📝 Show notes
CyberAware Daily — 2026-09-28
Citrix NetScaler is dealing with two zero-day flaws that are being actively exploited, and there is no patch yet. This is one for IT teams running that kit, not home users. If your workplace or your managed IT provider uses Citrix NetScaler, ask them today what interim mitigations are in place. Patch Tuesday is on the way next month. If your devices update automatically, leave them to it, and if they don't, switch that on this week. DarkWatch is tracking 10 active leak site targets, including DragonForce and LockBit. If you get an email claiming your data was found on a leak site, treat it as a scam and contact the company directly. This week's theme: attackers lean on the gap between a flaw being exploited and the fix arriving. Closing that gap is mostly about patching and passwords. One thing to do this week: spend ten minutes turning on automatic updates for every device in the house.
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Monday 28th September and this is CyberAware UK, the show that helps British families stay
one step ahead of the scammers. I am joined by Alex. Morning, Alex.
Morning. So it's the week ahead episode, and there's a lot on the radar this week.
Where do we start? Let's start with the one that matters most right now,
and that's Citrix NetScaler. Security researchers have flagged two zero-day flaws being actively
exploited in the wild, and there's no patch yet. When you say no patch yet, who actually needs to
worry about that? Because most of our listeners aren't running a data center in the spare room.
Right. This is squarely one for IT teams at larger organizations, the sort of kit used by companies,
hospitals, councils, and universities to let staff log in remotely.
If you're listening at home, this isn't something you can or should fix yourself.
So what should someone do if they're a small business owner with a managed IT provider,
or if they work somewhere that uses this?
Simple. Ask the question. Ring your IT provider or your IT department today and ask whether you're
running Citrix NetScaler and what interim mitigations are in place. That's a two-minute
phone call and it's the right one to make. And vendors like Citrix usually publish temporary
workarounds before a permanent fix lands. Reviewing those is the interim step while everyone waits for
the update. Exactly. Now, looking further into this week, we've got Patch Tuesday coming on the second
Tuesday of next month, and that preview is already out. Expect the usual large batch from Microsoft,
plus fixes from Adobe. We talked about the Microsoft preview last week. So let's not repeat the detail,
but the practical thing is this. If your devices are set to update automatically, just leave them to
it. And if they're not, or if you've been putting off switching that on, this is the week to do it.
It sounds boring. It's genuinely one of the best things you can do.
What else is on the radar? I saw the dark watch numbers this morning.
60 days of tracking, over 55,000 captures, and 10 active targets still listed.
Yes, and there are a few familiar ransomware names showing up on leak sites this week.
Dragonforce and Lockbit both have active pages, and there's a new one we've not seen before sitting
alongside them. What does that actually mean for a normal household though? I always want to be clear
on who is actually affected when we mention leak sites. Fair point. Leak sites are where criminals
dump stolen data after a company refuses to pay. That's a problem for the organizations involved and
their customers. It's not something you can log into or stumble across by accident, and we won't be
sharing any of those web addresses. So what should a household take from it?
If you get an email saying your data was found on a leak site and you need to click a link to check,
that's a scam almost every time. Delete it. If you're genuinely worried, contact the company
directly using a number you find yourself. Let's talk about the pattern across this week,
because there is one. Flaws that are already being used get fixed late,
and the criminals lean on the gap in between. That's the shape of it. Every week it's the
same story in a different outfit. Unpatched software, an old password, a link somebody trusted
too quickly. Which brings us nicely to the bit I always like, the one thing to do this week.
Here it is. Set aside 10 minutes this week and turn on automatic updates for every device in the
house, your phone, your laptop, your tablet, and your router if it has the option. Then go make a brew.
10 minutes, automatic updates on, and you're better protected than most of the country.
Nice way to start the week.
That's it from us. New episode tomorrow. Stay sharp, stay kind, and look after each other.