InfoSecBulletin Cybersecurity for mankind
Google has said that hackers are using two serious Citrix NetScaler security holes to get root access, set up hidden web shells, and enter victims’ networks. The activity has impacted groups in North America and Europe. This includes government, finance, technology, education, law, and professional services.
Mandiant Consulting and Google Threat Intelligence Group (GTIG) said the campaign started in early September 2026. The attackers are using CVE-2026-88772, a serious memory issue in Citrix NetScaler ADC and NetScaler Gateway, along with CVE-2026-88771, a problem that allows remote code to run due to bad input checks.
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
Citrix gave both flaws a CVSS score of 9.5 and said they are being actively used by attackers. CVE-2026-88772 impacts devices that have Datagram Transport Layer Security turned on, which is the default for VPN virtual servers.
Google said exploitation bypasses authentication and causes an unhandled termination of the NetScaler Packet Processing Engine, or NSPPE.
This allows attackers to access the main FreeBSD operating system. After taking control of a device, they change the httpd.conf settings of the web server so fake file types run as PHP.
Security teams must quickly update NetScaler systems that are affected. Citrix has fixed versions like NetScaler 14.1-73.37 and newer, and NetScaler 13.1-64.23 and newer; fixed FIPS versions are also ready.
Administrators need to check /etc/httpd.conf for weird AddHandler, AliasMatch, and PHP commands. They should look in VPN script folders for PHP code that is hidden in .deb or .sig files. Also, they should check for /tmp/.uxdport or /tmp/.uxdlock, which might show SLAPSHOT activity.
A setuid-enabled /bin/sh, unexpected NSPPE crashes, DTLS handshake failures, and unusual requests to /vpn/media/ or /vpn/scripts/ should be treated as high-priority compromise indicators.
GreyNoise saw attempts to exploit the weaknesses before Citrix announced them, including actions from 149.104.78.141 on September 24. This shows the ongoing risk from internet-facing devices, which usually don’t have endpoint detection and give direct access to sensitive internal systems.
| IOC Type | Indicator | Security Significance |
|---|---|---|
| Exploit traffic | UDP/443, DTLSv1.0 | Observed CVE-2026-88772 exploit traffic |
| NetScaler log | SSL_HANDSHAKE_FAILURE + DTLSv1.0 |
Possible malformed exploit traffic |
| Process crash | NSPPE crash |
Possible exploitation indicator |
| Watchdog log | pitboss NOT restarting NSPPE |
High-priority correlated signal |
| HTTP headers | HTTP_NSC_LDAP, HTTP_NSC_CLIENTTYPE |
Web-shell command delivery |
| HTTP headers | HTTP_X_UX, HTTP_X_UX_[0-9]+ |
WHIPSHOT C2 traffic |
| URI | /vpn/media/*.ico |
Possible hidden web-shell access |
| URI | /vpn/media/nsgclient.ico |
Known web-shell alias |
| Web-shell paths | /vpn/scripts/linux/nsginstaller*.deb |
Malicious installer shell |
| Web-shell paths | /vpn/scripts/linux/nsgclient*.deb |
Web-shell staging |
| Web-shell paths | /vpn/scripts/linux/*.php |
Potential PHP web shells |
| Web-shell | e6ee7c85.sig |
Reported PHP web-shell variant |
| SLAPSHOT | /tmp/.uxdport, /tmp/.uxdlock |
Tunneling artifacts |
| Persistence | AddHandler ... .deb/.sig |
Enables PHP execution |
| Persistence | AliasMatch ^/vpn/media/(.+).ico$ |
Redirects to web shells |
| Privilege escalation | chmod u+s /bin/sh |
Enables root execution |
| Commands | /bin/httpd -k restart -f /etc/httpd.conf |
Applies Apache changes |
| Commands | /netscaler/nsshutdown -R |
Activates persistence |
| Suspicious process | nohup Python + /tmp/.uxd* |
Possible SLAPSHOT activity |
| HTTP response | Large/slow HTTP 404 | Possible hidden web-shell output |
| Exploitation IP | 143.198.7.94 |
Scanning/staging infrastructure |
| Exploitation IP | 157.254.167.12 |
NetScaler exploitation activity |
| Exploitation IP | 149.104.78.141 |
Pre-disclosure exploitation observed |
| Web-shell path | /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver |
Hidden web shell |
| Alias filename | receiver.min.css |
Disguised web-shell access |
| Alias pattern | receiver\.min\.[0-9a-f]+\.css |
Web-shell alias pattern |
| SHA-256 | 6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7 |
Reported web-shell hash |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
