[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTFTAq2txw4AbmWHrzznzX_P69L_wlnAwX7IPb0I1igQ":3},{"article":4,"iocs":54,"watch_terms":66,"solutions":67,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b2ffb4f4-4656-4d7f-8181-da2b5a75534b","Hackers exploit Citrix NetScaler zero-day to deploy web shells","hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells-3cb734","Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]","Attackers are actively exploiting two unpatched Citrix NetScaler zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to deploy web shells, gain root access, and spread within victim networks. The exploitation, which began in early September, has impacted organizations across North America and Europe in various sectors, including government and financial services.","Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 exploited in the wild.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F07\u002F21\u002Fcitrix_headpic.jpg","2026-09-29T18:37:12+00:00","2026-09-29T20:00:07.152705+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"NetScaler","product",{"name":21,"type":22},"Citrix","vendor",{"name":24,"type":19},"NetScaler ADC",{"name":26,"type":19},"NetScaler Gateway",{"name":28,"type":22},"Mandiant",{"name":30,"type":22},"GreyNoise","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62],{"type":56,"value":57,"context":58},"cve","CVE-2026-88771","Unauthenticated remote code execution flaw affecting NetScaler ADC and Gateway.",{"type":56,"value":60,"context":61},"CVE-2026-88772","Memory overflow vulnerability leading to RCE or DoS when DTLS is enabled.",{"type":63,"value":64,"context":65},"ip","149.104.78.141","Source IP observed by GreyNoise attempting to exploit NetScaler Gateway.",[21,28,30],{"controls":68,"vendors":153},[69,98,124],{"slug":70,"name":71,"problem":72,"products":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":99,"name":100,"problem":101,"products":102},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":120,"product_name":121,"url":122,"description":123},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":125,"name":126,"problem":127,"products":128},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[154,159],{"slug":155,"name":21,"logo_path":156,"roles":157},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[158],"affected",{"slug":160,"name":161,"logo_path":162,"roles":163},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[164],"reported_by",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":182},"citrix-netscaler-zero-days-exploited-to-deploy-web-shells","Citrix NetScaler Zero-Days Exploited to Deploy Web Shells","Attackers are actively exploiting two unpatched zero-day vulnerabilities in Citrix NetScaler, a widely-deployed network appliance, to install web shells, achieve root-level access, and move laterally across victim networks. Because these are zero-days, no official patches were available at the time of exploitation, making proactive compensating controls and rapid detection the only viable defenses. Internet-facing network appliances like NetScaler are high-value targets because they sit at the perimeter, often with privileged access to internal resources. This incident underscores that organizations cannot rely solely on patching cycles — layered defenses, monitoring, and segmentation are critical to limiting blast radius when zero-days emerge.",[170,171,172,173,174,175,176,177,178,179,180,181],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SP 800-41: Guidelines on Firewalls and Firewall Policy","NIST IR-6: Incident Reporting","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST CA-7: Continuous Monitoring","MITRE ATT&CK T1505.003: Web Shell","MITRE ATT&CK T1210: Exploitation of Remote Services","ITIL: Problem Management — Known Error management for zero-day vulnerabilities",{}]