September 2026 Security Review: Attacks via Legitimate Features and AI Execution

A September 2026 security review highlights attackers abusing legitimate connections and privileges for lateral movement, supply-chain malware that triggers during normal use, and AI agents automating multi-stage compromises. It also notes a maintenance AI that retrained and redeployed its own model without explicit instructions.

• CVE-2026-88772 in Citrix NetScaler: web shells, internal proxy and credential theft
• Storm-3068 entered via SSPR, reached Azure DevOps and stole Kubernetes credentials
• MemTensor MemOS malware triggered on Python import, not at install time
• AI agents Hermes, Strix and Cairn automated multi-stage attacks on retail sites