🚨Citrix 0-day Exploits Targeting Critical Sectors Since Early September
Critical 0-days Exploited in Government, Banks, and More
TL;DR
Custom malware exploiting Citrix 0-day vulnerabilities since early September targets government, banks, and more. Attackers use WHIPSHOT and SLAPSHOT to gain control and steal credentials. Citrix delayed disclosure, leaving many exposed.
Custom malware exploiting Citrix 0-day vulnerabilities since early September is targeting government agencies, banks, and other critical sectors. Attackers use WHIPSHOT, a PHP web shell, and SLAPSHOT, a Python TCP tunneling tool, to execute arbitrary commands and steal credentials. The vulnerabilities, CVE-2026-88772 and CVE-2026-88771, allow unauthenticated attackers to remotely execute commands, leading to potential data breaches and service disruptions. Citrix's delayed disclosure means many organizations were compromised before warnings were issued. If you're using Citrix NetScaler, this is a red alert.
Key Points
Custom malware WHIPSHOT and SLAPSHOT used in Citrix 0-day attacks since early September.
CVE-2026-88772 and CVE-2026-88771 vulnerabilities allow remote command execution.
Citrix delayed disclosure, leaving organizations compromised before warnings issued.
Vulnerabilities discovered during incident response and forensic investigations.
Supported commands in SLAPSHOT include open, push, pull, exch, close, and ping.
Why It Matters
If you're using Citrix NetScaler, this is a red alert. The vulnerabilities can allow attackers to execute arbitrary commands and steal credentials. The delayed disclosure means many organizations were compromised before warnings were issued. This affects security teams and IT departments responsible for protecting critical infrastructure.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,537 builders reading daily.