Research · 16 October 2026 · Image: Zscaler Zscaler’s ThreatLabz has published an analysis of CVE-2026-88771, a critical remote code execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway that carries a CVSS v3.1 score of 9.8.
October 14, 2026 TL;DR The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.
The AICPA released a practice guide to help auditors apply current standards to the use of artificial intelligence in financial reporting and audits. The guide explains how an entity's reliance on AI affects acceptance decisions, risk assessment, and the understanding of internal controls. It highlights specific risks such as model drift, data governance issues, and…
A China-linked threat actor known as Armory Castle exploited a BeyondTrust vulnerability as a zero-day starting in August 2026. The flaw, identified as CVE-2026-102764, allowed attackers to perform file operations on Remote Support appliances. Mandiant and Google Threat Intelligence Group observed the group deploying custom tools to gain root access and exfiltrate sensitive documents. BeyondTrust…
State economists are scheduled to meet on March 14 to update general revenue estimates. This update is a key step for lawmakers preparing to negotiate the 2025-2026 fiscal year budget. The meeting, known as the Revenue Estimating Conference, will occur 10 days after the regular legislative session begins. General revenue, primarily from sales taxes, funds…
The Department of the Treasury announced a meeting for the Treasury Borrowing Advisory Committee on November 3, 2026. The session will take place at 10:45 a.m. at the Treasury Department headquarters in Washington, DC. Officials will seek advice on the economy, financial markets, and debt management strategies. The meeting is closed to the public to…
The American Institute of CPAs and CPA.com announced new enhancements to the Dynamic Assurance Solution suite on October 14, 2026. The updates include expanded industry content, group audit capabilities aligned with SAS No. 149, and support for interim review engagements. A new module called DAS 11-K was also launched to support dual-compliance work for Form…
The Defense Finance and Accounting Service awarded Ernst & Young two labor-hour contracts totaling up to $869.4 million to audit financial statements for the Navy, Marine Corps, and Air Force. Both solicitations were formally competitive but received only one quote each, with the awards announced on October 8, 2026. The Navy contract, valued at up…
Google warned on October 15 that organizations should prepare for widespread exploitation of a new bug in BeyondTrust remote support appliances. The vulnerability, identified as CVE-2026-102764, allows unauthenticated attackers to gain host-level control and access stored credentials. Mandiant found evidence that the suspected Chinese state-sponsored actor Armory Castle exploited the flaw in late August. The…
The Bureau of the Fiscal Service now screens federal payments to confirm bank account ownership and taxpayer identification details. This system, operational since September 30, 2026, has returned approximately 13,500 payments totaling $175 million intended for deceased individuals. Treasury Secretary Scott Bessent stated the initiative shifts the focus from recovering funds after payment to preventing…