Intel Chat: NetScaler pre-auth RCE, OpenAI agents DDoS Wikimedia, MonsterCloud & ShinyHunters [351]

Intel Chat with Matt Bromiley and Chris Luft.

• Citrix NetScaler pre-auth command injection, CVE-2026-88771 (CVSS 9.5). watchTowr Labs diffed vulnerable and patched builds and found the bug not in the Packet Engine but in a Perl maintenance script that hunts for crash dumps: it pulls data out of diagnostic logs and drops it into a shell command unvalidated. Put a payload in the username field of an unauthenticated login, NetScaler logs it, and the script later runs it as root (headers and request parameters work too, and execution can lag up to 24 hours). Default configurations are affected and it was exploited before a patch existed; it's one of eight fixes in the Citrix advisory, alongside a second exploited memory overflow. Fixed in the 13.1 and 14.1 branches. Chris: forget the old Perl script, the real failure is not scrubbing input. Matt: if you run these appliances, go read the advisory and patch, or take the service offline.
• OpenAI's autonomous agents caused a partial Wikimedia outage. Per Dark Reading, Wikimedia found unauthorized edits to its wiki sandboxes, a citation tool reconfigured to work as a proxy to external services, failed attempts on its Etherpad, and hundreds of thousands of queries against the Wikidata Query Service, which likely caused a partial outage in May. CTPO Selena Deckelmann confirmed the incidents; none of the agents were approved bots. Matt's read: call it what it is, a DDoS. No model wakes up and decides to attack a wiki. "If you were allowed to escape a sandbox, it's because someone put a ladder there for you," and putting a brick on the accelerator and stepping out of the car is not a defense. Chris: what happens when open-weight models on home GPUs can do the same? Do agents end up needing license plates?
• MonsterCloud's owner charged with selling "proprietary decryption" that was really paying the ransom. Prosecutors say Zohar Pinhasi (aka Zack Silver and Zack Green) negotiated with the same groups that hit his clients and bought the keys, paying more than $8 million and billing victims more than $19 million. In one case $8,200 to an affiliate became a ~$150,000 invoice. He faces wire fraud and wire fraud conspiracy charges. Matt: he was one honest sentence away from being a legitimate negotiator, so vet whoever you hire to negotiate.
• Alleged ShinyHunters leader arrested in Jordan and cooperating with the FBI. SecurityWeek identifies him as Saif al-Din Khader ("Rey"), a teenager from Amman also tied to Scattered Lapsus$ Hunters, arrested shortly after the group defaced the FBI's recruitment site and claimed 2-3 TB of data. Dutch police separately arrested a 24-year-old in Amsterdam the FBI ties to attacks on 140+ organizations and at least $70 million in extortion; reporting names him as Pepijn van der Stap. Brian Krebs reports Khader put an Umbreon image on the defaced FBI site, van der Stap's old nickname, apparently to point investigators at him. Chris: don't poke the bear, and there's no honor among thieves.

Stories covered:
• https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
• https://www.darkreading.com/cyberattacks-data-breaches/openai-agent-escape-causes-wikimedia-service-outage
• https://www.securityweek.com/fake-decryption-tools-masked-11m-markup-in-ransomware-recovery-scheme/
• https://www.securityweek.com/alleged-shinyhunters-leader-arrested-in-jordan/

Chapters:
0:00 Seasons change, and the cost of software goes to zero
1:59 Home computers are going to be a target again
2:38 "It's darkest before it goes pitch black"
3:25 Citrix NetScaler pre-auth command injection (CVE-2026-88771)
6:04 Forget the old Perl script, scrub your input
7:00 If you're a defender: read the advisory and patch
9:24 Please don't write blog posts like this
9:50 OpenAI agents cause a Wikimedia outage
13:16 What happens when everyone sends agents across the web?
13:40 "ChatGPT launched a DDoS attack"
16:58 No LLM ever woke up and decided to attack a wiki
17:38 "Someone put a ladder there for you"
18:19 When open-weight models can do this at home
19:45 "My LLM went crazy" is not a defense
20:15 A driver's license for the internet?
20:52 MonsterCloud: ransomware recovery that just paid the ransom
23:53 A middleman with an 18x markup
26:17 Vet your negotiator
26:44 Alleged ShinyHunters leader arrested in Jordan
28:49 The Umbreon frame-up
29:31 No honor among thieves
32:08 Maybe biweekly is the way to do it

The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.

Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio

Learn more about LimaCharlie: https://limacharlie.io

#cybersecurity #infosec #ransomware #AIsecurity #threatintel