Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited

This week's security digest highlights a teenage researcher who uncovered a flaw in Microsoft's internal analytics tool Titan, potentially exposing employee data and Bing search analytics across 17 trillion rows. Citrix also patched eight NetScaler ADC/Gateway vulnerabilities, including two zero-days (CVE-2026-88771 and CVE-2026-88772) that attackers—possibly state-sponsored—had already been exploiting for weeks to deploy webshells on exposed devices. Elsewhere, Apple fixed an actively exploited Core Graphics zero-day (CVE-2026-86950) in iOS and macOS, Cisco disclosed its fifth SD-WAN zero-day of the year (CVE-2026-76504), and Fortinet warned of in-the-wild attacks against a FortiMail zero-day (CVE-2026-104286). The roundup also covers the FBI's job portals staying offline after a ShinyHunters breach claim, an AI-agent attack exploiting Zammad zero-days against DIVD, and the arrest of a 16-year-old suspected KillSec ransomware leader.