Citrix NetScaler Zero-Days Exploited to Deploy Web Shells

Attackers exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, disclosed Sunday, to gain root access and deploy WHIPSHOT and SLAPSHOT malware. Mandiant says intrusions began in early September, hitting government, financial, education, legal and professional services organizations across North America and Europe. GreyNoise saw exploitation on September 24, three days before public disclosure. Citrix released patches; defenders should hunt for.ctxs.receiver files and modified /bin/sh permissions.