Thilan Hewage
← All digests

🔎 Research Digest — 2026-09-28

Executive signal:

  • Citrix confirmed active exploitation of two NetScaler RCE zero-days (CVE-2026-88771, CVE-2026-88772, CVSS v4 9.5); CISA amplified and added both to KEV (27 Sep).
  • Federal KEV deadline today (28 Sep 2026) for actively exploited SharePoint CVE-2026-65660 and MikroTik RouterOS CVE-2026-67279.
  • Microsoft’s Storm-3168 / JADEPUFFER write-up remains the week’s clearest Azure workload-identity destruction case (compromised service principals, ~7-minute wipe window).
  • US cash equities still on last regular close Fri 25 Sep 2026; crypto weekend print BTC ~$84.6k / ETH ~$2.7k (not trading-grade).

🎯 Today's Priority

💹 Markets & Macro

  • Fact: US cash equities last regular session close remains Fri 25 Sep 2026 (weekend/holiday gap into Monday open). Reported Friday closes: Dow Jones Industrial Average 51,828.62 (+0.93%), S&P 500 7,743.41 (+0.51%), Nasdaq Composite 27,068.72 (+0.48%). Sources: Reuters via LSE, 25 Sep; Dean Financials Market Pulse, 25 Sep.
  • Fact: Same Friday session: CME FedWatch-linked commentary put ~66% odds on another 25 bp hike at the 27–28 Oct FOMC (up from ~50% earlier in the week); 10-year Treasury yields were cited near ~5.20%. Source: Reuters via LSE; Kalshi news note, 25 Sep.
  • Fact (crypto print, not trading-grade): A Sunday 27 Sep market wrap placed Bitcoin near $84,601 (+0.65% 24h / +5.34% 7d) and Ethereum near $2,713 (+0.85% 24h / +5.32% 7d), after an earlier weekly print above ~$87k. Source: CryptoTicker, 27 Sep.
  • Interpretation: Equities finished the week firmer on AI/tech leadership while long yields and October-hike odds stayed elevated — speculation that rate-path risk still caps multiples even when weekend crypto holds the weekly gain.

🤖 AI & Agents

  • Fact: Microsoft Foundry (24 Sep Azure Blog) expanded model choice with the GPT-6 family (including Sol and Luna) and Claude Opus 5.5 available for evaluation/production in Foundry, plus voice agents in public preview (native spoken interaction across web, Teams, Teams Phone, and Twilio telephony paths). Source: Microsoft Azure Blog, 24 Sep.
  • Fact: Same Foundry update: Routines in Foundry Agent Service are generally available for scheduled, delayed, or event-driven agent runs; Agent-to-Agent (A2A) and tool search in Toolboxes are also called out as generally available; long-running hosted-agent resilience is in public preview. Source: Microsoft Azure Blog.
  • Fact: Microsoft described run-assert-eval as an open workflow chaining Clarity → ASSERT → Agent Control Specification to discover agent risks, generate runtime policy, and re-measure. Source: Microsoft Command Line, 24 Sep.
  • Interpretation: Platform messaging is shifting from “chat agents” to scheduled/event-driven production agents with identity, egress, and evaluation controls — the same operational surface Storm-3168 shows adversaries can automate against.

☁️ Cloud & 🛠️ DevOps

  • Fact: Microsoft Security Research (25 Sep) documented Storm-3168 (JADEPUFFER) using two compromised Azure service principals: ~15.5 hours of reconnaissance (300+ reads), then a ~7-minute destructive window with 100+ storage-account deletion attempts, plus Key Vault / Function App / App Service plan deletions and failed SQL deletes (unsupported API version). Resource locks and storage deletion protection blocked some deletions; ListKeys followed for credential collection. Possible initial access: client secret previously exposed in a public GitHub issue edit history. Primary: Microsoft Security Blog.
  • Fact (ops guidance from the same report): Rotate exposed secrets immediately (editing/redacting public posts does not invalidate them); enforce least privilege on workload identities; protect backup/recovery locks; enable relevant Defender for Cloud plans (Resource Manager, Storage, Key Vault, App Service, Databases).
  • Fact (casino / slots systems): G2E 2026 opens in Las Vegas 28 Sep–1 Oct. Quick Custom Intelligence (QCI) is demonstrating QCI Metrics (Booth #2440): next-day industry performance data across nearly 100,000 gaming machines for QCI customers, with theme-name normalization and feed-back into QCI Slots recommendations. Traditional industry reports can lag by up to six weeks. Sources: GlobeNewswire, 14 Sep; Gaming Americas, 23 Sep.
  • Interpretation: Highest-signal Azure admin lesson remains assumption of service-principal compromise: CanNotDelete locks and backup-protection boundaries matter when Contributor-class identities run at machine speed.

🔐 Cybersecurity

  • Fact: On 27 Sep 2026, Citrix/Cloud Software Group published bulletin CTX697096 for eight NetScaler ADC/Gateway flaws. Actively exploited: CVE-2026-88771 (improper input validation → unauthenticated command execution; affects all deployments including default config; CVSS v4 9.5) and CVE-2026-88772 (memory overflow → RCE/DoS when DTLS is enabled; CVSS v4 9.5). Fixed builds include 14.1-73.37 and 13.1-64.23 (plus FIPS/NDcPP branches). CISA alert confirms global exploitation reporting and KEV listing for both CVEs; preserve forensics before patching if compromise is suspected. Sources: CISA alert, 27 Sep; Citrix CTX697096; The Hacker News, 27 Sep.
  • Fact: CISA KEV items with FCEB remediation due 28 Sep 2026: CVE-2026-65660 (Microsoft SharePoint code injection / RCE; Microsoft noted observed exploitation as of 25 Sep 2026) and CVE-2026-67279 (MikroTik RouterOS improper enforcement of behavioral workflow). Coverage: The Hacker News; SecurityWeek, 27 Sep; CISA KEV catalog.
  • Fact: Storm-3168 Azure destruction/credential collection (above) is treated by Microsoft as consistent with ransomware/extortion-aligned tactics; no ransom note or confirmed exfiltration observed in the described activity. Primary: Microsoft Security Blog.
  • Interpretation: Near-term patch/ops focus: internet-facing NetScaler ADC/Gateway to fixed builds, SharePoint Server for CVE-2026-65660, exposed MikroTik RouterOS, and Azure service-principal secret hygiene + resource locks as today’s KEV deadline hits.