CVE-2026-109618: Citrix NetScaler PHP OOM corruption reaching the NetScaler management GUI

CVE-2026-109618 is a PHP vulnerability: PHP OOM corruption reaching the NetScaler management GUI, rated CVSS 4.0 9.2 Critical (CNA). PHP disclosed both vulnerabilities on 21 October 2026 with fixed releases the same day; Citrix confirmed in CTX697263 that NetScaler ADC and Gateway are affected through the management GUI only (NSIP, management-enabled SNIPs, cluster IP) - the Gateway and AAA logon path is not exposed - and published remediation builds on 27 October. Until upgraded, restrict management access to trusted administrative hosts with ACLs. [43][37][84] [37][50]

CVE
CVE-2026-109618
Product
PHP (reaching Citrix NetScaler ADC / Gateway through the management GUI)
Bulletin
CTX697263 (PHP) [37]
Severity
CVSS 4.0: 9.2 Critical (CNA)
Exploitation
Exploited in the wild (PHP, KEV)
CISA KEV
Yes, added 26 Oct 2026, federal deadline 29 Oct 2026, forensic triage required [50][30]
Disclosed
Fixed builds
NetScaler 14.1-73.49, 13.1-64.32 and FIPS/NDcPP builds (27 Oct); PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35

CVE-2026-109618

Exploited in the wild (PHP, KEV) CVSS 4.0: 9.2 Critical (CNA)
Type
PHP core vulnerability: RCE via out-of-memory (OOM) corruption - handling OOM errors via longjmp() leaves request memory partially initialized, and request cleanup can treat the invalid data as valid. Use-after-free class per public analysis. Not a NetScaler-specific flaw: it affects PHP itself. [43][45][154]
Exploitability
PHP validated full RCE over HTTP against Apache with mod_php with default input and memory limits; mod_php is the highest-risk path because an unauthenticated request can trigger exploitation before application code runs. Exploitability varies by SAPI, build and configuration - public PoCs are build-specific and do not work against every default install. Cloudflare reported early attack traffic on 21 Oct; Amazon MadPot telemetry recorded an exploitation attempt on 17 Oct, four days before disclosure. CISA added it to KEV on 26 Oct (due 29 Oct, forensic triage required). [43][48][50][156]
NetScaler exposure
NetScaler is affected because the Management Portal uses PHP: the NSIP GUI and API, SNIPs with management access enabled, and the cluster IP GUI. All supported builds were affected until the 27 Oct remediation builds (now confirmed on the Citrix downloads portal, with a Console CVE-Detection view and upgrade workflow for CVE-2026-109618). The Gateway and AAA logon path is NOT the same PHP surface - the standard data plane does not reach the management PHP. NetScaler Console (service and on-prem) and SVM are not impacted. Citrix-managed cloud services were already fixed. [37][38][40][42][84]
Data-plane exception
An LB or content-switching vserver that forwards to the management web server (the appliance management address or 127.0.0.1, port 80/443) puts the vulnerable PHP on the data plane, defeating the management/data-plane separation. Inspect actual forwarding rules rather than relying on the VIP label; the Poppelgaard checker v1.18 reports this state as exposed. [84][75]
Fix (NetScaler)
CTX697263 changelog 27 Oct: 14.1-73.49 and later, 13.1-64.32 and later, 14.1-73.49 FIPS and later, 13.1.37.286 FIPS/NDcPP and later; the same day the downloads portal lists the 14.1 Build 73.49 firmware, VPX images (including AWS/Azure/GCP), CPX, BLX and 14.1-FIPS Build 73.49, and CERT-FR relays the bulletin. These builds also contain the CTX697096, CVE-2026-88779 and CVE-2026-107406 fixes - the one build to install. Remko Weijnen and Jan Tytgat's 27 Oct binary teardown of 14.1-73.49: the upstream 8.1 fix is compiled in (both fix functions present, the bailout call gone), so the mechanisms of both CVEs are addressed - while PHP still reports 8.1.34, so version-based scanners will keep flagging the patched build. Citrix's upgrade notes: ICA/VPN sessions using pre-upgrade tickets are dropped, and samlRejectUnsignedAssertion OFF is forced to the secure default. Until upgraded, the mitigation is restricting management access to trusted administrative hosts and networks with ACLs (CTX228148). [37][38][40][41][39][85]
Fix (PHP)
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 Oct ahead of the scheduled 14:00 UTC time after details leaked. EOL branches 8.1 and older get source-only backports (7.4, 8.0, 8.1); NetScaler 14.1-73.46 ships PHP 8.1.34, the last 8.1 release. Citrix compiled the 8.1 backport branch into its own 8.1.34 tree for 73.49 rather than moving to a supported version - the version string stays 8.1.34 because a home-made 8.1.35 would collide with the PHP project's numbering. [43][45][84][85]
Workaround (PHP)
No generic config mitigation for CVE-2026-109618; updating is the only complete fix. session.upload_progress.enabled=0 addresses the CVE-2026-109619 family, not this one. WAF/size gates raise the bar for the >1MB body technique but are stopgaps. [43][45][89]
Related (PHP)
A second, separate RCE path in session upload progress, CVE-2026-115560, was disclosed as an informational advisory on 23 Oct. It requires an unusual serialize-handler switch and is unpatched until the next regular PHP release. Its NetScaler applicability is not established. [44]
Status
Exploited in the wild per CISA KEV (added 26 Oct, due 29 Oct) and vendor telemetry; per Palo Alto Networks it is not aware of malicious exploitation against PAN-OS. Neither CISA's KEV listing nor Unit 42's brief identifies NetScaler or PAN-OS appliances as the exploited product. No confirmed first-hand PHP2Shell compromise of a NetScaler appliance is established in public reporting as of 27 Oct. [50][154][51]

CVE-2026-109618 timeline

  1. Official advisory

    PHP2Shell disclosed and patched: PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 fix CVE-2026-109618 and CVE-2026-109619

    After details leaked on 20 Oct (screenshots and video of an exploit tool credited to "Calif"; PHP pulled the release a day forward from the original embargo), PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 13:52-13:55 UTC, ahead of the scheduled 14:00. Both vulnerabilities are CVSS 4.0 9.2 and allow unauthenticated RCE on any PHP installation serving web requests - PHP-FPM, Apache with mod_php (highest risk: exploitation before application code runs), php-cgi, FrankenPHP and LiteSpeed. CVE-2026-109618: out-of-memory handling leaves request data partially initialized and cleanup treats it as valid (GHSA-w8hw-w9fx-j79w). CVE-2026-109619: request-owned state survives free() and a later request on the same worker uses it (GHSA-6wmf-4rv5-p3rp) - session.upload_progress is one confirmed path, mitigable with session.upload_progress.enabled=0. Cloudflare reported early attacks from 07:43 UTC on 21 Oct and millions of attempts within 45 minutes of disclosure; Amazon MadPot telemetry recorded an attempt on 17 Oct, four days pre-disclosure; watchTowr observed exploitation in the wild through its honeypots. Dutch sites including Tweakers, the House of Representatives, NCSC and Security.NL went offline as a precaution. NVD published CVE-2026-109618 the same day (status later Analyzed, NVD primary CVSS 3.1, CNA 4.0 9.2 as Secondary). EOL branches 8.1 and older receive source-only backports - and NetScaler 14.1-73.46 ships PHP 8.1.34, which will never get an 8.1.35.

    Sources: [43][45][46][47][91][92][84]

  2. Official advisory

    CTX697263 published: PHP2Shell reaches the NetScaler management GUI; all supported builds affected; restrict management access now

    Citrix publishes security advisory CTX697263 confirming that NetScaler ADC and Gateway are impacted by PHP CVE-2026-109618 and CVE-2026-109619 because the NetScaler Management Portal uses PHP: all supported builds are affected, exposed through the NSIP GUI and API, SNIPs with management access enabled, and the cluster IP GUI. NetScaler Console (service and on-prem), Secure Private Access, StoreFront, Citrix Virtual Apps and Desktops, Workspace app, Endpoint Management and XenServer are not impacted; Citrix-managed cloud services were already fixed. Citrix's immediate mitigation is to restrict management access to trusted administrative hosts and networks (ACLs per CTX228148). Fixes were announced for 27 October and CTX697263's changelog added the remediation versions that day; the downloads portal lists the builds since 27 Oct. Remko Weijnen's 21 October firmware analysis, published hours before the advisory and confirmed by it, explains the boundary: on 14.1-73.46 the vulnerable PHP 8.1.34 runs behind the management interface only; the Gateway and AAA data plane proxies logon traffic to a loopback Apache vhost (127.0.0.1:81) with php_flag engine off, .php denied outright, and a LogonPoint package that contains no PHP at all. The exception that defeats the separation: an LB or content-switching vserver forwarding to the management web server - inspect actual forwarding rules rather than trusting the VIP label. Citrix also released WAF signature v186 for backend PHP applications; signatures for the management interface itself were still described as in development at last check - do not confuse the two.

    Sources: [37][38][84][52]

  3. Official advisory

    CISA's PHP alert gains a SIGMA rule; Unit 42 retracts its PHP2Shell link the same weekend

    CISA's PHP alert revision (23 Oct) adds a SIGMA detection rule (CISA_SIGMA_261429, TLP:CLEAR, request patterns, public-exploit markers, PHP error messages and reported infrastructure) and partner resources, and tells organisations that cannot update immediately - including those on unsupported PHP 8.1 or earlier - to take affected systems offline until patched. Separately, Unit 42's threat brief had added (23 Oct) an account of an attack against a European government agency using agentic AI platforms for rapid post-exploitation with access to password hashes and MFA secrets within two hours; on 25 October Unit 42 retracted the association with the PHP2Shell CVEs, saying it could not confirm the initial access was tied to them. Both the SIGMA listing and the retraction stand independently: the rule hunts broad PHP exploitation signals, and the retracted claim never established a NetScaler or PAN-OS connection.

    Sources: [48][49][154]

  4. Official advisory

    CISA adds both PHP2Shell CVEs to KEV (due 29 Oct); PAN-OS hotfixes roll out

    CISA adds CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog (date added 26 Oct, federal due date 29 Oct, forensic triage required per BOD 26-04, ransomware use Unknown). The listing does not identify NetScaler or PAN-OS appliances as the exploited product - it concerns PHP itself. The same day Palo Alto Networks lists its first seven PAN-OS hotfixes as released (10.2.18-h13, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 11.2.10-h16), with remaining builds estimated 27-30 Oct; PAN-OS and Panorama are affected through the management web interface (product CVSS-B 8.7) and Palo Alto says it is not aware of malicious exploitation against its products. Unit 42 has by now retracted (25 Oct) its 23 October association of a European government-agency incident with the specific PHP2Shell CVEs: the attack involved a vulnerable PHP application, but Unit 42 could not confirm the initial access vector - the remaining hunting queries are broad post-exploitation leads, not CVE-specific proof.

    Sources: [50][48][51][154]

  5. Official advisory

    Remko Weijnen and Jan Tytgat verify the fix in the binaries: 14.1-73.49 contains the upstream 8.1 backport; PHP still reports 8.1.34 - version-based scanners will false-positive

    Part 3 of the PHP2Shell series takes 14.1-73.49 apart and compares it with 73.46. Findings: both libphp.so and bin/php in 73.49 export the two functions the upstream fix adds (zend_mm_safe_error_ex, zend_new_array_singleton) - 73.46 exports neither; the zend_alloc.c bailout string is gone from the binary; sapi_deactivate_module, php_request_shutdown and zend_shutdown_executor_values now clear the stale pointers. The code matches the PHP project's 8.1 backport branch down to function names, format strings and which fields are cleared, so Citrix backported the upstream fix into its own PHP 8.1.34 tree instead of moving to a supported version. What did not change: the version string stays PHP 8.1.34 (the 8.1.35 number belongs to the PHP project), php.ini keeps memory_limit 1084M and post_max_size 1500M, and the kernel is still FreeBSD 11.4 without ASLR. Practical consequence: any scanner judging by the PHP version will keep flagging the patched build as vulnerable - a false positive; the patch state is the NetScaler build number against CTX697263. The authors analyse one build only, did not run an exploit, and note the 13.1 and FIPS builds should get the same check. The same day, r/Citrix users publish matching field observations: a radiff2 comparison of the 73.41 and 73.49 php binaries shows the new zend_mm_safe_error_ex handler, a reworked JSON engine and a /bin/php 1168 bytes smaller with php -v still reporting 8.1.34 built 22 Oct; an IDA-based comment confirms the fixes come from the 8.1 backport branch.

    Sources: [85][171][172]

  6. Official advisory

    CTX697263 gains NetScaler PHP2Shell remediation builds: 14.1-73.49 / 13.1-64.32 / FIPS equivalents; downloads portal lists them; checker v1.18 follows

    Citrix's changelog for CTX697263 (the PHP2Shell advisory for CVE-2026-109618 / CVE-2026-109619, initially published 22 Oct) gains a 27 October entry: "Updated remediation versions for Citrix NetScaler ADC and Citrix NetScaler Gateway". The bulletin now strongly urges upgrades to 14.1-73.49 or later, 13.1-64.32 or later, 14.1-73.49 FIPS or later, and 13.1.37.286 or later for 13.1-FIPS/NDcPP (the final dotted spelling is Citrix's). These builds also contain the CTX697096, CVE-2026-88779 and CVE-2026-107406 fixes, so they are the one build to install. Citrix's upgrade notes for 14.1-73.49 / 13.1-64.32: ICA and VPN sessions drop during the upgrade, and samlRejectUnsignedAssertion OFF is forced ON. Downloads-portal availability is now independently confirmed: the Citrix downloads portal lists the 14.1 Build 73.49 firmware, VPX images (including AWS/Azure/GCP), CPX, BLX and 14.1-FIPS Build 73.49, all dated 27 Oct and marked NEW, alongside 13.1 Build 64.32 and the 13.1-FIPS/NDcPP 37.286 equivalents, and CERT-FR relays the bulletin the same day. The Poppelgaard checker reaches v1.18 the same day: on a build without the PHP fix, a management GUI open to any source in the NetScaler ACLs, or forwarded by an LB vserver, is now marked VULNERABLE (verdict VULNERABLE_PHP2SHELL, exit code 2); a GUI restricted by ACLs is a [CHECK] (exit 1), not clean; a fixed build whose PHP module lacks the two fix functions returns [CHECK] with advice to confirm with Citrix Support. Today's remediation bulletin covers CVE-2026-109618 / -109619 only - do not assume it covers CVE-2026-115560.

    Sources: [37][38][40][41][75]

Questions about CVE-2026-109618

What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and does it affect my NetScaler?

PHP2Shell is two critical vulnerabilities in PHP itself (each CVSS v4.0 9.2), fixed on 21 Oct 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and exploited in the wild (CISA KEV 26 Oct, due 29 Oct). Citrix confirmed in CTX697263 (22 Oct; remediation builds 27 Oct) that NetScaler is affected because the Management Portal uses PHP: the NSIP GUI and API, SNIPs with management access enabled, and the cluster IP GUI. The Gateway and AAA logon path is NOT the same PHP surface - on that path PHP is switched off - and NetScaler Console and SVM are not impacted. Until you run 14.1-73.49 / 13.1-64.32 (or FIPS equivalents), restrict management access to trusted administrative hosts with ACLs, and check that no LB or content-switching vserver forwards to the management web server - that would put the vulnerable PHP on the data plane. [37][38][84][43][50]

Which PHP versions fix PHP2Shell, and what about CVE-2026-115560?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 Oct 2026) fix CVE-2026-109618 and CVE-2026-109619; PHP 8.1 and older are end of life and receive source-only backports (7.4, 8.0, 8.1) - NetScaler 14.1-73.46 shipped PHP 8.1.34, so the appliance fix comes only from the CTX697263 builds, which compile the 8.1 backport into Citrix's own 8.1.34 tree (the version string stays 8.1.34 - see the scanner false-positive question above). For CVE-2026-115560 (informational advisory, 23 Oct): the issue needs session.serialize_handler initially php_binary or php_serialize, switched to php at runtime before session_start(), with upload progress enabled; the mitigation is session.upload_progress.enabled=0 until the next regular PHP bugfix release. If you disabled that setting for CVE-2026-109619 and kept it, no further action is needed for this vector; applications that never switch the handler at runtime can leave it enabled. As of 27 Oct, neither NetScaler applicability nor a Citrix fix for 115560 has been established, and the NVD record had not appeared. [43][44][84][85]

Next steps

Related pages

References

#SourceTypeURL
1Citrix - CTX697096 security bulletin (Sep 27)Primary official advisorieshttps://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html
2Citrix community blog - Security Update: Guidance for NetScaler SAML Authentication Deployments (Oct 2; new issue, independent of CTX697096)Primary official advisorieshttps://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/
3Citrix - CTX697174 security bulletin for CVE-2026-88779 (Oct 3; fixed builds 14.1-73.41, 13.1-64.28, FIPS/NDcPP) and the accompanying Citrix blog on Global Deny List mitigationsPrimary official advisorieshttps://support.citrix.com/external/article/CTX697174/citrix-netscaler-adc-and-citrix-netscale.html
4Citrix - CTX697191 security bulletin for CVE-2026-107406 (Oct 8; SAML memory overflow leading to RCE or DoS, CVSS v4.0 9.5; fixed builds 14.1-73.46, 13.1-64.29 and the FIPS/NDcPP builds; no workaround listed)Primary official advisorieshttps://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html
5Citrix community blog - Protecting Customers: Immediate Guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway (Oct 8, updated 17:00 PDT; the blog sits behind a bot check and could not be read directly; per secondary reproductions of the advisory it adds no exploitation claim beyond the bulletin - Citrix not aware of any unmitigated exploits - and recommends restricting SAML/gateway reachability and disabling unused SAML configurations alongside upgrading)Primary official advisorieshttps://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/
6NIST NVD - CVE-2026-107406 record (published Oct 8 22:17 UTC, status Received; CNA CVSS v4.0 9.5 carried as Secondary; analysis not started)Primary official advisorieshttps://nvd.nist.gov/vuln/detail/CVE-2026-107406
7CERT-FR (ANSSI) - Avis CERTFR-2026-AVI-1285 (Oct 9; Citrix NetScaler ADC and Gateway, CVE-2026-107406, RCE or remote DoS; refers to Citrix CTX697191 for fixes)Primary official advisorieshttps://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1285/
8MS-ISAC advisory 2026-110 (Oct 8; CVE-2026-107406 - states there are currently no reports of the vulnerability being exploited in the wild; notes four Citrix CVEs added to CISA KEV in recent weeks and assesses exploit chaining across some of them)Primary official advisorieshttps://www.cisecurity.org/advisory/a-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-could-allow-for-remote-code-execution_2026-110
9NCSC New Zealand - Multiple vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway products (Sep 28, updated 14 Oct 2026 with CVE-2026-107406: appliances patched per the original advisory are still vulnerable to it; patching is not sufficient to remediate compromised systems)Primary official advisorieshttps://www.ncsc.govt.nz/alerts/multiple-vulnerabilities-affecting-citrix-netscaler-adc-and-netscaler-gateway-products-2/
10Canadian Centre for Cyber Security - Citrix security advisory AV26-1023 (Oct 9; CVE-2026-107406 build guidance; does not describe exploitation)Primary official advisorieshttps://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-1023
11CCB Belgium / Safeonweb (Oct 9) - Warning: Critical RCE vulnerability in Citrix NetScaler, Patch ImmediatelyPrimary official advisorieshttps://ccb.belgium.be/advisories/warning-critical-rce-vulnerability-citrix-netscaler-patch-immediately
12Citrix - CTX694799 Steps to Take if NetScaler ADC is Suspected to be CompromisedPrimary official advisorieshttps://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html
13Citrix community blog - Security Bulletin for CVE-2026-88771 through CVE-2026-88778 (incl. IoC section; last updated Sep 30) verification pendingPrimary official advisorieshttps://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/
14Citrix (CTX-Michael) on r/Citrix, Sep 27 - CRITICAL UPDATE announcementPrimary official advisorieshttps://www.reddit.com/r/Citrix/comments/1wro1yf/critical_update_citrix_netscaler_adc_and_citrix/
15NetScaler Console documentation - Indicators of Compromise detection (incl. Citrix disclaimer on limits; page moved/withdrawn from docs.netscaler.com as of 6 Oct - URL now redirects to the docs home)Primary official advisorieshttps://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc
16CISA alert - Critical zero-day vulnerabilities exploited in Citrix NetScaler ADC/Gateway (Sep 27; updated Oct 2 with a SIGMA detection rule; revised Oct 9 to add CVE-2026-88779 and CVE-2026-107406 and to confirm the reboot/re-execution relationship between the two)Primary official advisorieshttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
17CISA Code & Media Analysis SIGMA rule - Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (TLP:CLEAR, test status; repo may be updated)Primary official advisorieshttps://github.com/cisagov/SIGMA_Rules/blob/develop/CMA_SIGMA_Citrix_CVE_2026_8871.yaml
18NCSC-NL advisory NCSC-2026-0394, version 1.0.1 (Sep 30; probability high, damage high; per-CVE scores and preconditions)Primary official advisorieshttps://advisories.ncsc.nl/2026/ncsc-2026-0394.html
19NCSC-UK - Exploitation of vulnerabilities affecting Citrix NetScaler ADC and GatewayPrimary official advisorieshttps://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway
20CSA Singapore - AL-2026-129Primary official advisorieshttps://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-129/
21Canadian Centre for Cyber Security - AL26-024Primary official advisorieshttps://www.cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772
22CERT-FR alert CERTFR-2026-ALE-011 (Sep 28, updated Sep 30)Primary official advisorieshttps://cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/
23CSSF (Luxembourg) communique - Multiple Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway (Sep 28)Primary official advisorieshttps://www.cssf.lu/en/2026/09/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway/
24CERT Quebec CERTQC-AVIS-2026-364 (Sep 28, TLP:CLEAR)Primary official advisorieshttps://www.cyber.gouv.qc.ca/avis/certqc-avis-2026-364
25HKCERT - Citrix Products Multiple Vulnerabilities (Sep 28)Primary official advisorieshttps://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928
26ACSC (Australia) - Critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway (28 Sep; updated 3 Oct with the new SAML issue and confirmed Australian impacts)Primary official advisorieshttps://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/critical-vulnerabilities-in-citrix-netscaler-adc-and-citrix-netscaler-gateway-products
27BSI (Germany) - Citrix NetScaler: Systeme werden ueber ZeroDay-Schwachstellen angegriffen, BITS-H 2026-289305-1132, version 1.1 (Oct 1, TLP:CLEAR)Primary official advisorieshttps://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-289305-1032.pdf?__blob=publicationFile&v=4
28NCSC-FI / Traficom (Finland) - Citrix NetScaler vulnerabilities exploited in Finland (1 Oct; intrusions in Finland before the patches; 20 Oct: the warning is closed - no new exploitation or intrusion reports since 1 Oct, most exposed systems updated, and NCSC-FI still recommends log retention and monitoring for delayed detections)Primary official advisorieshttps://kyberturvallisuuskeskus.fi/en/news/citrix-netscaler-vulnerabilities-exploited-finland
29NCSC-FI / Traficom (Finland) - Citrix NetScaler -haavoittuvuuksia koskeva varoitus on päättynyt (20 Oct, in Finnish: the 1 Oct warning is ended; no new reports of exploitation attempts or intrusions since publication, most exposed systems updated per NCSC-FI observations, organisations still advised to verify all systems are updated, retain logs and keep monitoring to rule out delayed detections; reporting exploitation observations remains welcome)Primary official advisorieshttps://www.kyberturvallisuuskeskus.fi/fi/uutiset/citrix-netscaler-haavoittuvuuksia-koskeva-varoitus-paattynyt
30CISA Known Exploited Vulnerabilities catalog (CVE-2026-88771 and -88772 added Sep 27, due Sep 30; CVE-2026-88779 added Oct 4, due Oct 7)Primary official advisorieshttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
31CERT-EU Security Advisory 2026-014 - Critical Vulnerabilities in Citrix NetScaler ADC and Gateway (Sep 27)Primary official advisorieshttps://cert.europa.eu/publications/security-advisories/2026-014/
32DKCERT (CERT for Danish universities and research) - To kritiske NetScaler 0-dage udnyttes aktivt før patch (Sep 29)Primary official advisorieshttps://cert.dk/node/639
33NHS England Digital cyber alert CC-4858 (Sep 28) - Exploitation of zero-day vulnerabilities affecting Citrix NetScalerPrimary official advisorieshttps://digital.nhs.uk/cyber-alerts/2026/cc-4858
34CIRCL TR-100 - per-CVE configuration-check CLI commandsPrimary official advisorieshttps://www.circl.lu/pub/tr-100/
35Dutch government letter to parliament - Kwetsbaarheden Citrix Netscaler (2026D47262, Sep 29)Primary official advisorieshttps://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2026D47262&did=2026D47262
36CVE.org - CVE-2026-88771 record (reserved Sep 10 07:14 UTC by NetScaler; published Sep 27 16:02 UTC)Primary official advisorieshttps://www.cve.org/CVERecord?id=CVE-2026-88771
37Citrix - CTX697263 security advisory for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell, published 22 Oct; changelog 27 Oct: updated remediation versions - 14.1-73.49 and later, 13.1-64.32 and later, 14.1-73.49 FIPS and later, 13.1.37.286 FIPS/NDcPP and later; NetScaler Console, Secure Private Access, StoreFront, Citrix Virtual Apps and Desktops, Workspace app, Endpoint Management and XenServer not impacted; Citrix-managed cloud services already fixed)Primary official advisorieshttps://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve-2026-109618-and-cve.html
38Citrix community blog - Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE-2026-109619 (21 Oct; sits behind a bot check and could not be fetched directly - content per reproductions and the live page; it confirms only the management interfaces are affected - NSIP GUI and API, SNIPs with management access, cluster IP GUI - recommends restricting management access to trusted administrative hosts with ACLs per CTX228148; as of 27 Oct it states explicitly that the remediation 14.1 and 13.1 builds are available, replacing the earlier "planned for today" wording with the build numbers unchanged, and that WAF signature v186 covers backend PHP applications while management-interface signatures were still in development at last check; published at protect-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640)Primary official advisorieshttps://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/
39NetScaler ADC (includes NetScaler Gateway) - Release notes 14.1-73.49 (27 Oct; build replaces 14.1-73.46; the document itself lists no security-related fixes and points to CTX697263; ICA/VPN sessions using pre-upgrade session tickets are dropped; samlRejectUnsignedAssertion OFF is converted to the secure default)Primary official advisorieshttps://docs.netscaler.com/en-us/updates/citrix_adc/citrix_adc_14_1_73_49.pdf
40Citrix downloads portal - NetScaler Release 14.1 Build 73.49 (27 Oct, marked NEW: MPX firmware, VPX including AWS/Azure/GCP images, CPX, BLX and 14.1-FIPS Build 73.49; 13.1 Build 64.32 and 13.1-FIPS/NDcPP 37.286 equivalents listed the same day)Primary official advisorieshttps://www.citrix.com/downloads/citrix-adc/
41CERT-FR (ANSSI) - Avis CERTFR-2026-AVI-1394 (27 Oct; relays CTX697263: remote code execution risk, affected 14.1/13.1/FIPS/NDcPP version ranges, refers to the Citrix bulletin for fixes)Primary official advisorieshttps://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1394/
42NetScaler Console documentation - Identify and remediate vulnerabilities for CVE-2026-109618 (27 Oct; the CVE Detection view lists impacted instances, an on-demand Scan-Now and a Proceed-to-upgrade workflow)Primary official advisorieshttps://docs.netscaler.com/us/en/netscaler-console-service/security-advisory-dashboard/remediate-vulnerabilities-cve-2026-109618.html
43PHP - Security advisory: Critical remote code execution vulnerabilities, update now (21 Oct, php.net archive 2026-10-21-5; releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), both CVSS 4.0 9.2; every PHP installation serving web requests is at risk, mod_php highest risk; source backports for EOL 7.4, 8.0 and 8.1)Primary official advisorieshttps://www.php.net/archive/2026.php#2026-10-21-5
44PHP - Informational advisory: Session upload progress (23 Oct, php.net archive 2026-10-23-1; CVE-2026-115560: requires session.serialize_handler initially php_binary or php_serialize, changed to php at runtime via ini_set() before session_start(), with upload progress enabled; recommends session.upload_progress.enabled=0 until the next regular bugfix release, which is also the 21 Oct CVE-2026-109619 mitigation - if applied then, keep it; full advisory promised with the next release; no NetScaler applicability established as of 27 Oct)Primary official advisorieshttps://www.php.net/archive/2026.php#2026-10-23-1
45PHP php-src security advisory GHSA-w8hw-w9fx-j79w - CVE-2026-109618, RCE via OOM corruption (21 Oct)Primary official advisorieshttps://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
46PHP php-src security advisory GHSA-6wmf-4rv5-p3rp - CVE-2026-109619, RCE via stale global state (21 Oct)Primary official advisorieshttps://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
47NIST NVD - CVE-2026-109618 record (published 21 Oct 14:17 UTC, status Analyzed; NVD primary CVSS 3.1, CNA CVSS 4.0 9.2 as Secondary)Primary official advisorieshttps://nvd.nist.gov/vuln/detail/CVE-2026-109618
48CISA alert - Critical Vulnerabilities in PHP Require Immediate Patching (21 Oct; revised 23 Oct with a SIGMA detection rule and partner resources; updated 26 Oct for the KEV additions of both CVEs, federal due 29 Oct, forensic triage required)Primary official advisorieshttps://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
49CISA Code & Media Analysis SIGMA rule - PHP2Shell CVE-2026-109618/-109619 exploitation attempts (TLP:CLEAR, dated 21 Oct, modified 23 Oct; request patterns, exploit markers, PHP error messages and reported infrastructure)Primary official advisorieshttps://github.com/cisagov/SIGMA_Rules/blob/develop/CISA_SIGMA_261429_CVE_2026_109618-109619_PHP2Shell_TLP_CLEAR.yaml
50CISA KEV - CVE-2026-109618 and CVE-2026-109619 added 26 Oct 2026, federal due date 29 Oct, forensic triage required, ransomware use unknownPrimary official advisorieshttps://www.cisa.gov/known-exploited-vulnerabilities-catalog
51Palo Alto Networks - Impact of CVE-2026-109618/-109619 on Palo Alto Networks Products (21 Oct, updated through 25 Oct: PAN-OS and Panorama affected via the management web interface, product CVSS-B 8.7; hotfixes rolling out branch by branch - 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16 released, remaining builds estimated 27-30 Oct; not aware of malicious exploitation against its products; GlobalProtect and Captive Portal not affected)Primary official advisorieshttps://security.paloaltonetworks.com/CVE-2026-109618
52Beacon Lab (US) - Alert 2026-117: Two critical vulnerabilities in PHP (21 Oct, updated 23 Oct; confirms the Citrix exposure model - NSIP GUI, management SNIPs, cluster IP; Console and SVM not affected; Citrix WAF signature v186 covers backend PHP applications while management-interface signatures are being developed; ACL guidance preserving Console access before DENY rules)Primary official advisorieshttps://beaconlab.us/en/publication/alert-2026-117-two-critical-vulnerabilities-in-php-with-pending-emergency-update/
53Tenable Research Special Operations - FAQ on the reported Citrix NetScaler zero-days (Sep 27, last updated Oct 4 with CVE-2026-88779, KEV addition and GDL mitigations; also first to report the leaked NCSC-NL pre-notification TLP marking)Technical researchhttps://www.tenable.com/blog/frequently-asked-questions-about-reported-citrix-netscaler-zero-day-vulnerabilities
54Beazley Security (Oct 8 advisory) - Critical Remote Code Execution Vulnerability in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-107406; notes no independent technical analysis or public PoC known at time of writing, recommends removing unused SAML configurations and restricting SAML endpoints)Technical researchhttps://beazley.security/alerts-advisories/critical-remote-code-execution-vulnerability-in-citrix-netscaler-adc-and-netscaler-gateway
55DEV Community reproduction of Citrix's CVE-2026-107406 advisory (Oct 8-9; full breakdown of the blog + bulletin: attack flow, investigation triggers, MITRE mapping T1190/T1499.004, IdP/SP version ranges, "not aware of any unmitigated exploits" wording; third-party reproduction, not the Citrix text itself)Technical researchhttps://dev.to/anoymask/citrix-netscaler-cve-2026-107406-pre-authentication-rce-and-dos-via-saml-configuration-ae9
56CERT-EU - Taking "execute logging" a bit too literally - CVE-2026-88771 (Sep 28)Technical researchhttps://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771
57watchTowr Labs part 1 - Oh Look, the Foot Gun Went Off Again (CVE-2026-88771) (Sep 28)Technical researchhttps://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
58watchTowr Detection Artefact Generator - CVE-2026-88771 (GitHub)Technical researchhttps://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771
59watchTowr Labs part 2 - Here We Go Again (CVE-2026-88772), Sina Kheirkhah (Sep 29)Technical researchhttps://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/
60watchTowr Detection Artefact Generator - CVE-2026-88772 (GitHub)Technical researchhttps://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772
61watchTowr Intel - Post-Exploitation Analysis & Artifacts: Citrix NetScaler CVE-2026-88771 (Oct 7; honeypot sensor network: OOB probes, Sliver ns_helper implant, trojanized Dropbear SSH backdoor on tcp/37512, Perl stager with gw_health superuser and password-keyed PHP webshell, SSH-key spray, ns.conf theft; warm-reload claim for CVE-2026-88772/88779 crashes)Technical researchhttps://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/
62Martin's Blog (mac.sploit.dk) - "NetScaler Needs More Than Another Patch" (Oct 2 08:00 CEST; opinion/analysis: platform posture, 15.1 Linux Tech Preview, what to demand at renewal)Technical researchhttps://mac.sploit.dk/blog/netscaler-needs-more-than-a-patch/
63Martin's Blog (mac.sploit.dk) - "CVE-2026-88771: From a Failed NetScaler Login to a Shell" (Sep 29; reverse engineering of ns_monuploadd_err.pl on 14.1-73.30/73.37: source-to-shell path, -WR trigger not reproduced, detection engineering with confidence levels)Technical researchhttps://mac.sploit.dk/blog/cve-2026-88771-netscaler-login-log-command-injection/
64Martin's Blog (mac.sploit.dk) - "CVE-2026-88772: Following a NetScaler DTLS Overflow Across Two Builds" (Sep 29; binary comparison of nsppe 73.30/73.37: missing cumulative bound, 0x8c00 capacity check added; static only, no exploit run; flags type-DTLS load-balancing vservers as easy-to-miss exposure)Technical researchhttps://mac.sploit.dk/blog/cve-2026-88772-netscaler-dtls-memory-overflow/
65cirosec - "Hiding your NetScaler from mass exploitation with SNI" (27 Oct; part 1 IR: in cirosec's own cases attackers swept entire address ranges around 20 Sep and attacked anything that answered on the IP that looked like a NetScaler, and default-state logging meant logs had rotated out before investigation; part 2 hardening: SNI-only certificate bindings with SNI enforcement in a custom frontend SSL profile leave an IP-only scanner with no certificate, optionally plus a CLIENTHELLO_REQ policy that resets every ClientHello without the exact hostname; a single remaining non-SNI certificate binding defeats the concealment even with allowUnknownSNI DISABLED; builds on Johannes Norz's SNI-binding write-up; verification tool SNItch on GitHub; stated limits: not a patch and ineffective against anyone who knows the hostname - certificate transparency logs publish it, so they recommend a new non-obvious hostname behind a wildcard certificate, which makes the reset policy mandatory; DTLS on UDP/443 untested; tested on CPX 13.0/14.1 and 14.1 in profile mode only, so VPX/MPX behaviour is not established; IP-only health checks and monitors break; the profile-mode switch is global and hard to reverse, with a legacy-mode variant also tested)Technical researchhttps://cirosec.de/en/news/hiding-your-netscaler-from-mass-exploitation-with-sni/
66Johannes Norz - "Blocking requests to the IP address in SSL vServers on Citrix NetScaler ADC" (the SNI-binding approach cirosec builds on)Technical researchhttps://norz.at/?p=2419
67Martin's Blog (mac.sploit.dk) - "Finding the NetScaler SAML Crash in nsaaad" (Oct 3, updated Oct 4; reverse engineering + controlled lab: canonicalize_data 16-entry unterminated stack array, canary read as string pointer, SIGBUS in strlen; internal-message path only, no AAA licence for external test; fixed-build comparison not done)Technical researchhttps://mac.sploit.dk/blog/netscaler-saml-prefixlist-nsaaad-crash/
68Rapid7 ETR - Zero-Day Exploitation of Citrix NetScaler ADC and Gateway (Sep 28; last updated Oct 19: overview links to the separate Rapid7 Analysis of the confirmed 88771+88779 chain; earlier updates Oct 6: MDR observed exploitation from 20 Sep 14:28 UTC by 149.104.78.208 - tar of /flash/nsconfig to /vpn/c - two organisations compromised; .ctxs.receiver webshell sample hash ed082f74... observed 24 Sep)Technical researchhttps://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/
69Truesec - Multiple Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway (Sep 28)Technical researchhttps://www.truesec.com/hub/blog/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway
70Google GTIG / Mandiant - Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances (Sep 29)Technical researchhttps://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances
71Nextron Systems (Florian Roth) - New THOR Detection Coverage for CVE-2026-88771 and CVE-2026-88772 (Sep 29)Technical researchhttps://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/
72Arctic Wolf - Citrix NetScaler Active Exploitation via CVE-2026-88771 (IoC pack, Sep 30)Technical researchhttps://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771
73Sygnia - Actively Exploited NetScaler Vulnerabilities (IR-based advisory, Sep 30)Technical researchhttps://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/
74TENEX - What TENEX Observed Inside Active Exploitation of CVE-2026-88771 (Sep 30)Technical researchhttps://tenex.ai/blog/what-tenex-observed-inside-active-exploitation-of-netscaler-zero-day/
75Poppelgaard - NetScaler CTX697096/CTX697174/CTX697191/CTX697263 checker (free read-only script, source-available under PolyForm Shield from v1.17, MIT through v1.16; v1.18 released 27 Oct: php2shell status by build - fixed in 14.1-73.49 (also FIPS), 13.1-64.32 and 13.1.37.286 FIPS/NDcPP per CTX697263 - and on a build without the fix, a management GUI open to any source in the NetScaler ACLs, or forwarded by an LB vserver, is now VULNERABLE (verdict VULNERABLE_PHP2SHELL, exit code 2) while a restricted GUI is a [CHECK] (exit 1); a fixed build whose PHP module lacks the two fix functions returns [CHECK] to confirm with Citrix Support; v1.17 released 22 Oct: php2shell check on every run (PHP version and fix status, management addresses NSIP/SNIP/cluster IP and whether ACLs close ports 80/443 per CTX228148, LB vservers forwarding to the management web server, PHP stopgap settings, php2shell hunting leads - management POSTs from public addresses and PHP OOM errors/Apache child crashes since 17 Oct, never red), Zscaler ThreatLabz and watchTowr indicators (kw2 /var/kw2s11, Nx_ webshells, PHP enabled in httpd.conf, the Dropbear walk backdoor, gw_health, the lo@vps SSH key), a file-integrity check of the web GUI on 14.1-73.46 against a clean appliance per Manuel Winkel (Deyda) references, per-vserver MFA check, nobody-defunct false-alarm fix; v1.16 released Oct 8: CVE-2026-107406 build and SAML IdP/SP check on every run - verdict VULNERABLE_CVE-2026-107406 and exit code 2 also on builds already fixed for CTX697096 and CVE-2026-88779 - plus a community-reported overnight wave of the same login injection fetching https://v5v.in/r.sh?k=<key>|sh, payload host v5v.in and IP 72.5.65.111 added, totals 132 IPs / 18 domains / 38 hashes; v1.15 Oct 8: WHIPSHOT/SLAPSHOT scanning detection per Lupovis, log-reflection technique - a whole shell script parked in a tagged User-Agent landing in the HTTP access log, then the CVE-2026-88771 injection runs only grep <tag>: /var/log/htt* | sed ... | sh - the SOCRadar "NetScaler C2" automated injection tool with polling agent /tmp/.nsagent (compromise) and 45.143.130.195, and 16 Huntback.io attacker IPs, compromise check now runs by default on the appliance, receiver.deb / random 12-char .deb theme-folder probes, g-suffix .css cache-bypass requests; v1.14: config/SSL-key theft payload - ns.conf + /nsconfig/ssl/*.key dumped to a random 6-char .css in LogonPoint, exfil to 81.94.239.8:8877 via curl --data-binary; pick-up 200 = compromise, 404 = failed; VERDICT: COMPROMISED exit code; PR #4/#5: .php/.phtml under /var/netscaler/logon and /var/vpn, setuid/setgid under /var, /tmp, /nsconfig, /flash, /home, /root, CVE-2023-3519 gnuplot.php and /var/rgroupadd; v1.12 removed pyrlnk.cc per issue #3)Technical researchhttps://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker
76Beazley Security second-wave indicators (BSL-A1216, updated Oct 4 with Update 6; carried in the Poppelgaard checker v1.12 via Gotham Technology Group, shared with permission)Technical researchhttps://labs.beazley.security/advisories/BSL-A1216
77Previdian (@PrevidianCyber) - NetScaler honeypot sensors (Oct 5: installer script dropping the 'host' ELF from f.pylrk.cc to /nsconfig/.nsl and /var/nslog/.nsl during CVE-2026-88771 exploitation attempts; 51.158.203.95 targeting multiple vulnerabilities since 25 Aug; single-source)Technical researchhttps://x.com/PrevidianCyber/status/2107091061579649152
78SOCRadar - NetScaler C2: CVE-2026-88771 Exploitation Operation (Oct 7; full teardown of an in-the-wild autonomous mass-exploitation framework: FOFA recon up to ~120k candidates, version fingerprinting, injection across 11 unauthenticated endpoints every 30 minutes via the admautoregd daemon with a 24-hour/reboot execution window, lightweight polling C2 agent /tmp/.nsagent with DNS OOB fallback, Simplified-Chinese comments suggesting AI-assisted development and a Chinese-speaking operator)Technical researchhttps://socradar.io/blog/netscaler-c2-cve-2026-88771-exploitation/
79Binary Defense ARC Labs - "Platypwned: When a Citrix 0-Day Lays an Egg" (Oct 12; first-hand IR on two compromised appliances: private Platypus fork with fork-only rootesc/selfpersist modules, FreeBSD and Windows agents from one build tree, HA-sync analysis - httpd.conf and ssh keys sync to the secondary within a minute while webshell directories do not, JARM and three platypus-ingress cert thumbprints, Namecheap batch-registered aged domains, Russian-registered white-guard.pro as protected tier, prior Havoc C2 history on the same server; attribution low-confidence to financially motivated Eastern European/CIS operators, not nation-state)Technical researchhttps://binarydefense.com/resources/blog/platypwned-when-a-citrix-0-day-lays-an-egg
80Poppelgaard - CVE-2026-88771 through CVE-2026-88778, CVE-2026-88779, CVE-2026-107406 and php2shell, what you should know and how to fix (Sep 28, last updated Oct 22 with the php2shell management-GUI analysis, ACL examples per CTX228148, and a note on fixes planned for 27 Oct - since realized; earlier updates Oct 2)Technical researchhttps://www.poppelgaard.com/cve-2026-88771-through-cve-2026-88778-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway
81External malware analysis report (TLP:CLEAR, 2 Oct) - "Sliver C2 Implant Delivered via Citrix NetScaler Exploitation (CVE-2026-88771)"; independent static analysis, corroborated by Expel IR observationTechnical researchhttps://www.virustotal.com/gui/file/0188b0eba4b01c4fb838df9d1d76c76d7f1dc22897e25161975b606c134c1027
82LevelBlue SpiderLabs (THOR team) - CVE-2026-88771 Observed Exploitation Artifacts and Hunt Indicators (Sep 30; own findings, not independently confirmed)Technical researchhttps://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators
83Zscaler ThreatLabz - CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability (Oct 16; staged INDEX:<base64> User-Agent log staging, pitboss poisoning via /nf/auth/doAuthentication.do and /cgi/login with a grep+b64decode -r|sh trigger, Nx_<number>.html/.php/.pl webshells and Perl CGI shells, php_engine and AddHandler cgi-script .pl enablement, kw2-freebsd-x64-s11 Rust FreeBSD implant from 209.141.43.95 overlapping StyleSmuggler CVE-2026-75650 infrastructure, a 26-IP burst, 28 source IPs and Sh3llc0de-sourced hunt commands)Technical researchhttps://www.zscaler.com/blogs/security-research/cve-2026-88771-inside-exploitation-critical-netscaler-rce-vulnerability
84Remko Weijnen - "Does PHP2Shell reach NetScaler? Taking the firmware apart to find out" (21 Oct 18:19 CEST, static analysis of 14.1-73.46: PHP 8.1.34 - the last 8.1 release, EOL since 31 Dec 2025 - libphp.so lacks both fix functions (zend_mm_safe_error_ex, zend_new_array_singleton); exposed = management GUI via Apache mod_php on NSIP, management-enabled SNIPs/MIPs and the cluster IP; not exposed = the Gateway/AAA data plane, where the packet engine proxies logon traffic to a loopback vhost 127.0.0.1:81 with php_flag engine off, Require all denied on .php, and a LogonPoint package containing no PHP at all; exception = an LB or content-switching vserver forwarding to the management web server puts the PHP on the data plane; follow-up 22 Oct on ASLR)Technical researchhttps://remkoweijnen.nl/blog/2026/10/21/netscaler-php2shell/
85Remko Weijnen and Jan Tytgat - "Did Citrix really fix PHP2Shell on NetScaler? Taking the patched firmware apart" (27 Oct, part 3; static analysis of 14.1-73.49 vs 73.46: the upstream 8.1 backport is compiled into libphp.so and bin/php - both fix functions present, the zend_alloc.c bailout string gone, sapi_deactivate_module/php_request_shutdown/zend_shutdown_executor_values clear the stale globals - the mechanisms of CVE-2026-109618 and CVE-2026-109619 are fixed; PHP still reports 8.1.34 and the FreeBSD 11.4 kernel still has no ASLR, and php.ini is unchanged; version-based scanners will false-positive on the patched build - the NetScaler build number vs CTX697263 is the patch state; not confirmed by Citrix, no exploit run)Technical researchhttps://remkoweijnen.nl/blog/2026/10/27/netscaler-php2shell-citrix-patch/
86Rapid7 - "NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779" (Rapid7 Analysis, published 19 Oct, updated 22 Oct; first-hand IR on an affected 14.1 appliance compromised in early October: confirmed two-CVE chain, repeated post-reboot crash-handler execution, HA-aware persistence, Go recon scanner, nsvmd FreeBSD proxy, staged config/loot collection with confirmed exfil via the web interface; six hashes, 13 IPs, one C2 domain and on-appliance paths; YARA rules for Intelligence Hub customers)Technical researchhttps://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/
87Rubrik Zero Labs - "From Databases to Dialplans: Uncovering Platypus Deployment Attempts" (15 Oct; operator scripts reusing the entretiensol[.]com Platypus distribution infrastructure across Oracle-to-Windows/AD (ora23.sh, RTA23W scheduled task, rt23o.ps1, system-health.exe / health-monitor.exe) and Redis/Asterisk VoIP workflows (/tmp/system-health, rte_go.sh); Rubrik explicitly found no evidence these attacks exploited the NetScaler CVE; 12 file hashes, 173.255.247.97, one YARA rule; full IoC feed limited to RZL customers)Technical researchhttps://zerolabs.rubrik.com/blog/databases-dialplans-uncovering-platypus-deployment-attempts
88ExtraHop - "Anatomy of an Attack: NetScaler Exploitation, Hidden Web Shells, and Internal Pivots" (19 Oct; network-detection synthesis of earlier vendor/IR findings: inspect AddHandler/AddType/Alias/AliasMatch changes, non-PHP files configured as PHP, unusual outbound and east-west connections from NSIP/SNIP addresses; older observations cited as background, not fresh exploitation evidence)Technical researchhttps://www.extrahop.com/blog/aoa-netscaler-exploitation-hidden-web-shells-and-internal-pivots
89Abstract Security - PHP2Shell: Critical PHP RCE Vulnerabilities (21 Oct; technical breakdown: CVE-2026-109618 rawkey OOM path needs a >1MB request body and is blockable at the edge with a size gate; CVE-2026-109619 targets the session.upload_progress callback with a ~450-byte body that size-based WAF rules do not catch; Snort/Suricata rules)Technical researchhttps://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619
90Zscaler ThreatLabz - CVE-2026-109618 and CVE-2026-109619: PHP2Shell (21 Oct; use-after-free analysis of both bugs, the chainability of the pair, and memory/credential-disclosure impact)Technical researchhttps://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce
91watchTowr - PHP2Shell FAQ (CVE-2026-109618 & CVE-2026-109619) (updated as details emerge; confirmed the leaked vulnerabilities were real on 20 Oct, exploitation in the wild through its Attacker Eye honeypot network from 21 Oct; older unsupported branches including PHP 5 also affected)Technical researchhttps://watchtowr.com/intelligence/php-cve-2026-109618-faq/
92Sansec - PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619) (21 Oct, updated 22 Oct: public PoCs do not work against a default PHP install, several need an added LFI bug; mass exploitation less likely than first expected but patch anyway; lists affected CMS versions; notes the Dutch precautionary shutdowns on 21 Oct)Technical researchhttps://sansec.io/research/php2shell
93Beazley Security advisory (updated Sep 29) - IoC table incl. Lupovis honeypot IPsTechnical researchhttps://beazley.security/alerts-advisories/critical-vulnerability-in-citrix-netscaler-zero-day-prompts-emergency-shutdowns-cve-2026-88771-cve-2026-88772
94Corelight - Hunting Citrix NetScaler zero-days (Zeek queries, Sep 28)Technical researchhttps://corelight.com/blog/hunting-citrix-netscaler-zero-days-corelight
95Elastic detection rule - Potential NetScaler Log Poisoning Command Injection Attempt (merged Sep 28)Technical researchhttps://github.com/elastic/detection-rules/blob/main/rules/network/initial_access_netscaler_log_poisoning_command_injection.toml
96SigmaHQ pull request #6352 - NetScaler auth endpoint shell metacharacters (open, Sep 29)Technical researchhttps://github.com/SigmaHQ/sigma/pull/6352
97Nuclei templates pull request #17336 - CVE-2026-88771 active probe (open, Sep 28)Technical researchhttps://github.com/projectdiscovery/nuclei-templates/pull/17336
98eSentire TRU - Update: ongoing exploitation of NetScaler CVE-2026-88771 / -88772 (first-hand IR, Sep 29); "More Shells Than a Seafood Buffet" cluster analysis (blog, Oct 6: four clusters A-D with hashes, timing and tooling)Technical researchhttps://www.esentire.com/security-advisories/update-ongoing-exploitation-of-citrix-netscaler-adc-and-netscaler-gateway-vulnerabilities-cve-2026-88771-cve-2026-88772
99eSentire TRU blog - "More Shells Than a Seafood Buffet: Tracking Citrix NetScaler Exploitation Activities (CVE-2026-88771)" (Oct 6; four clusters: A pre-disclosure nsgtrust.deb webshell, B Platypus via 62.133.62.80 at 3 customers ~24h post-disclosure, C update_c08937.pl via 64.94.85.67 at 4 customers using the watchTowr PoC, D Python reverse shell from 23.27.143.20; notes LLM-style comments in the Perl installer)Technical researchhttps://www.esentire.com/blog/more-shells-than-a-seafood-buffet-tracking-citrix-netscaler-exploitation-activities-cve-2026-88771
100Lumen / Black Lotus Labs - expanded JDY IoT and SOHO botnet research (cited by eSentire for the Platypus/China-nexus association in Cluster B)Technical researchhttps://www.lumen.com/blog/en-us/expanded-jdy-iot-and-soho-botnet-enables-rapid-vulnerability-exploitation
101Beazley Security Labs - BSL-A1216 advisory (first published Sep 26; updates 2-4, Sep 27-29; Update 5 Oct 2; Update 6 Oct 4): consolidated IoCs and hunting commandsTechnical researchhttps://labs.beazley.security/advisories/BSL-A1216
102watchTowr (@watchtowrcyber) - "the watchTowr Labs team has now successfully reproduced this vulnerability" (Oct 3 X post; the vulnerability is not named in the text, understood to be the new SAML issue)Technical researchhttps://x.com/watchtowrcyber/status/2106177591438958751
103watchTowr (@watchtowrcyber) on X, Sep 26 - "Unpatched, 0days. Exploited in-the-wild - discovered during forensics."Technical researchhttps://x.com/watchtowrcyber/status/2103972792043479307
104CyberMaxx - Patches required: Citrix NetScaler vulns exploited in the wild (IoC notes)Technical researchhttps://www.cybermaxx.com/resources/patches-required-citrix-netscaler-vulns-exploited-in-the-wild-cve-2026-88771-and-cve-2026-88772/
105watchTowr - IoC repository for CVE-2026-88771 (GitHub; behavioral indicators, host artifacts, backdoor gw_health account, 47 source IPs, OOB callback domains, Sliver C2 indicators and URI regex, 5 SHA-256 hashes, hunting commands)Telemetry and IoCshttps://github.com/watchtowrlabs/citrix-netscaler-cve-2026-88771-iocs
106GreyNoise - Swarming Against Citrix 0-Day Exploitation (TLP:CLEAR IoCs, Sep 28)Telemetry and IoCshttps://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation
107GreyNoise Chronicle - GNTL-20260928 CVE-2026-88771 timelineTelemetry and IoCshttps://www.greynoise.io/chronicle/gntl-20260928-citrix-cve-2026-88771
108GreyNoise Visualizer - IP 149.104.78.141Telemetry and IoCshttps://viz.greynoise.io/ips/149.104.78.141
109GreyNoise tag - Citrix NetScaler CVE-2026-88771 Login Command Injection RCE AttemptTelemetry and IoCshttps://viz.greynoise.io/tags/citrix-netscaler-cve-2026-88771-login-command-injection-rce-attempt
110CrowdSec VulnTracking report - CVE-2026-88771: A Patched Box Is Not a Clean Box (Oct 19; 308 signals Sep 28-Oct 18, 24 unique source IPs since Sep 22 on the Live Exploit Tracker, pre-disclosure attempts Sep 22-26, watchTowr research fleet 38% of CTI-linked signals, one Russian Prospero OOO address with 107 signals Oct 10-15, no virtual-patching rule in the CrowdSec Hub)Telemetry and IoCshttps://www.crowdsec.net/vulntracking-report/cve-2026-88771-citrix-netscaler-pre-auth-command-injection
111IFIN - Multiple Citrix Netscaler 0-Days Exploited (tracking thread, from Sep 26; observables "shared without restriction")Telemetry and IoCshttps://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867
112VirusTotal - Perl file b9b0a438... (first submitted Oct 2 17:29 UTC; 3 of 75 engines by late 2 Oct); a Nextron THOR rule for CVE-2026-88771 and a community comment tie it to NetScaler exploitationTelemetry and IoCshttps://www.virustotal.com/gui/file/b9b0a4380db462c706597bd3e6a08d4d99fcbbf0919d63eb99b488d396c8ce63
113VirusTotal - ELF Sliver implant 0188b0eb... (31 of 75 engines; first submitted 2 Oct 11:49 UTC); served from f.pylrk.cc/HaKi2ufpiQ8AeVTZ/host, TLP:CLEAR malware analysis reportTelemetry and IoCshttps://www.virustotal.com/gui/file/0188b0eba4b01c4fb838df9d1d76c76d7f1dc22897e25161975b606c134c1027
114Censys advisory - NetScaler exposure (42,735 hosts, Sep 28); original advisory URL renumbered - now redirects to the CVE-2026-88771/88772 advisory pageTelemetry and IoCshttps://censys.com/advisory/cve-2026-88771-cve-2026-88772/
115Defused (@DefusedCyber) on X, Sep 29 - decoy hits across multiple CVE-2026-88771 pathsTelemetry and IoCshttps://x.com/DefusedCyber/status/2104888497693708505
116Lupovis (@LupovisDefence) on X, Sep 28 - decoys catch CVE-2026-88771 exploitation hours after the PoCTelemetry and IoCshttps://x.com/lupovisdefence/status/2104595071362326680
117Beaumont, Sep 27 - chained CVEs, webshells all September, "Probably nation state aligned"Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117343729453093307
118Beaumont, Sep 27 - patches live; detection script behind NDA; patching does not remove backdoorsKevin Beaumonthttps://cyberplace.social/@GossiTheDog/117343821114841048
119Beaumont, Sep 27 - Console check misses attempts when logs have rotatedKevin Beaumonthttps://cyberplace.social/@GossiTheDog/117345540231975640
120Beaumont, Sep 28 22:49 UTC - names "PitScaler", >100 victim orgs (his claim)Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117351107654208046
121Beaumont, Sep 28 23:02 UTC - Citrix checker incomplete (suid /bin/sh)Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117351155381900219
122Beaumont, Sep 29 04:39 UTC - mass exploitation, <10% patched (his claim)Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117352481501981552
123Beaumont, Sep 29 06:18 UTC - public message to the NSA (his unverified claim)Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117352869498139711
124Beaumont, Sep 29 16:12 UTC - IR vendors publishing victim-unique webshell namesKevin Beaumonthttps://cyberplace.social/@GossiTheDog/117355208096613386
125Beaumont, Sep 28 15:13 UTC - GitHub "PoCs" for the new Citrix vulns are "fake AI slop"Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117349313638958333
126Beaumont, Sep 29 18:32 UTC - Dutch government shuts down all Citrix NetScalers (relaying @bert_hubert)Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117355758746619146
127Beaumont, Oct 1 00:12 UTC - Arctic Wolf IoCs cover follow-up "spray and pray" activity, not the early-September actorKevin Beaumonthttps://cyberplace.social/@GossiTheDog/117362758120876296
128Beaumont, Oct 2 19:01 UTC - patched 13.1 and 14.1 honeypots are crashing; "we may have #PitScaler 2 on our hands" (with two screenshots of an unattributed write-up)Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117372857146978531
129Beaumont, Oct 2 20:00 UTC - Citrix has published a blog on the new SAML issue (edited 20:15 UTC: "pitboss will execute" softened to "something will execute")Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117373090409884785
130Beaumont, Oct 2 19:02 UTC - "to be confirmed but it looks like the pitboss fix is bypassable"Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117372864244958549
131Beaumont, Oct 2 19:19 UTC - one patched honeypot is running a downloaded binary; "sprayed and prayed"Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117372929427365765
132Beaumont, Oct 2 23:25 UTC - "the policy citrix gave out doesn't work for me" (reply to O_P about a responder policy from Citrix Support)Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117373896333693635
133Beaumont, Oct 3 01:40 UTC - "The Citrix support mitigations don't appear to work" (with a screenshot of an r/Citrix thread)Kevin Beaumonthttps://cyberplace.social/@GossiTheDog/117374427108683985
134Security Online (Oct 9) - Citrix NetScaler vulnerability CVE-2026-107406 is critical (quotes Citrix customer guidance: not aware of any unmitigated exploits)Press and vendor coveragehttps://securityonline.info/citrix-netscaler-vulnerability-cve-2026-107406
135The Register (Oct 9) - Citrix gives NetScaler admins another critical reason to patch (CVE-2026-107406 coverage; notes Citrix did not say whether it was exploited as a zero-day before disclosure)Press and vendor coveragehttps://www.theregister.com/security/2026/10/09/citrix-gives-netscaler-admins-another-critical-reason-to-patch/5302212
136The Hacker News (Oct 9) - Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML DeploymentsPress and vendor coveragehttps://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html
137SecurityWeek (Oct 9) - Citrix Urges Immediate Patching of Critical NetScaler VulnerabilityPress and vendor coveragehttps://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability
138Cybersecurity News - "Citrix NetScaler Keeps Rebooting Following the 0-Day Patch" (Guru Baran, Oct 3; page shows only the date; secondary, Reddit-based)Press and vendor coveragehttps://cybersecuritynews.com/citrix-netscaler-0-day-patch/
139BleepingComputer (Sep 29) - Hackers exploit Citrix NetScaler zero-day to deploy web shellsPress and vendor coveragehttps://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/
140BleepingComputer (Sep 27) - Citrix admins warned to shut down NetScalersPress and vendor coveragehttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
141The Stack (Oct 1) - Banks, gov'ts, telcos hit by hackers amid escalating NetScaler incidentPress and vendor coveragehttps://www.thestack.technology/banks-govts-telcos-hit-by-hackers-amid-escalating-netscaler-incident-2/
142Help Net Security (Sep 30) - Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)Press and vendor coveragehttps://www.helpnetsecurity.com/2026/09/30/cve-2026-88772-netscaler-exploitation-zero-day/
143Cloudflare changelog (Oct 1) - WAF Release 2026-10-01, Emergency: Citrix NetScaler CVE-2026-88771 managed rulePress and vendor coveragehttps://developers.cloudflare.com/changelog/post/2026-10-01-emergency-waf-release/
144Qualys ThreatPROTECT (Sep 28) - Citrix NetScaler zero-day vulnerabilities exploited in attacksPress and vendor coveragehttps://threatprotect.qualys.com/2026/09/28/citrix-netscaler-adc-and-gateway-zero-day-vulnerabilities-exploited-in-attacks-cve-2026-88771-cve-2026-88772/
145The Hacker News (Oct 1) - Citrix NetScaler post-exploitation payload creates superuser, maps web shell to CSS-like URLs (note: THN has also published unrelated third-party-appliance breach coverage sometimes mislinked to NetScaler)Press and vendor coveragehttps://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html
146BleepingComputer (Sep 28) - CISA orders feds to patch exploited Citrix flaws by WednesdayPress and vendor coveragehttps://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-exploited-citrix-flaws-by-wednesday/
147SecurityWeek (Sep 28) - Citrix confirms 2 NetScaler zero-daysPress and vendor coveragehttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/
148The Record (Sep 28) - US, UK warn of Citrix NetScaler zero-day bugPress and vendor coveragehttps://therecord.media/us-uk-warn-of-citrix-netscaler-zero-day-bug
149CyberScoop (Sep 28) - delayed-disclosure anglePress and vendor coveragehttps://cyberscoop.com/citrix-zero-days-delayed-disclosure/
150Sophos CTU (Sep 28) - CVE-2026-88771 / -88772 in active exploitationPress and vendor coveragehttps://www.sophos.com/en-us/blog/citrix-netscaler-cve-2026-88771-cve-2026-88772-in-active-exploitation
151watchTowr FAQ (Sep 27-28)Press and vendor coveragehttps://watchtowr.com/intelligence/citrix-netscaler-zero-day-vulnerabilities-faq/
152The Register (Sep 29) - Custom malware used in Citrix 0-day attacks targeting govt, banks, professional servicesPress and vendor coveragehttps://www.theregister.com/security/2026/09/29/custom-malware-used-in-citrix-0-day-attacks-targeting-govt-banks-professional-services/5299867
153Unit 42 (Palo Alto Networks) - NetScaler zero-days threat brief (Sep 27, updated Sep 28 and Sep 30 with pre- and post-disclosure activity and IoCs)Press and vendor coveragehttps://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
154Unit 42 (Palo Alto Networks) - Threat Brief: Critical Vulnerabilities in PHP (21 Oct, updated 23 Oct with an agentic-AI post-compromise case at a European government agency; on 25 Oct Unit 42 retracted the 23 Oct association with the PHP2Shell CVEs - the attack ran in the context of a vulnerable PHP application, but initial access could not be confirmed as tied to the specific CVEs; hunting queries remain as broad post-exploitation leads)Press and vendor coveragehttps://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
155Cloudflare blog - "There's always a patient zero: Defending the NetScaler front door before the patch" (19 Oct 13:00 UTC; architecture guidance: move the access decision in front of the authentication service with Access and WAF, and have the origin enforce the same boundary - a DNS change and an Access policy alone do not stop direct access to the original IP or an alternate hostname; the desktop transport and DTLS listeners need separate exposure review; its emergency WAF rule for CVE-2026-88771 dates to 1 Oct, outside this release)Press and vendor coveragehttps://blog.cloudflare.com/protect-your-netscaler-gateway/
156Agentbeam / secondary coverage of the StealMyBitcoin challenge - public PHP2Shell challenge on an unpatched PHP 8.4.26 server solved 25 Oct 15:47 UTC after 19.28 hours by a researcher known as killa, with a public PoC (KillaBoi/StealMyBitcoin-PoC, Alpine PHP 8.4.26 lab, ~7 of 10 lab runs); the recovered key did not match the advertised wallet - a lab/research result, not a production or appliance compromisePress and vendor coveragehttps://agentbeam.com/blog/stealmybitcoin-php2shell-challenge-solved-19-hours-what-it-proves
157Cybersecurity Dive (Sep 28) - Shadowserver: more than 20,000 instances exposedPress and vendor coveragehttps://www.cybersecuritydive.com/news/citrix-upgrades-netscaler-exploitation/831502/
158Help Net Security (Sep 29) - NetScaler zero-day exploitation escalates into mass attacks (Lupovis, Censys)Press and vendor coveragehttps://www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771/
159Ingeniøren (Sep 30) - Alvorlige huller i kendt software: PET, Forsvaret og Politiet hastelukker systemerPress and vendor coveragehttps://ing.dk/artikel/alvorlige-huller-i-kendt-software-pet-forsvaret-og-politiet-hastelukker-systemer
160SDxCentral (Sep 29) - NetScaler bugs bring critical sectors down in Europe (citing Techzine)Press and vendor coveragehttps://www.sdxcentral.com/news/netscaler-bugs-bring-critical-sectors-down-in-europe/
161Cybersecurity Dive (Sep 29) - Citrix NetScaler exploitation began days before public notificationPress and vendor coveragehttps://www.cybersecuritydive.com/news/citrix-netscaler-exploitation-days-before-notification/831634/
162heise online (Sep 27) - New zero-day exploits in Citrix NetScalerPress and vendor coveragehttps://www.heise.de/en/news/Security-researchers-warn-New-zero-day-exploits-in-Citrix-Netscaler-11467269.html
163heise online (Oct 3 10:23 CEST) - "Netscaler-Admins aufgepasst: Zero-Day verursacht Crashes und Codeausfuehrung" (Dr. Christopher Kunz; cites Beaumont and a watchTowr reproduction claim, confirmed by watchTowr's own post the same day)Press and vendor coveragehttps://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html
164Dark Reading (Sep 29) - Dual NetScaler Zero-Days Trigger Chaos for Citrix CustomersPress and vendor coveragehttps://www.darkreading.com/vulnerabilities-threats/netscaler-zero-days-chaos-citrix
165Omroep Brabant (Sep 27) - Storing bij ziekenhuizen door kritieke kwetsbaarheden in systeem (Amphia, ETZ, Z-CERT)Press and vendor coveragehttps://www.omroepbrabant.nl/nieuws/6028828/storing-bij-ziekenhuizen-door-kritieke-kwetsbaarheden-in-systeem
166Citrix community forum - "Update: ... Security Bulletin for CVE-2026-88779" thread (customer comments Oct 4-5 on Console labelling and stat denylist global AAA_REQUEST behaviour; unconfirmed, no Citrix reply)Communityhttps://community.citrix.com/forums/topic/259166-update-citrix-netscaler-adc-and-citrix-netscaler-gateway-security-bulletin-for-cve-2026-88779/
167r/Citrix - "vulnerability scans causing netscaler reboots" thread (early Oct; anonymous comments, unverified)Communityhttps://www.reddit.com/r/Citrix/comments/1wvwuno/vulnerability_scans_causing_netscaler_reboots/
168Maurice_Sec on X - notes from the field on NetScaler Console IoC scanner findingsCommunityhttps://x.com/Maurice_Sec/status/2104541998858240487
169r/Citrix - "Netscaler leak?" thread (~Sep 26)Communityhttps://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/
170r/Citrix - comment by asmOne (about 29 Sep; date approximate) quoting log-poison attemptsCommunityhttps://www.reddit.com/r/Citrix/comments/1wqjk9a/comment/pcub9wh/
171r/Citrix - "Netscaler 14.1-73-49 update released for CVE-2026-109618 and CVE-2026-109619" (27 Oct 13:23 UTC, u/TheCopernicus, 22 comments; field reports: lukemeup patched three 14.1 HA pairs without issues; silkyjohnstamos reports several customer upgrades that seemed buggy - HA trouble on 13.1, SSL and EDT problems - and calls the release rushed to meet CISA/NSA pressure, his unverified characterisation; independent reverse engineering in the comments confirms the fix is in the binaries with no PHP version bump)Communityhttps://www.reddit.com/r/Citrix/comments/1xgser0/netscaler_1417349_update_released_for/
172r/Citrix - comment by esxiguy on the 73.49 thread (27 Oct; radiff2 comparison of the php binaries in 73.41 and 73.49: new zend_mm_safe_error_ex handler, a reworked JSON parsing engine and php_pcre_replace_impl changes, /bin/php 1168 bytes smaller on 73.49, php -v still 8.1.34 built 22 Oct 2026; and a reply by johntimehole confirming IDA analysis: the fixes from the PHP 8.1-CVE-2026-109618-109619 backport branch are applied, no version bump)Communityhttps://www.reddit.com/r/Citrix/comments/1xgser0/comment/