InfoSecBulletin Cybersecurity for mankind
Google has said that hackers are using two serious Citrix NetScaler security holes to get root access, set up hidden web shells, and enter victims’ networks. The activity has impacted groups in North America and Europe. This includes government, finance, technology, education, law, and professional services.
Mandiant Consulting and Google Threat Intelligence Group (GTIG) said the campaign started in early September 2026. The attackers are using CVE-2026-88772, a serious memory issue in Citrix NetScaler ADC and NetScaler Gateway, along with CVE-2026-88771, a problem that allows remote code to run due to bad input checks.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Citrix gave both flaws a CVSS score of 9.5 and said they are being actively used by attackers. CVE-2026-88772 impacts devices that have Datagram Transport Layer Security turned on, which is the default for VPN virtual servers.
Google said exploitation bypasses authentication and causes an unhandled termination of the NetScaler Packet Processing Engine, or NSPPE.
This allows attackers to access the main FreeBSD operating system. After taking control of a device, they change the httpd.conf settings of the web server so fake file types run as PHP.
Security teams must quickly update NetScaler systems that are affected. Citrix has fixed versions like NetScaler 14.1-73.37 and newer, and NetScaler 13.1-64.23 and newer; fixed FIPS versions are also ready.
Administrators need to check /etc/httpd.conf for weird AddHandler, AliasMatch, and PHP commands. They should look in VPN script folders for PHP code that is hidden in .deb or .sig files. Also, they should check for /tmp/.uxdport or /tmp/.uxdlock, which might show SLAPSHOT activity.
A setuid-enabled /bin/sh, unexpected NSPPE crashes, DTLS handshake failures, and unusual requests to /vpn/media/ or /vpn/scripts/ should be treated as high-priority compromise indicators.
GreyNoise saw attempts to exploit the weaknesses before Citrix announced them, including actions from 149.104.78.141 on September 24. This shows the ongoing risk from internet-facing devices, which usually don’t have endpoint detection and give direct access to sensitive internal systems.
| IOC Type | Indicator | Security Significance |
|---|---|---|
| Exploit traffic | UDP/443, DTLSv1.0 | Observed CVE-2026-88772 exploit traffic |
| NetScaler log | SSL_HANDSHAKE_FAILURE + DTLSv1.0 |
Possible malformed exploit traffic |
| Process crash | NSPPE crash |
Possible exploitation indicator |
| Watchdog log | pitboss NOT restarting NSPPE |
High-priority correlated signal |
| HTTP headers | HTTP_NSC_LDAP, HTTP_NSC_CLIENTTYPE |
Web-shell command delivery |
| HTTP headers | HTTP_X_UX, HTTP_X_UX_[0-9]+ |
WHIPSHOT C2 traffic |
| URI | /vpn/media/*.ico |
Possible hidden web-shell access |
| URI | /vpn/media/nsgclient.ico |
Known web-shell alias |
| Web-shell paths | /vpn/scripts/linux/nsginstaller*.deb |
Malicious installer shell |
| Web-shell paths | /vpn/scripts/linux/nsgclient*.deb |
Web-shell staging |
| Web-shell paths | /vpn/scripts/linux/*.php |
Potential PHP web shells |
| Web-shell | e6ee7c85.sig |
Reported PHP web-shell variant |
| SLAPSHOT | /tmp/.uxdport, /tmp/.uxdlock |
Tunneling artifacts |
| Persistence | AddHandler ... .deb/.sig |
Enables PHP execution |
| Persistence | AliasMatch ^/vpn/media/(.+).ico$ |
Redirects to web shells |
| Privilege escalation | chmod u+s /bin/sh |
Enables root execution |
| Commands | /bin/httpd -k restart -f /etc/httpd.conf |
Applies Apache changes |
| Commands | /netscaler/nsshutdown -R |
Activates persistence |
| Suspicious process | nohup Python + /tmp/.uxd* |
Possible SLAPSHOT activity |
| HTTP response | Large/slow HTTP 404 | Possible hidden web-shell output |
| Exploitation IP | 143.198.7.94 |
Scanning/staging infrastructure |
| Exploitation IP | 157.254.167.12 |
NetScaler exploitation activity |
| Exploitation IP | 149.104.78.141 |
Pre-disclosure exploitation observed |
| Web-shell path | /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver |
Hidden web shell |
| Alias filename | receiver.min.css |
Disguised web-shell access |
| Alias pattern | receiver\.min\.[0-9a-f]+\.css |
Web-shell alias pattern |
| SHA-256 | 6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7 |
Reported web-shell hash |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
