> TritonInfoSec News
Home / Oct 02, 2026 / Story
0
#6 The Hacker News general October 01, 2026 at 04:35 UTC

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

By [email protected] (The Hacker News)

AI Summary

Threat actors exploited a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772) across multiple customer environments, deploying web shells mapped to CSS-like URLs and creating superuser accounts to persist access. LevelBlue's THOR team confirmed the activity targeted government and financial sector organizations over a weeks-long campaign, making unpatched NetScaler appliances an active battleground.

Read full article → https://thehackernews.com/2026/10/citrix-netscaler…

Relevance score: 87.0/100

# More from October 02

  1. 1
    Hackers stole Pentagon personnel records of over 3 million people BleepingComputer
  2. 2
    Fortinet warns of critical FortiMail flaw exploited in zero-day attacks BleepingComputer
  3. 3
    CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV The Hacker News
  4. 4
    Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft The Hacker News
  5. 5
    Police dismantle KillSec ransomware gang allegedly led by 16-year-old BleepingComputer
  6. 7
    Russian state hackers use new RedFlick technique to push malware BleepingComputer
  7. 8
    Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path The Hacker News
  8. 9
    Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure SecurityWeek
  9. 10
    OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates The Hacker News