# This Week in Identity, Issue 16 Source: https://startwithidentity.com/newsletter/2026-10-06-this-week-in-identity-16/ Last updated: 2026-10-16 License: content by Start with Identity. Cite the source URL. --- Issue 16 of This Week in Identity. The week's identity surface was the login path itself: the SAML endpoint on an edge appliance, a patch nobody applied on a third-party platform, and a phishing kit run by a person watching the victim type. ## In brief - CVE-2026-88779, a memory overflow in NetScaler ADC and Gateway reachable only when the appliance is a SAML service provider or identity provider, was exploited before the fix and added to CISA's KEV catalog on October 4. Appliances patched in late September for CVE-2026-88771 and CVE-2026-88772 needed a second upgrade. - The FBI says the ShinyHunters breach of its employee data came from a contractor who failed to apply a patch on a third-party-managed platform. Reuters, citing sources, names the platform as Oracle PeopleSoft and the firm as Accenture. - NIST launched an implementation hub for SP 800-63-4 on October 6, with version 0.1 conformance criteria in Excel, PDF and OSCAL. It adds no new requirements, and NIST does not certify against the criteria. ## The big story **The NetScaler SAML endpoint was exploited, and the September patch was not enough.** Cloud Software Group published bulletin CTX697174 on October 3 for CVE-2026-88779 (CWE-119, CVSS v4.0 8.7), a memory overflow it rates as denial of service. It is reachable only on appliances configured as a [SAML](https://startwithidentity.com/glossary/saml/) service provider (`add authentication samlAction`) or identity provider (`add authentication samlIdPProfile`). Citrix said it had observed targeted attacks, and CISA gave federal agencies until October 7. Fixed builds are 14.1-73.41 and 13.1-64.28. Administrators logged SAML login attempts whose usernames carried shell commands, followed by `nsaaad` crashes, but no one has publicly confirmed code execution through this flaw. Why it matters: an appliance acting as the SAML identity provider holds the signing key that every relying party trusts to say who a user is. A crash today is a warning about where the next bug lands, and code execution on an IdP-mode box would put that key in reach. Check every NetScaler for `samlIdPProfile` and `samlAction`, confirm the running build rather than the update history, and keep management interfaces off the internet. Two days after this issue's window closed, Citrix disclosed a second SAML-path flaw that raised the floor again; Issue 17 covers it. Source: [Exploited NetScaler SAML zero-day forces a second upgrade](https://startwithidentity.com/blog/2026-10-03-exploited-netscaler-saml-zero-day-forces-second-upgrade-after-september-patch/). ## Patch this week - **CVE-2026-88779**, NetScaler ADC and Gateway in SAML SP or IdP mode. CVSS v4.0 8.7, exploited, on KEV since October 4. Upgrade to 14.1-73.41 or 13.1-64.28 at minimum, including appliances already moved to 14.1-73.37 or 13.1-64.23 in September. [Brief](https://startwithidentity.com/cves/cve-2026-88779/). ## The pattern Two of the week's stories were MFA that existed and did not matter. The fake AI ad portals let a live operator choose which MFA challenge the victim saw next, SMS code, authenticator code or Okta push, and relayed each answer as it arrived. Copilot CLI never touched an MFA prompt at all: it read a `.env.prod` file and sent it to an attacker's URL, because the credentials it could reach were already sitting on disk. One is a person being relayed, the other an agent being instructed. The fixes differ, an origin-bound factor for the first and no long-lived secrets on disk for the second, but neither is "turn on MFA". See [AitM phishing proxies](https://startwithidentity.com/techniques/aitm-phishing-proxy/), [OTP relay](https://startwithidentity.com/techniques/otp-relay-social-engineering/) and [agent instruction injection](https://startwithidentity.com/techniques/agent-instruction-injection/). ## What else happened - **Fake ChatGPT, Gemini and Claude ad portals capture credentials and MFA codes**, according to Island. A browser-in-the-browser "Connect" window shows an accounts.google.com or [Okta](https://startwithidentity.com/vendors/iam/okta/) address bar while the real tab stays on the phishing domain. The targets are ad-account administrators, whose accounts hold payment methods and client access. Passkeys bound to the real origin would not have been relayed. [Post](https://startwithidentity.com/blog/2026-10-06-fake-chatgpt-gemini-and-claude-ad-portals-capture-credentials-and-mfa-codes/). - **An encrypted web page tricked GitHub Copilot CLI into leaking a `.env` file**, per Adversa AI, in 28 seconds with no confirmation prompt in autopilot mode. GitHub validated the report but does not consider it a vulnerability. Secrets in files an agent can read are secrets the agent can send. [Post](https://startwithidentity.com/blog/2026-10-06-encrypted-web-page-tricks-github-copilot-cli-into-leaking-env-secrets/). - **The FBI removed a contractor after a missed patch led to the ShinyHunters breach.** Reuters names [Oracle](https://startwithidentity.com/vendors/iam/oracle/) PeopleSoft as the platform; the FBI has not said which flaw was used. A third party's patch cadence is part of your identity perimeter when its platform holds your workforce data. [Post](https://startwithidentity.com/blog/2026-10-06-fbi-removes-accenture-contractor-after-missed-patch-led-to-shinyhunters-breach/). - **NIST opened an implementation hub for SP 800-63-4**, with FAQs on trusted referees and password managers, a subscriber-controlled wallet explainer, and conformance criteria in OSCAL that assessment tools can consume. A Digital Identity Risk Management tool is listed as coming soon. [Post](https://startwithidentity.com/blog/2026-10-06-nist-opens-implementation-hub-for-sp-800-63-4/). ## New from Start with Identity - **A [podcast directory](https://startwithidentity.com/podcasts/) with ten learning paths**, linking only to publishers' own episodes and transcripts, and a fix for stale data across the [conferences](https://startwithidentity.com/conferences/) directory. - **The [jobs board](https://startwithidentity.com/jobs/) refreshed with 42 verified roles**, with a weekly check that listings are still open. - **Five dead or broken official links replaced** in the [digital ID directory](https://startwithidentity.com/digital-ids/). ## From the community We are recruiting [volunteers](https://startwithidentity.com/community/#volunteer): news curators, country ambassadors, and jobs scouts. A few hours a week, credited by name. That's Issue 16. [Subscribe](https://startwithidentity.com/subscribe/) for the next one.