Oops, all vulns! (Citrix NetScaler problems, the FBI ShinyHunters saga cont’d and MORE)

Welcome to The Low Down, the best show on the internet for hackers

Listen on Spotify!
https://go.lowdownpod.com/spotify

The Low Down is presented by Maze.
LinkedIn: https://www.linkedin.com/company/mazehq/
X: https://twitter.com/Maze_Security

Follow Us!
https://www.instagram.com/lowdown.pod

Heading to OneCon 2026? SentinelOne’s cybersecurity conference runs October 20–22 at the ARIA Resort & Casino in Las Vegas. Use code oc26lowdown for a discount on registration.
https://www.onecon.io/

00:00 Coming up
00:33 Intro and Matt’s SecTor keynote
02:52 Citrix NetScaler zero-days and disclosure
09:25 Breaking down the NetScaler exploits
19:04 Sponsor: Maze
20:41 Citrix’s response and responsible disclosure
25:06 Why edge devices are so hard to defend
30:54 MikroTik RouterOS vulnerabilities
35:33 Cisco SD-WAN authentication bypass
38:37 Zimbra command injection
42:22 ShinyHunters arrest and conflicting claims
50:42 Reacting to the FBI’s warning
55:05 Open-weight AI, Anthropic and GLM-5.3
1:07:35 Wrap-up and OneCon

Today we're talking about:

Your NetScaler Warning Came From Reddit
Finding out about NetScaler zero-days through Reddit is not the enterprise support experience Matt had in mind. Ed walks through watchTowr's command injection and memory overflow writeups, including missing protections in the binary they tested. Then we get into Google's hunting guidance and why a patch alone won't kick an attacker out.
https://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/
https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/
https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances

MikroTik and the User Named -2
MikroTik joins the pile with an HTTP underflow and a separate SSH authentication chain. The username "-2" showing up in attack logs gets our attention. Ed explains how assumptions between different parts of a system can become an exploit. Matt has been saying "don't roll your own crypto" for his entire career. Apparently we still need the reminder.
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/

Cisco's Admin API Lets the Wrong People In
A specially encoded request can give an unauthenticated attacker admin access to Cisco's SD-WAN Manager API. We talk about what that means for a corporate network, and the difference between connections that need to be public and management interfaces that don't. Cisco patched its managed cloud service. If you run an affected instance yourself, the upgrade is still your job.
https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-webauth-xr8beuuU.html

Zimbra: An Email Goes In, a Shell Command Comes Out
A crafted email can trigger command execution through Zimbra's SNMP notification system on affected configurations, without anyone clicking anything. We trace the route from incoming mail to a shell command and look at Microsoft's account of the attacks. Ed has a fairly blunt suggestion for developers: stop handing user input to Bash.
https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/

ShinyHunters Meets the FBI's Camera
Dutch police arrest an alleged ShinyHunters leader, and the FBI looks straight into the camera with a message for whoever's left. We untangle the arrest timeline, conflicting gang statements and the Pokémon branding. Matt brings us back to the PeopleSoft campaign and why following a group's methods is useful even when its PR is impossible to trust.
https://krebsonsecurity.com/2026/09/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigation/
https://www.fbi.gov/video-repository/shinyhunters-arrested-092926.mp4/view
https://www.securityweek.com/shinyhunters-defiant-after-fbi-calls-on-members-to-come-forward/
https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft

If the Attacker Gets AI, So Do I
Anthropic's GLM-5.3 report sets off a disagreement. If attackers get powerful, freely available models, Matt wants to know why defenders don't get the same advantage. Ed thinks the way our systems are built still favors the attacker. We get into reports of safeguards getting in the way of incident response, the incentives behind calls for regulation, and who we'd trust to write the rules.
https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities
https://huggingface.co/blog/security-incident-july-2026