Tekin Night Sept 28, 2026: 3,200 Xbox Layoffs & Citrix Zero-Days

A tense night in the tech world unfolds. Microsoft is laying off thousands from Xbox while calling it great streamlining, two critical zero-days in Citrix NetScaler are being actively exploited without patches, CISA added SharePoint and MikroTik vulnerabilities to KEV with urgent warnings, a CSRF flaw in Elementor allows arbitrary admin account creation, Lunex malware abuses AMD drivers to bypass security, and Tether with $114 billion in US Treasury holdings has made Washington dependent.

Microsoft Praises Xbox Streamlining as Thousands Get Laid Off

Microsoft CEO Satya Nadella called the restructuring process led by new Xbox CEO Asha Sharma "great to see" during a financial analyst meeting - just days after 268 more Xbox employees were laid off. This latest wave is part of a broader program eliminating 3,200 jobs (about 20% of total Xbox workforce) across fiscal years 2026 and 2027.

Nadella also stated he feels "fantastic" about Xbox IP portfolio and predicts the gaming division will grow in fiscal 2027 (July 2026 through June 2027). However, these statements come as some studios have been shut down and the next Halo game has been moved to Activision.

Gaming Community and Employee Reactions

These layoffs have triggered harsh reactions from the gaming community and former employees. Many laid-off workers have stated on social media that these decisions are not only ruthless but also strategically wrong. Some analysts believe Microsoft is destroying the very studios it paid heavily to acquire.

Meanwhile, Nadella emphasized in the financial meeting that Microsoft will continue investing in gaming, but with focus on efficiency and profitability. He also noted that Game Pass continues growing with subscriber count reaching 35 million.

Two Critical Zero-Day RCEs in Citrix NetScaler Under Active Exploitation

Security firm watchTowr issued an urgent warning on September 26: two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway allowing remote code execution (RCE) are currently being actively exploited in real attacks.

Interestingly, Citrix has not yet officially confirmed these flaws and has not released any patches or security updates. This situation has forced some system administrators who know their systems are at risk to decide to take their NetScaler servers completely offline while waiting for patches.

System Administrator Reactions and Attacker Tactics

In security forums and Reddit, system administrators have reported seeing active attempts to breach their NetScaler servers. Some of them, upon observing suspicious logs, decided to shut down the service until patch release - even if it means cutting off employee VPN access.

watchTowr has not published precise technical details of these vulnerabilities to prevent wider exploitation, but stated Citrix is working on patches. However, as of this writing (September 27), no official timeline for patch release has been announced.

CISA Adds SharePoint and MikroTik Vulnerabilities to KEV

The Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited security vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog on September 25, issuing urgent warnings for federal organizations.

The first vulnerability, CVE-2026-65660 with CVSS score 8.8, is a code injection flaw in Microsoft SharePoint Server affecting versions 2016, 2019, and Subscription Edition. This flaw allows an attacker with low-level access (authenticated user) to execute arbitrary code on the server.

The second vulnerability, CVE-2026-67279 with CVSS score 6.9, is an SSH protocol flaw in MikroTik RouterOS. This flaw allows an unauthorized attacker to bypass authentication, open session channels, and execute commands on the device.

Remediation Deadlines and Enterprise Impact

Per CISA directives, federal organizations must remediate these two vulnerabilities by September 27–28. This exceptionally short deadline reflects the severity and operational urgency of the situation. While Microsoft previously released patches for SharePoint, extensive telemetry indicates that numerous enterprises have not yet applied the updates.

MikroTik has likewise published stable RouterOS firmware updates. However, with millions of edge MikroTik routing appliances deployed across global SMBs and regional internet providers, automated patch distribution remains fragmented.

Elementor CSRF Flaw Allows WordPress Admin Account Creation

A high-severity Cross-Site Request Forgery (CSRF) vulnerability was discovered in Elementor Website Builder plugin for WordPress that could be exploited by an attacker to create arbitrary administrator accounts and gain complete control over the site.

This flaw has not yet received an official CVE but security researchers have assigned it a high CVSS score. The attack requires a site administrator to click on a crafted link while logged into the WordPress admin panel. After clicking, the attacker can create a new admin account without the admin noticing.

Exploit Mechanics and Protective Countermeasures

In a standard attack scenario, the adversary crafts an email or web landing page containing a seemingly innocuous hyperlink. When an authenticated WordPress administrator clicks the link while an active session exists in their browser, silent background requests are dispatched to create an unauthorized administrator account with arbitrary credentials.

Elementor has remediated this vulnerability in its latest release, and all site administrators must upgrade immediately. Furthermore, engineering teams should enforce the following safeguards:

• Never click on unverified links while holding an active administrative session
• Deploy endpoint web application firewalls such as Wordfence
• Regularly audit administrative user tables and privilege assignment logs
• Enforce hardware-backed multi-factor authentication (MFA/2FA) across all administrative accounts

Lunex Stealer Abuses AMD Driver to Disable Security

A sophisticated malware called Lunex Stealer (previously known as Psychedelic Stealer) has been discovered using an advanced technique called BYOVD (Bring Your Own Vulnerable Driver) to disable security systems.

This malware is distributed through compromised Ukrainian websites using fake Cloudflare verification pages (ClickFix technique). When victims click the "I'm not a robot" button, they actually execute a malicious PowerShell script that downloads and installs the malware.

Malware Capabilities and Infiltration Vectors

Lunex operates as a Malware-as-a-Service (MaaS) offering, enabling threat actors to lease modular build payloads. Key operational capabilities include:

• Exfiltration of browser credentials, autofill data, and cookies across 7 Chromium variants
• Harvesting non-custodial cryptocurrency wallet keys and local browser extensions
• Establishing persistent footholds through malicious Native Messaging Host registration
• Neutralizing kernel security telemetry by abusing an outdated signed AMD driver

Researchers at Ontinue who discovered the campaign note that Lunex is undergoing active feature expansion, with new payload variants released at a rapid cadence.

Tether's $114B Treasury Holdings Make Washington Dependent

In a shocking report, it was revealed that Tether, issuer of the world's largest stablecoin (USDT), held $114.96 billion in US Treasury bills as of June 30, 2026. This amount has made Tether one of the largest holders of US government debt.

To better understand this figure, let's compare: Tether has invested more in US Treasury than countries like Germany, South Korea, and UAE. This financial dependency comes as the Trump administration is considering an offshore stablecoin initiative that could expand dollar usage worldwide.

Impact on Sovereign Economic Policy

This massive liquidity concentration provides considerable financial leverage. If federal regulators enforce hostile enforcement actions against Tether, forced liquidations of Treasury reserves could introduce severe volatility into secondary debt markets.

Conversely, federal policy initiatives are actively evaluating offshore stablecoin frameworks to reinforce the US Dollar's position as the primary international unit of account.

Systemic Market Trajectory

While macro analysts express concern regarding systemic contagion in the event of an abrupt liquidation, institutional finance increasingly acknowledges that digital dollar stablecoins represent an indispensable pillar of modern sovereign debt absorption. The digital asset economy has definitively integrated into traditional global finance.

Conclusion: A Night of Challenges and Opportunities

Tonight we witnessed a mix of concerning news and strategic developments. On one hand, massive Xbox layoffs and unpatched security vulnerabilities show the tech industry faces serious challenges. On the other, Tether's penetration into the US financial system demonstrates crypto has become an undeniable force.

For security professionals, the message is clear: immediate patching, continuous monitoring, and awareness of new threats are essential. For system administrators, top priority must be remediating CVE-2026-65660 in SharePoint and CVE-2026-67279 in MikroTik. And for WordPress users, immediate Elementor update is unavoidable.