Security Signal Weekly: September 26-October 2, 2026

OverviewThis week’s urgent work sits inside systems that defenders and IT teams already trust: Citrix access gateways, Cisco’s SD-WAN manager, a help-desk platform, secure email appliances, remote support clients, and security products protecting a cryptocurrency exchange. Several of those systems were not merely vulnerable. Attackers had already used them to gain administrative or root access, deploy persistence, or reach high-value internal services.The practical distinction is between installing a fix and deciding whether the system is still trustworthy. For Citrix, Cisco, Zammad, Kiteworks, and the third-party appliances in the Bitget investigation, the maintenance ticket needs an incident-response branch whenever the exposed period, logs, or indicators justify it. The other stories reinforce the same point from different angles: credentials remain valid after code is cleaned up, personal data keeps its value long after collection, and faster discovery is compressing the time…