PitScaler - Citrix NetScaler Zero-Day Crisis

Overview: exploited NetScaler zero-day vulnerabilities

The eight NetScaler vulnerabilities (CVEs) in CTX697096

Citrix's bulletin lists all eight CVEs with CVSS 4.0 scores and preconditions, and NCSC-NL's advisory NCSC-2026-0394 gives the same figures. Only CVE-2026-88771 and CVE-2026-88772 are confirmed exploited. ^[9][1][7]

Timeline

Times are UTC unless marked otherwise. Events without a time show only their date. Expand an event to see its sources.

1. Aug 21 Research

   Unit 42: earliest activity is NetScaler version fingerprinting

   On 21 Aug 104.248.244.66 and then 77.83.199.39 requested /admin_ui/common/css/ns/ui.css and /vpn/js/rdx/core/lang/rdx_en.json.gz from a US NetScaler Gateway. On 21 and 22 Aug these two hosts and 78.47.24.217 sent the same requests to more than 100 other systems. Unit 42 describes this as fingerprinting, not exploitation.

   Sources: ^[96]

2. Sep 4 Research

   Unit 42: .deb webshell requests begin (CVE-2026-88772 chain)

   From 4 to 24 Sep the actor repeatedly requested .deb files in /vpn/scripts/linux/, rotating infrastructure: one VPS per day on 4-8 Sep, Cloudflare WARP addresses on 9-11 Sep, 162.33.178.9 on 14 Sep and 193.149.176.207 daily on 15-24 Sep. A continuous stream of requests to /logon/LogonPoint/Authentication/GetUserName ran from 10 Sep until 01:54 UTC on 27 Sep, hours before the bulletin.

   Sources: ^[96]

3. Sep 5 Research

   eSentire: CVE-2026-88771 exploited as early as 5 September

   eSentire TRU incident response saw exploitation of Internet-facing NetScaler Gateways from 5 Sep, more than three weeks before disclosure: base64 PHP staged in the access log via fake /vpn/media/*.ico requests, then executed through a crafted login username. In one intrusion a .deb-variant webshell was installed and operated from 5 Sep, with signs of data exfiltration and lateral movement to internal virtual desktops and back to the appliance over SSH.

   Sources: ^[48]

4. Sep 10, 07:14 UTC Official advisory Validated

   CVE IDs reserved

   NetScaler reserves CVE-2026-88771 and CVE-2026-88772 at 07:14 UTC. The records were published on 27 Sep at 16:02 and 16:09 UTC.

   Validated against the CVE record on 29 Sep.

   Sources: ^[26][54]

5. Sep 21 Research

   Unit 42: three-stage CVE-2026-88771 chain drops a PHP webshell

   77.83.199.39, 78.47.24.217 and 139.180.152.138 staged a Base64 dropper in the User-Agent (logged to httpaccess-vpn.log), poisoned ns.log with a fake pitboss heartbeat message, and had ns_monuploadd_err.pl -WR decode and run it, installing the .ctxs.receiver webshell at a US target.

   Sources: ^[96]

6. Sep 23 Reported observation

   Danish NetScalers start going offline

   Ingeniøren's review of Shodan data shows several Danish NetScaler systems switched off from 23 Sep, four days before Citrix's public disclosure.

   Sources: ^[99]

7. Sep 24, 07:32 UTC Telemetry

   GreyNoise sensors see exploitation from a single IP

   149.104.78.141: 3 sessions 07:32:19-07:32:20 UTC. IP flagged "suspicious" (Citrix ADC Gateway Login Panel Crawler), then "malicious" (Generic ${IFS} Use in RCE Attempt; CitrixBleed 2 attempt). Later retro-tagged as CVE-2026-88771. GreyNoise's retro-hunt found no other exploitation sessions before disclosure - this covers GreyNoise sensors only.

   Sources: ^[53][54][55]

8. Sep 25 Reported observation Validated

   Danish government agencies shut down their NetScalers

   Danish agencies, among them PET, the Armed Forces and the police, took their Citrix NetScaler environments offline from Friday 25 Sep, two days before Citrix disclosed the vulnerabilities. Ingeniøren later reported the shutdowns from Shodan data; none of the agencies would explain why.

   The Friday 25 Sep shutdown was validated independently on 30 Sep.

   Sources: ^[99]

9. Sep 25 Official advisory

   NCSC-NL confidentially warns Dutch organisations

   On the afternoon of Friday 25 Sep, after a tip from a European partner, NCSC-NL confidentially informed companies and organisations, including central government, about two NetScaler zero-days being exploited outside the Netherlands, before any patch existed. Dark Reading reports that a copy of the pre-notification, marked TLP:AMBER+STRICT, was briefly posted on Reddit and then deleted. According to BleepingComputer, the notice said Citrix found the vulnerabilities while investigating incidents at customers and filed a notification under the EU Cyber Resilience Act.

   Sources: ^{[25][104][82]}

10. Sep 26, 06:43 UTC Reported observation Validated

    r/Citrix "Netscaler leak?" thread

    User FastFredNL opens the thread at 06:43:22 UTC (08:43 CEST), reporting that an IT provider advised shutting NetScalers down immediately. It becomes the first public gathering point, with admins reporting similar unofficial advice over the weekend. Dark Reading dates the first reports to 25 Sep, but the thread itself was posted on 26 Sep.

    Post timestamp checked on the thread itself (30 Sep). The shutdown advice is consistent with the Dutch government letter to parliament.

    Sources: ^{[108][57][104][25]}

11. Sep 26, 22:19 UTC Research

    watchTowr: two unpatched RCE zero-days, found during forensics

    Two vulnerabilities - both RCE. Unpatched, 0days. Exploited in-the-wild - discovered during forensics.

    watchTowr adds that Citrix comms and patches are expected early the following week.

    Sources: ^[51]

12. Sep 26, 23:39 UTC Reported observation

    IFIN opens a public tracking thread

    IFIN starts compiling public reporting and observables for the NetScaler zero-days; it later states that all observables it shares were shared without restriction.

    Sources: ^[57]

13. Sep 26 Reported observation

    watchTowr: pull NetScaler appliances offline immediately

    Please, take this seriously and pull NetScaler appliances offline immediately.

    watchTowr publicly warns that credible rumours of unpatched NetScaler RCEs are circulating; later that day CEO Benjamin Harris says the rumours are confirmed and urges admins to pull NetScaler appliances offline immediately.

    Sources: ^[104]

14. Sep 27, 10:05 UTC Reported observation

    Dutch hospitals Amphia and ETZ close patient portals

    Patients of Amphia (Breda) and Elisabeth-TweeSteden Ziekenhuis (Tilburg) cannot log in to their portals; other Dutch hospitals report problems too. That evening Z-CERT, the Dutch healthcare CERT, says it warned the sector about critical vulnerabilities in Citrix NetScaler and advised temporarily switching the system off.

    Sources: ^[105]

15. Sep 27, 15:51 UTC Official advisory

    Public disclosure; Citrix publishes CTX697096 with fixes

    Disclosure time per GreyNoise. The bulletin covers 8 CVEs. watchTowr notes the patch it analysed was dated 24 Sep, suggesting Citrix knew of the exploitation the week before.

    Sources: ^[1][54][104]

16. Sep 27, 16:06 UTC Official advisory

    Citrix announces the bulletin on r/Citrix

    A Citrix staff account (CTX-Michael) posts a CRITICAL UPDATE in r/Citrix linking the CTX697096 bulletin and the Citrix community blog post with its IoC section, and quoting that exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments has been observed.

    Sources: ^[5][4]

17. Sep 27, 20:28 UTC Telemetry

    GreyNoise deploys CVE-specific tag

    Tag deployed 20:28:39 UTC; the 24 Sep sessions are retro-tagged as CVE-2026-88771.

    Sources: ^[54][56]

18. Sep 27, 21:30 UTC Official advisory Validated

    CISA adds CVE-2026-88771 and CVE-2026-88772 to KEV

    Both were added on 27 Sep with a federal remediation deadline of 30 Sep. The 21:30 UTC release time comes from the compiled dataset and was not found in the sources checked.

    Dates validated against the KEV catalog feed on 29 Sep.

    Sources: ^[7][20]

19. Sep 27, 23:15 UTC Telemetry

    Unit 42: 50,277 exposed instances

    Palo Alto Networks Cortex Xpanse identifies 50,277 exposed NetScaler instances that could potentially be vulnerable (update posted 4:15 p.m. PT). Exposure, not confirmed compromise.

    Sources: ^[96]

20. Sep 27 Official advisory

    Danish Defence Intelligence (FE) and CERT-EU warn NetScaler users

    The Danish Defence Intelligence Service sent a warning urging NetScaler users to update, per Ingeniøren. CERT-EU published Security Advisory 2026-014 recommending an immediate update of all customer-managed appliances and enabling Enhanced ISN Generation where TCP is configured.

    Sources: ^[99][21]

21. Sep 27 Reported observation

    Beaumont: three CVEs chained, webshells all September

    The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained. It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September. Probably nation state aligned

    Beaumont's claim; attribution not independently verified.

    Sources: ^[63]

22. Sep 27 Reported observation

    Beaumont: patches live, detection script behind NDA

    patching alone doesn't remove the backdoors being placed

    Patches are live on the main support site; Citrix's detection script is locked behind NDA/support.

    Sources: ^[64]

23. Sep 27 Reported observation Validated

    Beaumont: Console check misses earlier attempts

    The NetScaler Console check misses earlier semi-successful attempts because it relies on logs not having rotated; he adds that the activity is weeks old because of slow disclosure.

    Validated independently on 29 Sep.

    Sources: ^[65]

24. Sep 28, 09:40 UTC Official advisory

    NHS England alert CC-4858

    NHS England's National CSOC rates the threat High and assesses further exploitation as almost certain. It strongly recommends a compromise assessment before patching, since patching first may delete evidence, and warns that end-of-life 12.1 and 13.0 releases are likely vulnerable and receive no fix. Published 10:40 UK time.

    Sources: ^[23]

25. Sep 28, 22:49 UTC Reported observation

    Beaumont names it "PitScaler"

    I'm tracking over 100 victim orgs now. Each one has a unique webshell which can't be scanned for remotely unless you're the attacker. It's espionage.

    Victim count is Beaumont's claim, not independently verified.

    Sources: ^[66]

26. Sep 28, 23:02 UTC Reported observation Validated

    Beaumont: Citrix checker incomplete

    Some really big orgs are backdoored after patching still

    The checker does not check for suid on /bin/sh; Beaumont calls on NCSCs to publish a detection script.

    The missing suid /bin/sh check was validated independently on 29 Sep. The claim about big organisations still being backdoored is not independently verified.

    Sources: ^[67]

27. Sep 28 Official advisory

    CERT-FR, CSSF (Luxembourg) and CERT Quebec issue alerts

    CERT-FR says the two vulnerabilities allow unauthenticated remote code execution, are actively exploited and were exploited before patches existed. The CSSF points supervised financial entities to the CIRCL report and reminds them that unauthenticated remote code execution is unauthorised access, so it counts as a major ICT-related incident to notify under DORA or its national circulars. CERT Quebec rates the risk critical (TLP:CLEAR) and says Quebec public bodies using a vulnerable product must test and deploy the vendor updates or mitigations.

    Sources: ^[13][14][15]

28. Sep 28 Reported observation

    Press covers the weekend shutdown warnings

    BleepingComputer, SecurityWeek, The Record and CyberScoop cover the story.

    Sources: ^{[82][89][90][91]}

29. Sep 28 Research

    CERT-EU technical writeup on CVE-2026-88771

    "Taking 'execute logging' a bit too literally" - root cause, attack chain and hunting guidance.

    Sources: ^[27]

30. Sep 28 Official advisory

    Government advisories worldwide

    NCSC-NL NCSC-2026-0394 [H/H], NCSC-UK, CSA Singapore AL-2026-129, plus Canada, HKCERT, ACSC, and CIRCL TR-100 with per-CVE config-check CLI commands.

    Sources: ^{[9][10][11][12][16][17][24]}

31. Sep 28 Telemetry

    GreyNoise publishes TLP:CLEAR IoC set

    "Swarming Against Citrix 0-Day Exploitation" - the first public IoC set in this compiled dataset as of 29 Sep, with a companion Chronicle timeline.

    Sources: ^[53][54]

32. Sep 28 Research

    watchTowr Labs part 1 (CVE-2026-88771)

    "Oh Look, the Foot Gun Went Off Again", published with a Detection Artefact Generator (PoC-class tool).

    Sources: ^[28][29]

33. Sep 28 Telemetry

    Censys and Shadowserver count exposed NetScalers

    Censys detects NetScaler ADC or Gateway on 42,735 hosts and 323,527 web properties; these are exposed instances, not confirmed-vulnerable counts. Shadowserver reports more than 20,000 instances exposed and potentially at risk.

    Sources: ^[60][97]

34. Sep 28 Telemetry

    Lupovis honeypots see exploitation minutes after the public PoC

    Lupovis says its sensors recorded live CVE-2026-88771 exploitation attempts within minutes of watchTowr releasing its PoC; the attempts were opportunistic, from several distinct actors.

    Sources: ^[98][43]

35. Sep 28 Research

    First public detection rules

    Elastic merges a rule for NetScaler log-poisoning command injection; Corelight publishes Zeek hunting queries. Sigma and Nuclei pull requests follow (28-29 Sep, still unmerged at snapshot time).

    Sources: ^{[45][44][46][47]}

36. Sep 28 Research

    Truesec publishes potential C2 IPs

    Truesec lists 104.248.244.66, 139.180.152.138 and 77.83.199.39 as potential C2 IPs it has observed.

    Sources: ^[33]

37. Sep 28 Official advisory Validated

    ACSC alert; Australian organisations later confirm exploitation

    Australia's ACSC publishes an alert on 28 Sep. In an update it says Australian organisations have since confirmed exploitation, and recommends reviewing for evidence of compromise since at least 4 Sep 2026. The original background text, still lower on the page, says no Australian exploitation had been confirmed at first publication.

    Both statements checked on the ACSC page on 1 Oct.

    Sources: ^[17]

38. Sep 28 Reported observation

    Dutch ministry and hospitals take systems offline

    The Dutch Ministry of the Interior took all Citrix environments offline over the weekend; patients of two major hospitals (Amphia and ETZ) could not view their records, and Frisius MC in Leeuwarden shut down some digital systems as a precaution (SDxCentral, citing Techzine).

    Sources: ^[100]

39. Sep 29, 00:59 UTC Research

    Sygnia: new "unexpectedly died" log-poison variant

    Sygnia saw commands after pitboss PPE unexpectedly died NSPPE; in raw logs: copying ns.conf to /var/netscaler/logon/insight-new.js (00:59 UTC), curl of update_c08937.pl from 64.94.85.67 piped to perl (03:18 UTC) and whoami (04:05-04:07 UTC). Sygnia notes this shows the commands reached the vulnerable logging path, not that they ran.

    Sources: ^[37]

40. Sep 29, 04:39 UTC Reported observation

    Beaumont: mass exploitation

    #PitScaler is under mass exploitation, seeing it spray and pray now. I've done some firmware version scanning, fewer than 10% of boxes are patched

    The <10% figure is Beaumont's own estimate, not independently verified.

    Sources: ^[68]

41. Sep 29, 06:18 UTC Reported observation Compromise unverified

    Beaumont posts a public message to the NSA

    do forensics on 103.41.70.207,vdicorp.nsa.gov

    The domain resolves to that IP. That the host is an NSA-operated Citrix system has been validated independently. That it is compromised is Beaumont's implication and is not verified. This briefing does not identify any organisation as compromised, and these values are not listed as IoCs.

    Sources: ^[69]

42. Sep 29, 16:12 UTC Reported observation Validated

    Beaumont: IR writeups expose victim-unique indicators

    IR vendors are publishing PitScaler writeups containing victim-unique webshell names (.sig files) and attacker IPs, which he says lets him map victim orgs via network traffic. He warns that unremediated orgs' published webshell names can be used to access their boxes, and says one vendor uploaded its IR investigation to VirusTotal.

    Validated independently on 29 Sep.

    Sources: ^[70]

43. Sep 29, 18:49 UTC Reported observation

    The Register: government, banks and professional services targeted

    Why Citrix took so long to disclose these vulnerabilities is a question only Citrix can answer

    It reports GTIG/Mandiant findings that government, financial services, education and legal and professional services organisations in North America and Europe were likely hit. watchTowr CEO Benjamin Harris criticises the slow disclosure and says no attribution has been made public.

    Sources: ^[95][34]

44. Sep 29 Research

    watchTowr Labs part 2 (CVE-2026-88772)

    "Here We Go Again" (Sina Kheirkhah) - full RCE analysis plus a second Detection Artefact Generator.

    Sources: ^[30][31]

45. Sep 29 Research

    Google GTIG / Mandiant: custom malware WHIPSHOT and SLAPSHOT

    The CVE-2026-88772 campaign has been ongoing since at least early September. WHIPSHOT is a PHP webshell staged with a .deb disguise that hides base64 C2 in HTTP headers; SLAPSHOT is a Python TCP tunneler (open/push/pull/exch/close/ping) used to reach internal networks for reconnaissance and credential theft.

    Sources: ^[34][95]

46. Sep 29 Reported observation

    BleepingComputer: credential theft and internal spread

    It reports that attackers exploited CVE-2026-88772 to deploy webshells and tunneling malware, gain root, steal credentials and spread into internal networks, citing Mandiant. GTIG itself describes the credential theft and internal reconnaissance in at least one observed intrusion.

    Sources: ^[81][34]

47. Sep 29 Reported observation Validated

    Mandiant CTO: check for compromise before patching

    Given the active exploitation, NetScaler customers should prioritize examining their systems for compromise *before* upgrading/patching

    Charles Carmakal on LinkedIn, as quoted by The Register.

    Quote validated against a second, non-public source on 29 Sep.

    Sources: ^[95]

48. Sep 29 Research

    Nextron releases THOR rules and a NetScaler filesystem IoC set

    Three rules in the THOR Preview channel (higher false-positive rate than stable rules) plus a YAML IoC set derived from the filesystem checks in Citrix's scanner script. A match is a lead, not proof.

    Sources: ^[35]

49. Sep 29 Research

    eSentire publishes first-hand IR findings and IoCs

    Two webshell variants (.ico and .deb), 14 IPs and 2 SHA-256 hashes; the technique matches CERT-EU's description. eSentire advises treating appliances that were Internet-facing and unpatched in early September as potentially compromised until an integrity assessment shows otherwise.

    Sources: ^[48]

50. Sep 29 Telemetry

    Defused: hundreds of decoy hits across multiple exploit paths

    Defused reports hundreds of CVE-2026-88771 hits on its decoys in 24 hours via /nf/auth/doAuthentication.do, /cgi/login, /p/u/doLogon.do, /logon/LogonPoint/tmindex.html and User-Agent payloads on /. Observed follow-up: whoami/id to prove root, nx_verify.html marker files, curl/wget/fetch pulling a second stage, and blind DNS callbacks. Full IoCs are on Defused Radar (not reproduced here).

    Sources: ^[61]

51. Sep 29 Official advisory

    DKCERT warns Danish universities and research institutions

    DKCERT, the CERT for the Danish research and education network, reports two critical NetScaler zero-days exploited before a patch and notes that several administrators took systems offline before Citrix published details.

    Sources: ^[22]

52. Sep 29 Reported observation

    Mandiant: dozens of organisations impacted

    Cybersecurity Dive reports Mandiant CTO Charles Carmakal saying the actor deployed webshells and moved laterally into internal networks at some targets, with dozens of organisations impacted across North America and Europe, including telecommunications.

    Sources: ^[101]

53. Sep 29 Official advisory

    Dutch government confirms preventive disconnection

    Letter to parliament: on Saturday 26 Sep the CIO Rijk set the line "loskoppelen tenzij" (disconnect unless) for central government, and it was broadly applied; remote-work access has not yet been restored everywhere while the patch is tested and forensic investigation continues. Beaumont relays it at 18:32 UTC as "shut down all Citrix Netscalers".

    Sources: ^[25][72]

54. Sep 30, 05:00 UTC Reported observation

    Ingeniøren: PET, Danish Defence and police shut down Citrix

    Based on Shodan data, Ingeniøren reports that PET, the Danish Armed Forces, the Danish police and Copenhagen Airport, among many others, had to switch off their Citrix environments over the weekend. None of the agencies would explain why.

    Sources: ^[99]

55. Sep 30, 22:00 UTC Research

    Unit 42 expands its threat brief

    Adds pre- and post-disclosure activity back to 21 Aug, analysis of the nsg64.deb RC4 webshell and the .ctxs.receiver webshell, hunting queries and a formal IoC list. Updated 15:00 PT.

    Sources: ^[96]

56. Sep 30 Official advisory

    CERT-FR updates its alert with GTIG indicators

    The update relays the GTIG/Mandiant indicators and YARA rules, which ANSSI says it has not qualified, and the two patterns GTIG calls characteristic of successful exploitation: a DTLS handshake-failure line in syslog, and a pitboss NOT restarting NSPPE line in /var/log/messages. CERT-FR also says it knows of public proof-of-concept code for CVE-2026-88771 (noted 28 Sep) and for CVE-2026-88772.

    Sources: ^[13]

57. Sep 30 Official advisory

    NCSC-NL revises its advisory to version 1.0.1

    The revision (30 Sep) extends the recommended actions with information on the Console scan script and IoCs, and says customers without Console should ask Citrix Support for the generic IoCs. The advisory says installing the update prevents new abuse but does not rule out earlier abuse, advises securing relevant logging and a memory dump before updating, and says appliances that were internet-facing before the update should be treated as possibly compromised.

    Sources: ^[9]

58. Sep 30 Research

    TENEX traces a Platypus C2 chain from the injected login

    From malicious login requests TENEX followed four rotating staging hosts to a shell loader that enrols the off-the-shelf Platypus agent from entretiensol.com, then mapped a four-node C2 cluster through one shared TLS certificate. It also recovered the Python (customsnmpd reverse shell) and Perl (sec_monitor, .local_journal webshell, SUID /bin/sh, config theft) stages, and saw a separate loud wave of commodity payloads after the public PoC. TENEX does not name an actor and says logs show attempts, not confirmed execution.

    Sources: ^[38]

59. Sep 30 Official advisory

    Citrix updates its community bulletin

    Last updated 30 Sep. It adds: a known issue where 13.1-64.23 can enter a reboot loop during upgrade if show ns variable lists variables (use 13.1-64.24); a Console Security Advisory scan that may wrongly flag 13.1-64.23 as vulnerable until the next automatic advisory update; a note that NetScaler VPX 15.1 Technology Preview is also vulnerable, is not permitted in production, and a fix will follow; and that samlRejectUnsignedAssertion OFF is no longer supported and is converted to the secure default on upgrade. For suspected compromise Citrix recommends deploying a new, updated instance rather than relying on the update, forwarding logs to an external SIEM, and using Console File Integrity Monitoring.

    Sources: ^[4]

60. Sep 30 Research

    Arctic Wolf publishes follow-up exploitation IoCs and the nsmon.pl implant

    Commands fetched Python, Perl and shell scripts, opened reverse shells and sent Base64 command output over HTTP. The 3,752-byte Perl script nsmon.pl installs under /var/tmp/.nsmon, attempts to add a root cron entry every five minutes, attempts to listen on a port in 41000-41999 and begins a UDP or TCP check-in. These are attempts in the visible code, not proven persistence. Arctic Wolf also shows the injected username as it appears in AAA, AAATM and SSLVPN appliance logs.

    Sources: ^[36]

61. Sep 30 Research

    Sygnia publishes an IR-based advisory

    Investigation-derived indicators (IPs, .sig artefacts, a JSON artefact and a SHA-256) that Sygnia stresses are context-specific and not Citrix-published; validate NAT and direction before blocking.

    Sources: ^[37]

62. Sep 30 Reported observation

    Mandiant CTO: suspected state-sponsored actors likely behind the first intrusions

    Help Net Security relays Carmakal saying advanced and suspected state-sponsored threat actors are likely behind the initial targeted intrusions that used CVE-2026-88772, with dozens of organisations impacted across North America and Europe. No actor is named.

    Sources: ^[84]

63. Sep 30 Official advisory Deadline - upcoming

    Deadline: CISA KEV federal remediation

    Both CVEs were added to KEV on 27 Sep with a due date of 30 Sep, giving US federal agencies three days. The required action is to apply Citrix mitigations under BOD 26-04 and CISA's Forensics Triage Requirements, or stop using the product if mitigations are unavailable; the KEV notes say customers must conduct forensic triage. The KEV entry gives a date only (2026-09-30), no time of day. CISA's directive deadlines are conventionally 11:59 PM U.S. Eastern (23:59 EDT, 03:59 UTC on 1 Oct), and third-party KEV trackers treat the due date the same way, but CISA publishes no official time for KEV due dates - so the deadline was passed by 1 Oct 04:00 UTC at the latest. A deadline, not an event.

    Sources: ^{[20][7][86][88]}

64. Oct 1, 00:12 UTC Reported observation

    Beaumont: Arctic Wolf set is new "spray and pray" activity

    He says the follow-up activity covered by the Arctic Wolf IoCs is definitely not related to the initial actor in early September.

    Sources: ^[73]

65. Oct 1, 15:22 UTC Research

    Poppelgaard checker v1.9 adds public indicators

    Release 1.9 of the free, read-only CTX697096 checker script adds, among others, Arctic Wolf's nsmon.pl implant, the Unit 42 .deb webshell and more attacker IPs, and tags each attack line as before or after the fix. Its author says a clean result is not proof of a clean appliance.

    Sources: ^[39]

66. Oct 1 Official advisory

    NCSC-FI (Finland): confirmed intrusions in Finland before the patches

    The National Cyber Security Centre Finland (NCSC-FI, part of Traficom) publishes an alert after receiving reports of active exploitation of the CTX697096 vulnerabilities in Finland, including intrusions that began before Citrix released the security updates on 27 September. The underlying Finnish warning page (Warning 1/2026) classifies it as a yellow warning ("Keltainen varoitus"). NCSC-FI says internet-facing NetScaler systems should be assumed to have been exposed to attacks, that updating alone may not be enough because an attacker may have established a persistent foothold, and that organisations must investigate for compromise even if they patched quickly: review logs and administrative changes, check user accounts created on the systems, scheduled tasks, services and other persistence, and change administrative passwords if compromise is suspected. NCSC-FI says it has identified hundreds of NetScaler instances in Finland and contacted their administrators, and asks organisations to report observed exploitation and intrusions.

    Sources: ^[19]

67. Oct 1 Official advisory

    BSI (Germany) updates its warning and recommends this site's IoC list

    BSI's TLP:CLEAR warning BITS-H 2026-289305-1132 (version 1.1, 1 Oct) rates the criticality 3 / Orange, meaning act immediately. It says logs should be checked back to at least early September, that patching alone does not remove a compromise, and that operators should check for a compromise even if they patched on release day. In its update it links to PitScaler as a place that collects detection options and IoCs from several sources, and recommends that operators use the growing IoC list.

    Sources: ^[18]

68. Oct 1 Official advisory Validated

    Citrix ships version 4 of its IoC detection logic

    Citrix has released a fourth version of the IoC detection logic used by the NetScaler Console scan. Citrix's documentation says the logic keeps being updated and that Console shows when an update is available, so rerun the scan after updating.

    Version 4 validated independently on 1 Oct.

    Sources: ^[6]

69. Oct 2, 06:00 UTC Research

    Analysis: "NetScaler Needs More Than Another Patch" - the case against treating each emergency as the fix

    A long-form analysis by "Martin" (mac.sploit.dk, 08:00 CEST, opinion; the site's about page says only that the author has "spent a long time working in cybersecurity") argues that the recurring emergency-patch cycle is the wrong frame. Its claims, each with stated boundaries: NetScaler 14.1 runs a vendor-modified FreeBSD 11.4 base (upstream EOL since September 2021); of 107 examined executables under /netscaler, 106 lack PIE and only one has RELRO (from the author's earlier lab assessment of build 73.30, not evidence of an internet-reachable path); most packet and control-plane services observed ran as root with no visible privilege drop, and the author reports a locally demonstrated authentication failure in the privileged configuration service. It reads Citrix's 1 October NetScaler 15.1-9.30 Tech Preview (FreeBSD to Linux, BLX/DPDK data plane, ASLR, SELinux auditing, Yama, faster third-party patching) as promising platform work that does not fix NetScaler's own application-layer bugs, and notes it is a days-old vendor-described preview, not independently tested. Also notes CVE-2026-88771 was a root Perl script passing failed-login text to a shell via backticks - command construction, not memory corruption - so memory-safety roadmaps alone would not have stopped it. Renewal-meeting checklist included (SBOM, privilege separation evidence, mitigation settings, session-kill guidance, ZTNA off-ramp). All vendor bulletins it cites are already on this page.

    Sources: ^[32]

70. Oct 2, 19:01 UTC Reported observation Validated

    Beaumont: patched honeypots crash, "we may have PitScaler 2"

    Beaumont says his patched 13.1 and 14.1 honeypots are crashing, from multiple source IPs, and posts greps for authentication-daemon (nsaaad) crashes and pitboss restart messages in ns.log, one of them for 213.209.159.55. The two screenshots in the post show a write-up (author not named) about two 14.1-73.37 appliances that rebooted repeatedly after nsaaad crashed with exit status 0x8a and hit the restart limit of six. On one of them, crafted usernames on SAML factors told the appliance to fetch a payload from 213.209.159.55 over plain HTTP on port 443, save it as /v and run it, just before each crash. The write-up says this shows exploitation attempts and correlated crashes, not confirmed command execution, a CVE or a firmware regression, and adds *.pyrlink.cc as a later delivery source. This is unverified: at the time there was no CVE and no vendor or CERT statement.

    Post text and both screenshots read directly on 2 Oct.

    Sources: ^[74]

71. Oct 2, 19:02 UTC Reported observation Validated

    Beaumont: the pitboss fix "looks bypassable" (to be confirmed)

    In a reply to his honeypot post, Beaumont says that, to be confirmed, it looks like the pitboss fix is bypassable. He gives no technical detail, and Citrix has not said whether builds with the CTX697096 fixes are affected by the new SAML issue.

    Post text read directly on 2 Oct.

    Sources: ^[76]

72. Oct 2, 19:19 UTC Reported observation Validated

    Beaumont: a patched honeypot is running a downloaded binary

    Beaumont says one of his honeypots is running a downloaded (malware) binary, that both were patched so he concludes it is a new vulnerability, and that it is being sprayed and prayed. One honeypot has no valid TLS certificate because he let it expire. He does not say whether the honeypots had SAML configured, and Citrix lists no affected versions yet. These are one researcher's observations and conclusions.

    Post text read directly on 2 Oct.

    Sources: ^[77]

73. Oct 2, 23:25 UTC Reported observation

    Beaumont: the responder policy he says Citrix shared as a SAML workaround does not work for him

    Asked by O_P whether he tried the responder policy from Citrix Support on his crashing honeypot - and whether enhanced ISN was on and he saw the reboots others report - Beaumont replies that "the policy citrix gave out doesn't work for me". This implies Citrix Support is sharing a responder policy as a workaround for the new SAML issue, and that it has not worked on at least one appliance. Single source; the policy text has not been seen, Citrix's own post does not mention any policy, and he does not answer the enhanced-ISN or reboot questions in the reply.

    Sources: ^[78]

74. Oct 2 Official advisory

    Citrix publishes guidance on a new SAML issue, independent of CTX697096

    Citrix says it is tracking a newly observed issue related to SAML authentication in customer-managed NetScaler deployments. The issue is associated with deployments that use SAML authentication in conjunction with Gateway or AAA functionality, and is configuration dependent based on the information currently available. The NetScaler is affected when at least one of the following SAML commands is present in the configuration: add authentication samlAction.* or add authentication samlIdPProfile.*. Recommended action: inspect the Gateway and AAA configuration for a SAML authentication action, contact Citrix support if currently experiencing impact, and upgrade to the updated software as soon as possible once the security bulletin is published. Citrix says the issue is independent of the vulnerabilities disclosed in CTX697096, that a new security bulletin and simultaneous product update release is planned, and that it will update the blog as more information becomes available. The post lists no CVE, affected versions, fixed builds or workaround yet, and points to the upcoming bulletin for the definitive list of affected versions, fixed builds and applicability conditions. Last updated 2 October (Pacific Daylight Time). Beaumont links the post at 20:00 UTC; his post was edited at 20:15 UTC, softening "pitboss will execute commands again" to "something will execute commands again" (per the edit history of the post).

    Sources: ^[2][75]

75. Oct 3, 01:40 UTC Reported observation

    Beaumont: "The Citrix support mitigations don't appear to work"; admins firewall-blocking attacker IPs

    Beaumont posts that the Citrix support mitigations do not appear to work, that admins are firewall-blocking known threat-actor IPs as a mitigation instead, and that many people cannot reach Citrix Support ("they've replaced people with AI chat bots"). His screenshot is an r/Citrix thread ("vulnerability scans causing netscaler reboots") where anonymous commenters report NetScaler restarts, one saying the responder-policy fix they received "didnt change anything", another that blackholing the attack IPs "semi works till they change their ip", and a third describing an endless Citrix support chatbot loop. Anonymous Reddit comments relayed via one researcher: unverified, no policy text, and no new IoCs. The thread matches the crash and reboot pattern in the earlier 14.1-73.37 screenshots.

    Sources: ^[79][106]

76. Oct 3, 08:23 UTC Reported observation

    heise: mass spontaneous reboots on fully patched devices; exploit "apparently circulating" since the evening of 2 October

    heise online (Dr. Christopher Kunz, 10:23 CEST) reports that security researchers and administrators are seeing mass spontaneous reboots of devices that were on the latest patch level, that an exploit for the new issue has apparently been circulating since the evening hours of 2 October, and that it can likely be triggered by sending SAML requests in bulk to a vulnerable device. It relays Beaumont's honeypot findings (a downloaded malware binary running on patched devices, so "new vulnerability") and frames the new issue as a possible bypass of the September fix - his framing, not Citrix's. It quotes the claim that "the watchTowr Labs team has now successfully reproduced the vulnerability" without naming its source; watchTowr's own X post the same day confirms the reproduction in its own words (see the next entry). heise notes Citrix's blog names no effective countermeasures and no patch exists yet, and links the same r/Citrix reboot thread. Says it will update the article continuously.

    Sources: ^{[103][77][79][2][106]}

77. ~Oct 3 Reported observation Approximate date

    Cybersecurity News rounds up the 14.1-73.37 reboot reports: crafted SAML traffic crashing nsaaad, pitboss restarting appliances

    Cybersecurity News (Guru Baran, article dated 3 October; the page shows only the date - earliest observed trace is a Bluesky share at 03:06 UTC, so the publication time is approximate) reports that customers are seeing repeated appliance reboots after installing build 14.1-73.37, linking them to crafted SAML authentication traffic that crashes the nsaaad authentication service until the pitboss watchdog restarts the appliance. It relays anonymous Reddit reports of severity-one cases with Citrix and of Citrix support "reportedly" preparing a fix, and states itself that these reports "do not yet prove attackers have bypassed the September patch" - a crash of nsaaad may be denial of service only, without sender control of the device. Secondary source: the underlying claims are anonymous forum posts it does not link individually, no new technical detail beyond the earlier r/Citrix thread, no Citrix statement, and no new IoCs. Its advice (preserve core files and logs before another restart, correlate reboot times with inbound SAML requests, check nsaaad crash messages in /var/core) matches the checks already on this page.

    Sources: ^[80][106]

78. Oct 3 Research

    watchTowr confirms it has reproduced the new vulnerability; mitigation rulesets for platform clients only

    watchTowr posts on X: "Unfortunately? Fortunately? the watchTowr Labs team has now successfully reproduced this vulnerability. watchTowr Platform clients now have mitigation rulesets available to them via our Active Defense capability. Speak soon." The post does not name the vulnerability; in context it is understood to be the SAML issue that heise quoted the same day, and that reading is this site's inference, not watchTowr's statement. What the post itself establishes, in watchTowr's own words: it has reproduced a vulnerability and has mitigation rulesets for Platform clients via Active Defense. Nothing indicates a public ruleset, advisory or IoCs yet. This site lists no watchTowr SAML indicators, and none are implied by this post.

    Sources: ^[50][103]

79. Oct 3 Official advisory

    Citrix releases a new responder policy via Support (3 October); not yet in Citrix's public post

    Citrix has released a new responder policy as a mitigation for the SAML issue, distributed through Citrix Support on 3 October. The Poppelgaard checker README describes it and recognises it by behaviour on the appliance: any responder policy whose rule mentions samlauth or doAuthentication, bound to a Gateway/AAA vserver or globally, alongside Citrix's earlier RSP_POL_DROP and community Gotham policies. Citrix's public SAML post does not mention the policy yet and its text has not been published; distribution is through Support (under NDA), which matches Beaumont's reports of a responder policy shared through Support ("the policy citrix gave out doesn't work for me" on Oct 2, "the Citrix support mitigations don't appear to work" on Oct 3). The checker reminds admins to ask Citrix Support for the new policy and verifies whether it is bound - and flags a [CHECK] state where a policy is bound but the Responder feature is disabled, which silently ignores it.

    Sources: ^{[39][2][78][79]}

80. Oct 3 Research

    FreeBSD Sliver C2 implant tied to pylrk.cc delivery: independent malware analysis (TLP:CLEAR), corroborated by Expel IR

    A TLP:CLEAR malware analysis report dated 2 October ties the two 2 October threads together: the payload served at f.pylrk.cc/HaKi2ufpiQ8AeVTZ/host is a Sliver C2 implant cross-compiled for FreeBSD - the operating system under NetScaler - built specifically for these appliances. Statically linked stripped Go ELF64, 8,822,784 bytes. Static strings (sample not executed): hardcoded C2 https://www.pylrk.cc, protocol tag pylrkfbsd, IMPLANT_CAPABILITY_TUNNEL_TERMINAL_V1 with tunnel/reverse-shell capability (consistent with the netcat-style callbacks Expel described in this campaign), a spoofed Chrome 108/Windows User-Agent for its own beacons, and no embedded IP - C2 resolves via DNS to pylrk.cc. VirusTotal: 31 of 75 engines, all Sliver/Vilers labels; first submitted 2 Oct 11:49 UTC; recorded filenames /var/tmp/.host, /private/var/tmp/.host and citrix3.bad (appliance paths). Corroboration: an Expel IR observation of exploitation against a NetScaler Gateway in late Sep-early Oct. This connects the pylrk.cc delivery domain to actual malware, and distinguishes this FreeBSD implant from the Perl webshell hosted on 213.209.159.55 (a separate, weaker-signal payload). The report is vendor-independent: no vendor or CERT has published on it. IoCs are on this page's IoC list.

    Sources: ^[41][59][40]

81. Oct 3 Official advisory

    ACSC update: the new SAML issue affects Australian organisations; "crashes, denial of service and potential exploitation"

    ASD's Australian Cyber Security Centre adds an "Update 3 October 2026" section to its alert: Citrix has published guidance about a newly identified issue affecting NetScaler deployments that use SAML authentication; a remote attacker exploiting the issue may induce system crashes, denial of service and potential exploitation; and ASD's ACSC is aware of impacts to Australian organisations. It advises organisations using NetScaler SAML authentication to review their configurations, monitor for unusual activity, follow Citrix's advice, contact Citrix support if impacted, and report to ACSC. It states the issue is understood to be separate from CVE-2026-88771 and CVE-2026-88772. This is the first government confirmation of impact from the new SAML issue, and it stops short of the September-patch-bypass claim: awareness of impacts is not the same as a confirmed bypass of 14.1-73.37. Alert first published 28 Sep, page last updated 3 Oct.

    Sources: ^[17][2]

Public IoCs Public / TLP:CLEAR only

This table only contains indicators that have been published openly. The Sharing column shows each source's own marking. ^{[53][57][33][34]}

• GreyNoise published its set on 28 September, marked TLP:CLEAR. GreyNoise has announced a longer "GreyNoise Labs" version, but the link on its blog was still a placeholder on 29 September.
• IFIN says the observables it shares were shared without restriction.
• Truesec's page is public and has no TLP marking.
• GTIG/Mandiant's blog is public and has no TLP marking. GTIG keeps its full IoC collection for registered GTI users only.

Download all IoCs as CSV Firewall blocklist (93 IPs, annotated) Plain IP list Domain blocklist (pylrk.cc wildcard, annotated) Plain domain list

The blocklist contains only the IPv4 indicators whose own source data does not warn against blocking. It excludes Cloudflare WARP egress, shared commercial VPN exits, residential/ISP (CGNAT) addresses and a domain-parking IP — those are in the CSV with their caveats. IPs differ per victim; a blocklist is defence in depth, not a substitute for patching and compromise checks.

The 2 October SAML-issue payload chain: f.pylrk.cc and the FreeBSD Sliver implant

A TLP:CLEAR malware analysis report (2 October, vendor-independent, corroborated by an Expel IR observation) and the delivery host's live state connect the new-issue delivery domain to an actual implant:

• pylrk.cc was registered on 2 Oct at 06:56 UTC (NameSilo, Cloudflare nameservers); the delivery subdomain f.pylrk.cc first appears in passive DNS at 11:50 UTC with a Let's Encrypt certificate (CN=pylrk.cc) issued at 06:01 UTC.
• f.pylrk.cc/HaKi2ufpiQ8AeVTZ/host served an 8,822,784-byte Go ELF64 binary over HTTPS (HTTP/2 200, application/octet-stream, Cloudflare-fronted). Still live and unchanged on 3 October.
• The binary is a Sliver C2 implant compiled for FreeBSD - the OS under NetScaler - with a hardcoded C2 reference to https://www.pylrk.cc, a custom protocol tag pylrkfbsd, tunnel/reverse-shell capability (IMPLANT_CAPABILITY_TUNNEL_TERMINAL_V1), a spoofed Chrome 108/Windows User-Agent for its own beacons, and no embedded IP (C2 resolves via DNS).
• VirusTotal: 31 of 75 engines detect it, all Sliver/Vilers-family labels; first submitted 2 Oct 11:49 UTC; recorded filenames include /var/tmp/.host and citrix3.bad - appliance deployment paths.
• A separate Perl-script payload (3-4 of 75 engines) is associated with 213.209.159.55, not with f.pylrk.cc; the two delivery chains are distinct in the public reporting.

The report is a static analysis (sample not executed) by an external team, not a vendor or CERT publication. Cloudflare fronts the delivery host: block the domain names and the hash, never the resolved proxy IPs. Hunt *.pylrk.cc in DNS logs rather than the single hostname - subdomains may rotate. ^[41]

Post-exploitation steps attempted on a GreyNoise sensor

GreyNoise says the attacker did not gain a foothold on its sensor. The steps below show the attacker's playbook, not a successful compromise.

• Set setuid and setgid on /bin/sh.
• Planted a PHP webshell that authenticates by cookie.
• Killed and restarted httpd, for anti-forensics or to activate the changed config.

A Reddit user described one sample of the .ctxs.receiver file, and IFIN relayed the description. This is unconfirmed. ^[57]

• The file is a 237-byte PHP one-liner.
• It runs a URL-decoded cookie value through passthru(), but only when a second cookie matches a hardcoded 16-character hex token.
• NetScaler uses both cookie names legitimately, so the traffic blends in.
• The file survived a reboot and the upgrade to 14.1-73.37.

The token likely differs per victim, so search the file's content rather than relying on its hash.

Source: GreyNoise, "Swarming Against Citrix 0-Day Exploitation". Victim-specific names and IPs from later IR-vendor writeups are deliberately left out. Beaumont warns that publishing them exposes organisations that have not yet remediated. ^[70]

Detection and hunting for NetScaler compromise

In short: review httpd.conf for PHP handler and AliasMatch changes, look for PHP files in VPN script and media directories, check /bin/sh for setuid, and correlate DTLSv1.0 handshake failures with NSPPE crashes. Sources: GTIG/Mandiant, CERT-EU and GreyNoise, as of 30 September 2026. ^[34][27]

dataset = citrix_adc_raw // replace with citrix_netscaler_raw if required
| filter _raw_log contains "pitboss"
| alter log_type = arrayindex(regextract(_raw_log, "<[^>]+>(?:[A-Za-z]{3}[ ]+[0-9]{1,2}[ ]+|[ ]+[0-9]{2}/[0-9]{2}/[0-9]{4}:)[0-9]{2}:[0-9]{2}:[0-9]{2}.+default ([\w]+)"), 0),
log_sub_type = arrayindex(regextract(_raw_log, "<[^>]+>(?:[A-Za-z]{3}[ ]+[0-9]{1,2}[ ]+|[ ]+[0-9]{2}/[0-9]{2}/[0-9]{4}:)[0-9]{2}:[0-9]{2}:[0-9]{2}.+default [\w]+ ([\w]+)"), 0),
command_attempted = arrayindex(regextract(_raw_log, "pitboss PPE unexpectedly died NSPPE(?:\-00|)\;(.+)\>, factor"), 0)
| filter command_attempted != null
| comp earliest(_time) as first_seen, latest(_time) as last_seen, values(log_type) as log_type, count() by command_attempted

Remediation: patching NetScaler ADC and Gateway

In short: check for compromise and preserve evidence first, then upgrade to 14.1-73.37 or 13.1-64.23 or later (FIPS/NDcPP builds below), per Citrix CTX697096 as of 30 September 2026. Patching does not remove an existing backdoor. ^[1]

Fixed builds (Citrix CTX697096)

Source: Citrix CTX697096. Use the bulletin as the authority for which build applies to your deployment.

13.1 upgrades: watchTowr advises running show ns variable first. If it returns any variables, use 13.1-64.24 to avoid a known reboot loop during the upgrade; Citrix lists this as a known issue in 13.1-64.23, not a vulnerability. ^[94][4] CVE-2026-88778 is fixed by enabling Enhanced ISN Generation, not by the upgrade alone. ^[21]

Other notes from Citrix: the NetScaler VPX 15.1 Technology Preview is also vulnerable. It is not permitted in production and Citrix says a fix will follow. The Console Security Advisory scan may wrongly flag 13.1-64.23 as vulnerable until the next automatic advisory update, with no need to upgrade Console. samlRejectUnsignedAssertion OFF is no longer supported and is converted to the secure default on upgrade, so make sure your identity provider signs SAML assertions. ^[4]

Cloudflare WAF: Cloudflare shipped an emergency managed rule on 1 October that blocks the CVE-2026-88771 improper-input-validation pattern. It covers only that CVE, and Cloudflare itself says to apply the latest versions to secure the origin. Treat it as a stopgap for appliances that sit behind Cloudflare, not a substitute for patching or a compromise check. ^[85]

Secure Private Access: Citrix says Secure Private Access Hybrid deployments that use NetScaler instances are also affected, so those instances need the same upgrade. The bulletin applies only to customer-managed NetScaler ADC and Gateway; Citrix upgrades its own managed cloud services and Citrix-managed Adaptive Authentication. ^[1]

End-of-life releases: NetScaler ADC and Gateway 12.1 and 13.0 are end of life, receive no fix and are likely vulnerable. Migrate them to a supported release. ^[23][60]

The bulletin is inconsistent about the last build. Its fixed-builds list says 13.1.37.279, while its affected-versions list says "FIPS and NDcPP BEFORE 13.1-37.279". Truesec and IFIN use 13.1-37.279. The table above keeps Citrix's fixed-builds wording exactly.

After patching

1. Check for compromise and preserve evidence before you patch. Mandiant's CTO, Charles Carmakal, says customers should examine their systems for compromise *before* upgrading/patching. ^[95] Unit 42 lists the evidence to capture: ^[96]
   • a NetScaler VPX instance snapshot
   • logs on remote syslog servers and in NetScaler Console
   • a technical support bundle
   • a packet engine core dump
   Patching and restarting can destroy this evidence. Citrix lists the same items and also says to record the system time, timezone and NTP settings first. ^[3]
2. Patch to a fixed build from the table above.
3. Hunt for compromise. Check for:
   • webshells, including the GreyNoise path and alias above
   • changes to httpd.conf, such as an unexpected AliasMatch
   • unusual permissions on /bin/sh, such as setuid or setgid
   Use the CERT-EU and CIRCL guidance. ^[27][24][53]
4. If compromise is suspected or confirmed, Citrix's CTX694799 says to:
   • take the appliance off the network;
   • change every secret stored on it on the systems it talks to (LDAP and RADIUS secrets, OAuth tokens, API keys, SNMP community names) and the passwords of users who signed in through it, and revoke its certificates and private keys;
   • check the servers and systems it connected to, especially authentication servers and management jump hosts;
   • rebuild rather than clean: replace a VPX instance, wipe and reinstall an MPX, upgrade the firmware, then restore a known good configuration backup that pre-dates the compromise;
   • rotate the local passwords and key encryption keys again after the restore, replace the restored certificates, and monitor closely for at least 90 days.
   Citrix says management services should never be exposed to the internet, and to consult legal counsel before rebuilding if law enforcement may become involved. ^[3]
5. Assume activity may be weeks old. Beaumont says slow disclosure means attackers have been active for weeks. ^[65]

Patching closes the vulnerabilities. It does not reverse a compromise that already happened. This page does not give remediation commands or guarantees. Follow Citrix and your national CSIRT.

NetScaler zero-day FAQ

References

Bracketed numbers in the text, such as ^[1], point to the rows below. Every link below is the exact URL from the compiled dataset. IFIN, Truesec, GTIG/Mandiant, Nextron, The Register, Unit 42, the Dutch government letter, two more Beaumont posts, the CVE record, a second BleepingComputer article, the Canada, HKCERT and ACSC advisories, eSentire, Beazley Security Labs, Ingeniøren, DKCERT, NHS England, the CERT-EU advisory, SDxCentral, heise, Dark Reading, Lupovis's own post, and the Censys, Shadowserver, Lupovis, Beazley, Corelight, Elastic, Sigma and Nuclei material were added later, on 29 September. Links marked verification pending did not load in an automated check at build time. The URL has been kept unchanged, not replaced. For all other links, the check only showed that the page loaded, not that its content was reviewed.