InfoSecBulletin Cybersecurity for mankind
Google has said that hackers are using two serious Citrix NetScaler security holes to get root access, set up hidden web shells, and enter victims’ networks. The activity has impacted groups in North America and Europe. This includes government, finance, technology, education, law, and professional services.
Mandiant Consulting and Google Threat Intelligence Group (GTIG) said the campaign started in early September 2026. The attackers are using CVE-2026-88772, a serious memory issue in Citrix NetScaler ADC and NetScaler Gateway, along with CVE-2026-88771, a problem that allows remote code to run due to bad input checks.
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
Citrix gave both flaws a CVSS score of 9.5 and said they are being actively used by attackers. CVE-2026-88772 impacts devices that have Datagram Transport Layer Security turned on, which is the default for VPN virtual servers.
Google said exploitation bypasses authentication and causes an unhandled termination of the NetScaler Packet Processing Engine, or NSPPE.
This allows attackers to access the main FreeBSD operating system. After taking control of a device, they change the httpd.conf settings of the web server so fake file types run as PHP.
Security teams must quickly update NetScaler systems that are affected. Citrix has fixed versions like NetScaler 14.1-73.37 and newer, and NetScaler 13.1-64.23 and newer; fixed FIPS versions are also ready.
Administrators need to check /etc/httpd.conf for weird AddHandler, AliasMatch, and PHP commands. They should look in VPN script folders for PHP code that is hidden in .deb or .sig files. Also, they should check for /tmp/.uxdport or /tmp/.uxdlock, which might show SLAPSHOT activity.
A setuid-enabled /bin/sh, unexpected NSPPE crashes, DTLS handshake failures, and unusual requests to /vpn/media/ or /vpn/scripts/ should be treated as high-priority compromise indicators.
GreyNoise saw attempts to exploit the weaknesses before Citrix announced them, including actions from 149.104.78.141 on September 24. This shows the ongoing risk from internet-facing devices, which usually don’t have endpoint detection and give direct access to sensitive internal systems.
| IOC Type | Indicator | Security Significance |
|---|---|---|
| Exploit traffic | UDP/443, DTLSv1.0 | Observed CVE-2026-88772 exploit traffic |
| NetScaler log | SSL_HANDSHAKE_FAILURE + DTLSv1.0 |
Possible malformed exploit traffic |
| Process crash | NSPPE crash |
Possible exploitation indicator |
| Watchdog log | pitboss NOT restarting NSPPE |
High-priority correlated signal |
| HTTP headers | HTTP_NSC_LDAP, HTTP_NSC_CLIENTTYPE |
Web-shell command delivery |
| HTTP headers | HTTP_X_UX, HTTP_X_UX_[0-9]+ |
WHIPSHOT C2 traffic |
| URI | /vpn/media/*.ico |
Possible hidden web-shell access |
| URI | /vpn/media/nsgclient.ico |
Known web-shell alias |
| Web-shell paths | /vpn/scripts/linux/nsginstaller*.deb |
Malicious installer shell |
| Web-shell paths | /vpn/scripts/linux/nsgclient*.deb |
Web-shell staging |
| Web-shell paths | /vpn/scripts/linux/*.php |
Potential PHP web shells |
| Web-shell | e6ee7c85.sig |
Reported PHP web-shell variant |
| SLAPSHOT | /tmp/.uxdport, /tmp/.uxdlock |
Tunneling artifacts |
| Persistence | AddHandler ... .deb/.sig |
Enables PHP execution |
| Persistence | AliasMatch ^/vpn/media/(.+).ico$ |
Redirects to web shells |
| Privilege escalation | chmod u+s /bin/sh |
Enables root execution |
| Commands | /bin/httpd -k restart -f /etc/httpd.conf |
Applies Apache changes |
| Commands | /netscaler/nsshutdown -R |
Activates persistence |
| Suspicious process | nohup Python + /tmp/.uxd* |
Possible SLAPSHOT activity |
| HTTP response | Large/slow HTTP 404 | Possible hidden web-shell output |
| Exploitation IP | 143.198.7.94 |
Scanning/staging infrastructure |
| Exploitation IP | 157.254.167.12 |
NetScaler exploitation activity |
| Exploitation IP | 149.104.78.141 |
Pre-disclosure exploitation observed |
| Web-shell path | /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver |
Hidden web shell |
| Alias filename | receiver.min.css |
Disguised web-shell access |
| Alias pattern | receiver\.min\.[0-9a-f]+\.css |
Web-shell alias pattern |
| SHA-256 | 6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7 |
Reported web-shell hash |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
