WASHINGTON, September 12 — The Cybersecurity and Infrastructure Security Agency is warning that a critical flaw in Citrix’s NetScaler line has been exploited in the wild, attaching a CVSS score of 9.3 to a defect that Citrix patched on August 19. The vulnerability, tracked as CVE-2026-19490, affects all NetScaler ADC and NetScaler Gateway appliances configured as a gateway or an AAA virtual server. CISA’s warning follows an alert posted the previous week by Ryan Dewhurst, founder of Previdian and former head of threat intelligence at WatchTowr.
Security Week reported the development. Under the hood, the AAA virtual server configuration is the detail that matters.
It is the authentication, authorisation and auditing layer that sits between remote users and the resources they are trying to reach — which is precisely why an exploitable defect there is rated as severe as it is.
AdaptHealth breach exposes 4.1 million
The same news cycle brought a follow-up to a breach covered in July. Medical equipment company AdaptHealth has confirmed that a cyberattack resulted in the theft of personal, health and insurance information belonging to more than 4.1 million individuals. AdaptHealth operates more than 680 facilities across the United States.
According to the reporting, the threat actor gained access to the company’s cloud-based applications, including internal systems used for patient management and document storage. The route in was social engineering: the hacker compromised a user session at a third-party contractor.
The company emphasised that although contact information, health data and health insurance information were stolen, Social Security numbers and financial information were not affected. Security Week also carried this item.
Two Android malware families under the microscope
Two Android reports landed on Wednesday. The first, from Zimperium’s zLabs team, attributes a strain called MantaxOtax to Indonesian threat actors. MantaxOtax combines ransomware, spyware and device control in a single package.
Once it has secured extensive permissions, it can steal messages, credentials, location, contacts, browser history and screen recordings, while also taking photos and monitoring apps. On older Android versions it can encrypt files and demand payment; newer versions limit its reach because of Android’s Scoped Storage.
Attackers can remotely lock screens, block apps, and disrupt devices with intrusive alerts and overlays. The malware uses GitHub to locate changing command-and-control infrastructure. InfoSecurity Magazine reported the findings.
The second report, from Group-IB and also published on Wednesday, concerns the Gigabud banking trojan. Gigabud now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it, hiding the trojan from the banking app’s own malware checks.
As a remote access trojan, Gigabud gives its operator live control of the phone. It has been active since 2022 and is linked to a group Group-IB calls GoldFactory, which reaches phones via a fake app posing as a national airline, a tax office or a government portal, installed from outside the official store. The Hacker News carried that report.
What to watch
The NetScaler warning is the one with the shortest fuse. Appliances configured as a gateway or AAA virtual server should be checked against the August 19 patch, and the fact that CISA has now confirmed in-the-wild exploitation means the window for unpatched systems is closing fast. On the mobile side, the technical reality is that both MantaxOtax and Gigabud depend on users installing software from outside official channels.
As ever, the detail that matters is where the app came from.
