LinkedIn Carousel - #CyberWeekly Week 40

Somebody Else Has A Copy Of Your Key

A VPN box was picked before Citrix could cut a new key. Time to count the keys you handed out yourself.

Update your Citrix NetScaler now

The spare keys you forgot you gave out

A Belgian manufacturer, breached?

Your Wi-Fi access points need an update

Our training now counts as evidence

Easy Cyber Protection

1/5

Update your Citrix NetScaler now

The lock had a hole in it before anyone shipped a new key.

Today's question for your IT provider:

Two flaws, CVE-2026-88771 and CVE-2026-88772, both scored 9.5 out of 10. Citrix confirms both are being used in attacks, and the Belgian cyber centre (CCB) says plainly they were "exploited as zero-days before fixes were available." In plain terms: attackers found them first. One needs no password at all.
Both the CCB and its American counterpart CISA now list these as actively exploited. Researchers who found the flaws during real investigations describe attackers reading the VPN's own saved session data after getting in. They broke the lock, then copied the visitor log behind it.
Update, but check first. Because these were used before a fix existed, ask whether you were already broken into. Save the logs before updating: the update can wipe the traces of an earlier break-in. Then update anyway.

CCB warning: Citrix NetScaler flaws used in attacks before a fix existed (28 Sep 2026) → https://ccb.belgium.be/advisories/warning-citrix-netscaler-adc-netscaler-gateway-rce-vulnerabilities-actively-exploited

2/5

by Patch, our friendly house bot

— Patch, your friendly house bot

Patch, our house bot, writes: The story above ends with attackers reading the VPN's own saved sessions. That is the line I keep coming back to. Once they were in, they did not need to break the lock again.

3/5

A Belgian manufacturer, breached?

About twenty people, and a lock somebody else now claims to hold.

Is this you?

The window maker was not the only one this week. Three Belgian organisations appeared on ransomware leak sites in five days: also CENELEC, the Brussels-based European standards body (claimed by "Everest", 25 September), and a Belgian agri-food company (claimed by "SafePay", 28 September).
That ends a quiet stretch. The Belgian leak-site count sat still at 178 from 27 August onwards; it is 181 now. A quiet leak site never meant a quiet month. The last three issues carried that warning; this week shows it.
What limits the damage when your turn comes is dull. Backups you have tested by restoring a file; a log line saying "ran successfully" proves nothing. And a plan for how you would notice an intrusion.

Ransomware tracker: the listing by "the gentlemen" (29 Sep 2026, unconfirmed leak-site claim) → https://www.ransomware.live/country/BE

4/5

Your Wi-Fi access points need an update

Three more urgent warnings, same week.

WatchGuard wireless access points, two flaws scored 9.3. The CCB warned on 29 September that an attacker needs no password at all to run their own commands on an access point, or to take one over outright. No attacks have been seen using them yet. Update to firmware 3.4.8 or later while that is still true.
Zimbra email software: a flaw that runs inside a victim's own browser session while they are logged in (CCB warning, 28 September). Zimbra behind your email, or your IT provider's? Then it gets updated this week.
GitLab: critical flaws that let an attacker run their own commands on the code-hosting tool many developers and IT teams rely on daily (CCB warning, 24 September). Relevant if you run your own GitLab instance rather than the hosted version.

CCB warning: WatchGuard access point takeover flaws (29 Sep 2026) → https://ccb.belgium.be/advisories/warning-two-critical-vulnerabilities-which-can-lead-remote-code-execution-watchguard

5/5

Our training now counts as evidence

A finished course now leaves a record your auditor can read.

Finished training becomes evidence automatically. Every completed course now shows up, per person, against the "security awareness training" control in your compliance pack. You see who finished, who has not and who is due a refresher, and you can export it as one file with a checksum for your auditor.
MSPs enrol a client's people straight from that client's staff list: everyone, one group, or hand-picked names, with a personal link per person to send out. Nobody's inbox gets an email unless you choose to send one.

How the evidence works → https://easycyberprotection.com/learn/