Hackers exploit Citrix NetScaler zero-day to deploy web shells

Security researchers report active exploitation of two Citrix NetScaler zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway appliances. According to Mandiant, attacks began as early as September and have hit government, financial, education, legal, and professional-services organizations across North America and Europe, with attackers gaining root access, planting web shells, and moving laterally inside victim networks. GreyNoise independently spotted exploitation of a NetScaler Gateway days before Citrix's public disclosure, observing attempts to drop a hidden PHP web shell and tamper with shell permissions to maintain elevated access. Mandiant also identified two new malware families, WHIPSHOT and SLAPSHOT, used together as a proxy-and-tunneling toolkit to steal credentials and reach internal systems, and urges admins to apply Citrix's latest patches immediately since mitigations like disabling DTLS only cover one of the two flaws.