News
ai Making the internet better for AI agents might make it worse for everyone else - MIT Technology Review cybersecurity Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks - SecurityWeek ai “We were looking at it wrong”: The explosive claim that’s upended the AI world - MIT Technology Review cybersecurity Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor - The Hacker News cybersecurity OpenCode hack exposes API keys amid AI distillation attacks - BleepingComputer cybersecurity Weekly Cybersecurity Newsletter — Top 50 Cybersecurity Stories of the Week - CyberPress threat-intel Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding - GBHackers cybersecurity Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor - The Hacker News cybersecurity WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot - Wired Security vulnerability Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED) - Rapid7 Vulnerability Disclosure cybersecurity Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw - SecurityWeek cybersecurity Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack - SecurityWeek threat-intel Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 - Rapid7 Emergent Threat Response threat-intel Supply Chain Zero Days: Closing the Gap Between Publication and Detection - Wiz Research threat-intel CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild - Rapid7 Emergent Threat Response
1 / 15
All news ›
Threat Intel

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Rapid7 Emergent Threat Response ·

Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments. The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Directory, management services and VMware vCenter infrastructure, and exfiltrated NetScaler configuration and key material. The activity overlaps with public reporting on the WHIPSHOT/SLAPSHOT NetScaler campaign. However, this case provides additional detail on the operational lifecycle, including repeated post-reboot execution through the crash-handling workflow, HA-aware persistence, a dedicated Go reconnaissance tool, a separate FreeBSD proxy agent, and a staged collection pipeline. Key findings

Continue on Rapid7 Emergent Threat Response ↗ ‹ All news Get the newsletter

The summary and image come from Rapid7 Emergent Threat Response; the image is shown from their website.