free in Linux AF_UNIX socket subsystem enables container-to-host escape with root privileges. Exploit released while major Ubuntu LTS versions remain unpatched despite upstream fix available since August.
EDITOR’S NOTE
CRITICAL: Patch all Ubuntu LTS systems running containers immediately. This is a direct path from compromised container to host root. If you cannot patch immediately, restrict container images to read-only filesystems and disable privileged containers. Audit running containers for suspicious privilege escalation attempts. Check container orchestration logs (Kubernetes, Docker) for exploitation patterns.
Also worth reading —
Chrome-Windows Zero-Day Chain Deploys CLEANGULP Malware—Urgent Patching Required — Deploy Chrome + Windows patches immediately; threat hunting for CLEANGULP indicators across endpoints.
Salesbleed—Salesforce AI Agents Manipulated to Enable Slack Phishing — Review Salesforce agent configurations + Slack integration controls; elevate phishing awareness for AI-generated messages.
Ghost Service Accounts Enable M365 Data Theft—Orphaned Credentials Bypass MFA — Audit M365 service accounts for orphaned/unused credentials; implement service account lifecycle management + conditional access.
EDR Evasion via Process Parameter Poisoning—Detection Gaps Exploited — Review EDR tuning for process initialization monitoring; supplement with behavioral analytics and threat hunting.