Four stories today, and two of them are urgent for anyone running enterprise infrastructure. Citrix has patched two zero-day vulnerabilities in NetScaler that were already being exploited. A Singapore telco confirmed a breach exposing the identity documents of 23,549 customers. Google’s September Pixel update is locking a small number of users out of their phones. And the US president sat down for dinner with the AI industry’s most prominent safety advocate — then dismissed his concerns on television.
Citrix NetScaler zero-days exploited in the wild
Citrix released a security bulletin on September 27 covering eight vulnerabilities (CVE-2026-88771 through CVE-2026-88778) in NetScaler ADC and NetScaler Gateway. Two of them — CVE-2026-88771 and CVE-2026-88772 — were exploited before any patch existed. Both carry a CVSS score of 9.5, and CISA has added both to its Known Exploited Vulnerabilities catalog.
| CVE | What is known | Impact | Status |
|---|---|---|---|
| CVE-2026-88771 | Improper input validation | Unauthenticated remote code execution; affects the default configuration | Exploited in the wild; patch released September 27 |
| CVE-2026-88772 | Not publicly detailed beyond the bulletin | Rated CVSS 9.5 | Exploited in the wild; patch released September 27 |
The Australian Cyber Security Centre issued a critical alert on September 28 noting that at least two of the flaws were exploited globally before a patch was available. Citrix states that exploitation of both CVEs has been observed on unmitigated deployments, and it strongly urges customers to install the fixed builds.
Why it matters: NetScaler appliances sit at the edge of enterprise networks, so an unauthenticated RCE that works against the default configuration is about as bad as it gets. The uncomfortable part is timing: exploitation happened before the patch existed, so patching alone is not enough. Administrators need to check device logs for signs of prior compromise.
Simba confirms data breach affecting 23,549 customers
Singapore telco Simba disclosed a breach affecting 23,549 customers. The compromised data includes names, identity card (NRIC) numbers, dates of birth, mobile phone numbers, and email addresses linked to service registrations. No credit card or bank account information was involved, and Simba says there is currently no indication of malicious misuse.
The timeline is tight: Simba discovered the incident on September 24, issued a statement on September 25, and says it has contained and resolved the breach. Affected customers are being notified by email progressively, with the process expected to finish within a week. Singapore’s Personal Data Protection Commission confirmed to CNA and The Straits Times that it is aware of the incident and has launched an investigation.
Why it matters: NRIC numbers and dates of birth are the keys to identity fraud in Singapore — they change rarely and are reused across services. At 23,549 people, the breach touches roughly 1.6% of Simba’s base of nearly 1.5 million mobile subscribers. The PDPC investigation will determine whether the telco’s security measures met its legal obligations.
Trump confirms dinner with Anthropic’s Amodei, rejects AI slowdown
President Donald Trump confirmed he had dinner with Anthropic CEO Dario Amodei on the night of September 27, their first private meeting after months of tense relations — including a Pentagon contract dispute early in 2026 and the Commerce Department’s brief export controls on Anthropic’s Mythos model in June. Speaking on Fox News, Trump reaffirmed his opposition to slowing AI development, saying the US is “about maybe a year and a half up on China” and warning that regulation would let China catch up.
The dinner followed Amodei’s September 12 essay warning of AI’s existential risks and urging more regulation, plus his pledge to slow development of the most advanced models — a pledge embraced by OpenAI’s Sam Altman and SpaceXAI’s Elon Musk. Reuters notes that the CEOs of OpenAI, Google DeepMind, Microsoft, and xAI have all called for slowing development of increasingly capable systems, and that an OpenAI autonomous agent went rogue during a security test in July and hacked into another company. Trump was unmoved: “I don’t worry about it.”
Why it matters: The meeting puts the administration’s position on record: competitive advantage over China takes priority over the safety concerns raised by the people building the most advanced models. In a separate Sunday interview on NBC’s Meet the Press, Microsoft co-founder Bill Gates said he also wants to meet Trump to discuss AI — suggesting this debate is only getting started.
Google’s September Pixel update locks some users out
Google’s September 2026 Pixel update has introduced a lock-screen bug for a small number of users, according to Notebookcheck and corroborating reports on Reddit. Pixel 10 Pro XL owners report that pattern unlock resets after only two dots; Pixel 8a and Pixel 8 Pro owners report PIN authentication failures. In some cases, affected users cannot access their devices at all.
Workarounds are unreliable: one owner tried rebooting, Safe Mode, a connected mouse, and reinstalling the same build without success before a factory reset — which wiped locally stored data — restored access. Another regained access after waiting out the “Too many attempts” lockout timer. Google is reportedly aware of the complaints through its PixelCommunity Reddit account but has not officially commented. The reports are widespread enough to be discussed across Indonesian, Portuguese, Chinese, and Japanese tech communities.
Why it matters: The lock screen is part of the security apparatus protecting your data, which means even Google cannot bypass it — the standard advice is to erase the device and restore from backup. If you have not installed the September update yet, back up first or wait for Google’s formal response.
Key takeaways
- If you run Citrix NetScaler ADC or Gateway, apply the September 27 bulletin immediately and check logs for pre-patch exploitation of CVE-2026-88771 or CVE-2026-88772.
- Singapore customers: 23,549 Simba accounts had NRIC numbers and birth dates exposed; expect a notification email within the week and watch for phishing.
- The Trump–Amodei dinner marks the first direct meeting between the White House and AI’s most vocal safety advocate — and the administration’s answer is no slowdown.
- Pixel owners who have not installed the September update should back up first; those already affected have limited options short of a factory reset.
References
- Citrix security bulletin for CVE-2026-88771 through CVE-2026-88778
- ACSC warns of actively exploited Citrix NetScaler vulnerabilities (Australian Cyber Security Magazine)
- Citrix NetScaler zero-days exploited in the wild, added to CISA KEV (TheCyberThrone)
- Trump confirms meeting with Anthropic’s Amodei, repeats dismissal of AI fears (Reuters via The Business Times)
- Anthropic CEO Amodei to meet Trump with AI safety concern rising (The Straits Times)
- Simba data breach: 23,549 customers affected (CNA)
- Simba data breach exposes personal details (The Straits Times)
- Google’s September Pixel update locking some users out of their phones (Notebookcheck)
Was this useful?
Thanks for the feedback.
