Daily Signal — 2026-09-28

This is FLLC's automated morning scan of named public sources. It is intentionally concise: what changed, why it may matter, what to verify next, and where the claim came from. 7/7 source systems were live for this edition.

At a glance

CVE-2026-88772 leads the latest CISA exploited-vulnerability entries.
CISA advisory watch: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway.
Official disclosure watch: Former Postal Worker Indicted After Allegedly Disposing of Hundreds of Mail-In Ballots in Utah.
M5.4 was the strongest M4.5+ event in the USGS 24-hour feed.
Starship | Starlink Group 31-1 (Starship Flight 14) is next on the public launch manifest.

Exploited vulnerabilities

CVE-2026-88772 — Citrix NetScaler. Added 2026-09-27; remediation due 2026-09-30. Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-88771 — Citrix NetScaler. Added 2026-09-27; remediation due 2026-09-30. Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-67279 — MikroTik RouterOS. Added 2026-09-25; remediation due 2026-09-28. Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEV priority queue

CVE-2026-88772 · Citrix NetScaler · added 2026-09-27 · due 2026-09-30
CVE-2026-88771 · Citrix NetScaler · added 2026-09-27 · due 2026-09-30
CVE-2026-67279 · MikroTik RouterOS · added 2026-09-25 · due 2026-09-28
CVE-2026-65660 · Microsoft SharePoint · added 2026-09-25 · due 2026-09-28
CVE-2026-87902 · WordPress Core · added 2026-09-25 · due 2026-09-28
CVE-2026-5430 · WSO2 Multiple Products · added 2026-09-24 · due 2026-09-27
CVE-2026-71362 · Adobe Commerce and Magento · added 2026-09-24 · due 2026-09-27
CVE-2026-93952 · Arista VeloCloud Orchestrator · added 2026-09-22 · due 2026-09-25

Defensive move: match the cited products against your actual inventory, follow the vendor remediation, and prioritize internet-facing or privileged systems. A catalog entry is evidence of exploitation in the wild—not proof that your environment is compromised.

Threat-actor and campaign watch

The current CISA advisory window contains no title or summary that explicitly names a threat actor, campaign, or ransomware operation.

Trace responsibly: preserve the source and timestamp, map only explicitly reported infrastructure and MITRE ATT&CK behaviors, separate observed facts from assessment, and record confidence. A vendor, geography, malware family, or IP address alone is not actor attribution.

Public disclosure / exposure watch

This desk surfaces newly public records and public reporting that may deserve investigation: declassified or unsealed material, FOIA/public-record releases, inspector-general findings, whistleblower reporting, breach disclosures, and exposed-system reporting. Selection into this section is not a truth score, political ranking, or endorsement. FLLC links to the public source of record and does not reproduce raw nonpublic source material.

Official newsroom matches

OFFICIAL SOURCE · U.S. Department of Justice: Former Postal Worker Indicted After Allegedly Disposing of Hundreds of Mail-In Ballots in Utah — 2026-09-22 12:00 UTC. An indictment was unsealed today charging a former postman with the U.S. Postal Service (USPS) with unlawful secretion, destruction, and delay of mail after he allegedly unlawfully threw away mail that he was entrusted to deliver – including approximately 300 mail-in ballots to registered voters in Utah.
OFFICIAL SOURCE · Federal Bureau of Investigation: Turkey-Based Global Director of Sham Charity Arrested and Charged with Conspiring to Provide Material Support to Hamas — 2026-07-31 15:58 UTC. A three-count complaint was unsealed today charging Mohammad Yousef Hasna, also known as “Orhan Korkmaz” and “Abu al-Baraa,” 45, of Istanbul, Turkey, with conspiring to provide material support to Hamas, a U.S. designated foreign terrorist organization (FTO), and related terrorism financing charges.

Publisher-direct leads

UNVERIFIED LEAD · Fox News U.S.: The frat omertà: Whistleblower warns of ‘code of silence’ after Ole Miss deaths, alleged Penn State coke ring — 2026-09-26 10:00 UTC. Publisher-direct reporting is a lead until independently corroborated.

Analyst rule: preserve the original URL and timestamp, distinguish OFFICIAL SOURCE from UNVERIFIED LEAD, corroborate extraordinary claims, and avoid republishing personal data or sensitive raw material that is not necessary to explain the public-interest finding.

Earth systems

M5.4 — north of Svalbard, 2026-09-28 13:22 UTC. The M4.5+ day feed contained 26 events when retrieved. Open the USGS event.
NOAA space-weather data was unavailable or malformed during this run.

Interpretation boundary: earthquake magnitude does not establish local impact, and Kp is planetary-scale context. Follow the issuing agency and local authorities for decisions.

Orbital watch

Starship | Starlink Group 31-1 (Starship Flight 14) — SpaceX; Payload Deployed; no-earlier-than 2026-09-28 12:48 UTC. Pad: Orbital Launch Pad 2 · SpaceX Starbase, TX, USA.

Launch times and status can move. Confirm with the launch provider before travel, viewing, or operational decisions.

Source health

CISA: live
ADVISORIES: live
USGS: live
NOAA: live
LAUNCHES: live
OFFICIALNEWSROOMS: live
PUBLISHERNEWS: live

Primary sources

Retrieved 2026-09-28 15:15 UTC. Automated, source-linked, and reviewed by machine rules for completeness. It is not emergency, navigational, investment, or legal advice.

Daily Signal: CVE-2026-88772, seismic activity, and the next launch