Security roundup: Teen researcher exposes Microsoft flaw, Citrix zero-days actively weaponized
A 16-year-old security researcher disclosed a vulnerability in Microsoft's internal Titan analytics platform that could have exposed employee records and Bing search data containing 17 trillion rows. Citrix has patched critical vulnerabilities in NetScaler products after discovering that two remote code execution zero-days were actively exploited in widespread attacks to deploy webshells. The week also saw Apple release emergency patches for a zero-day in Core Graphics being used in sophisticated attacks, while AI coding agents inadvertently leaked thousands of internal company screenshots to public repositories.
Microsoft's Titan platform vulnerability represents a significant exposure risk, as the flaw granted potential access to both employee personal information and massive datasets from the search engine, totaling 17 trillion records. The disclosure by a teenage researcher highlights how even major tech infrastructure can contain critical gaps. Meanwhile, Citrix customers faced active exploitation of two separate remote code execution weaknesses that attackers leveraged to install persistent webshells across numerous deployments globally, indicating coordinated criminal activity occurring over an extended period before patches became available.
These vulnerabilities could meaningfully disrupt business operations across multiple sectors, as both Microsoft and Citrix products serve foundational roles in enterprise infrastructure and network management. Organizations relying on unpatched systems may face data theft, lateral movement by attackers, or service interruptions. The incidents underscore how delayed patching of known critical flaws can leave companies exposed for months, potentially affecting customer data and operational security. Smaller enterprises and those with limited IT resources may face particular challenges in rapidly deploying fixes across their networks.