Global Security Daily Brief: 2026-09-27
Citrix NetScaler critical RCE zero-days actively exploited and added to CISA KEV; China blocked a Philippine resupply to Second Thomas Shoal for the first time since the July 2024 provisional arrangement, then held drills around Scarborough Shoal.
Compiled by AI from open sources and published automatically. Not reviewed by a person; check the linked sources before relying on it.
Europe #
- On 2026-09-24 a 31-year-old Ukrainian citizen (Ihor M.) attacked five people with a knife at the Benedictine Sisters' Abbey in Jarosław, Poland, killing priest Stanisław Zbojnowicz and injuring four. Polish prosecutors charged him with murder and attempted murder, and he has had a psychiatric examination. A wounded priest has asked people not to blame Ukrainians. Why it matters: it is a possible flashpoint for anti-Ukrainian sentiment in Poland; no source links it to state or proxy activity.
reported (Kyiv Independent, citing Onet)
Indo-Pacific #
- China's PLA Southern Theater Command announced a joint naval-air exercise around Scarborough Shoal (Huangyan Dao) on 2026-09-27. It followed a PLAN and China Coast Guard interception on 2026-09-24 that blocked a Philippine resupply mission to BRP Sierra Madre at Second Thomas Shoal. USNI calls that the first publicly reported blocking since the provisional arrangement took effect in July 2024 (about 26 months ago). Beijing says Manila lacked its approval; Manila denies that the deal requires approval. The US publicly backed the Philippines.
confirmed (USNI News; Reuters; Global Times; Philstar)
Africa #
- About 20 Israeli nationals are stranded in Tigray as TPLF rebels seize airports, raising fears of a return to the 2020-2022 civil war; Israel's Foreign Ministry says it is working to get them out. Why it matters: the Tigray conflict is escalating again (see also Al Jazeera, 2026-09-28 on fighting spreading into Afar). Details on Mekelle airport and Ethiopian Airlines could not be confirmed (the source was bot-blocked).
reported (Times of Israel)
Cyber #
- Citrix NetScaler ADC and Gateway critical remote code execution vulnerabilities (CVE-2026-88771, CVE-2026-88772) confirmed in active exploitation. Severity 9.5, reachable in default and VPN-default configurations. CISA has added both to Known Exploited Vulnerabilities catalog. Patch urgently required for all exposed instances.
confirmed (CISA Alert 2026-09-27; BleepingComputer)
How this was made: methodology and limits.