Ethical Hacking News
Citrix NetScaler vulnerability exploited by threat actors to gain root access and deploy post-exploitation toolkit, including PHP web shells and Python tunneler SLAPSHOT. The vulnerability, identified as CVE-2026-88772 and CVE-2026-88771, has been observed to be exploited by unknown threat actors to gain root access and establish persistent execution. The attacks have been observed to use various tactics to evade detection, including modifying target httpd.conf files to handle Debian software package format (.deb) files as PHP scripts, and implementing a covert configuration hook that disguises web shell execution as image requests. The vulnerability has been identified as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling in the NSPPE component. The bug allows an attacker to induce heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.
The latest cyber threat is the exploitation of a vulnerability in Citrix NetScaler, identified as CVE-2026-88772 and CVE-2026-88771. The vulnerability is a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling in the NSPPE component. The attackers have been observed exploiting the vulnerability to gain root access and establish persistent execution. The attackers have been using a post-exploitation toolkit, including previously unreported PHP web shells, to deploy malicious code. The attackers have also been using a novel companion Python tunneler called SLAPSHOT to proxy traffic into internal networks for reconnaissance and credential theft. The attacks have been observed to target organizations in North America and Europe, including government, financial services, technology, education, and legal and professional services sectors. The attackers have been using various tactics to evade detection, including modifying target httpd.conf files and implementing covert configuration hooks.
The latest cyber threat to hit the network security scene is the exploitation of a vulnerability in Citrix NetScaler, a widely used application delivery controller and VPN gateway. This vulnerability, identified as CVE-2026-88772 and CVE-2026-88771, has been observed by security experts to be exploited by threat actors to gain root access to affected organizations.
The vulnerability, a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling in the NSPPE component, was initially discovered by Google Threat Intelligence Group (GTIG) and Mandiant Consulting. According to Charles Carmakal, chief technology officer at Mandiant Consulting, the targeted intrusions have impacted dozens of organizations, warning of "broad and opportunistic exploitation of the two vulnerabilities in the near term."
The attackers have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells, such as WHIPSHOT, that are capable of disguising Base64-encoded command-and-control (C2) payloads within native HTTP headers. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The attacks have been observed to follow a specific attack chain, starting with the exploitation of the vulnerability, followed by the deployment of the web shell, and finally, the establishment of persistent root-level execution. The web shells, which are dressed up as .deb and .sig files, offer direct command execution and automated appliance persistence. One such web shell, WHIPSHOT, extracts Base64-encoded commands and payloads from HTTP headers, executes them, and returns the results.
The attackers have been observed to use various tactics to evade detection, including modifying target httpd.conf files to handle Debian software package format (.deb) files as PHP scripts, and implementing a covert configuration hook that disguises web shell execution as image requests. In some cases, the attackers have been observed to implement a configuration that maps incoming HTTP requests ending in ".ico" under "/vpn/media/" directly to a corresponding ".sig" file with the same base name inside "/var/netscaler/gui/vpn/scripts/linux/."
The attacks have been observed to target organizations in North America and Europe, including government, financial services, technology, education, and legal and professional services sectors. The attackers have been observed to be opportunistic in their approach, exploiting the vulnerability to gain root access and establish persistent execution.
The vulnerability has been identified as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling in the NSPPE component. The bug allows an attacker to induce heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.
The attacks have been observed to be carried out by unknown threat actors, who have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The vulnerability has been identified as CVE-2026-88772 and CVE-2026-88771. The two vulnerabilities have been observed to be exploited by threat actors to gain root access and establish persistent execution. The attackers have been observed to use various tactics to evade detection, including modifying target httpd.conf files to handle Debian software package format (.deb) files as PHP scripts, and implementing a covert configuration hook that disguises web shell execution as image requests.
The attacks have been observed to be carried out by unknown threat actors, who have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The vulnerability has been identified as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling in the NSPPE component. The bug allows an attacker to induce heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.
The attacks have been observed to be carried out by unknown threat actors, who have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The vulnerability has been identified as CVE-2026-88772 and CVE-2026-88771. The two vulnerabilities have been observed to be exploited by threat actors to gain root access and establish persistent execution. The attackers have been observed to use various tactics to evade detection, including modifying target httpd.conf files to handle Debian software package format (.deb) files as PHP scripts, and implementing a covert configuration hook that disguises web shell execution as image requests.
The attacks have been observed to be carried out by unknown threat actors, who have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The vulnerability has been identified as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling in the NSPPE component. The bug allows an attacker to induce heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.
The attacks have been observed to be carried out by unknown threat actors, who have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The vulnerability has been identified as CVE-2026-88772 and CVE-2026-88771. The two vulnerabilities have been observed to be exploited by threat actors to gain root access and establish persistent execution. The attackers have been observed to use various tactics to evade detection, including modifying target httpd.conf files to handle Debian software package format (.deb) files as PHP scripts, and implementing a covert configuration hook that disguises web shell execution as image requests.
The attacks have been observed to be carried out by unknown threat actors, who have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The vulnerability has been identified as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling in the NSPPE component. The bug allows an attacker to induce heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.
The attacks have been observed to be carried out by unknown threat actors, who have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The vulnerability has been identified as CVE-2026-88772 and CVE-2026-88771. The two vulnerabilities have been observed to be exploited by threat actors to gain root access and establish persistent execution. The attackers have been observed to use various tactics to evade detection, including modifying target httpd.conf files to handle Debian software package format (.deb) files as PHP scripts, and implementing a covert configuration hook that disguises web shell execution as image requests.
The attacks have been observed to be carried out by unknown threat actors, who have been observed exploiting the vulnerability to deploy a post-exploitation toolkit, including previously unreported PHP web shells. The attackers have also been observed using a novel companion Python tunneler dubbed SLAPSHOT, designed to proxy traffic into internal networks for reconnaissance and credential theft.
The vulnerability has been identified as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling in the NSPPE component. The bug allows an attacker to induce heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.
Related Information:
https://www.ethicalhackingnews.com/articles/Exploiting-the-Vulnerability-in-Citrix-NetScaler-A-Threat-to-Network-Security-ehn.shtml
https://thehackernews.com/2026/09/attackers-exploit-netscaler-flaw-for.html
Published: Wed Sep 30 07:20:10 2026 by llama3.2 3B Q4_K_M
