Bitget $388M Breach via Citrix NetScaler ADC Zero-Day Exploit

https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772
https://flagthis.com/tldr/8192

##Bitget ##ZeroDay ##LazarusGroup ##DataBreach ##Citrix

If you are having #Citrix #Netscaler issues after applying all patches and remediations and want to confidentially share intel, let us know: tipsIFIN

PGP key available at

The latest update for #GripMatix includes "NetScaler Console Indicators of Compromise Detection" and "Notes from the Field: Incomplete #Monitoring Data After Upgrading to #Citrix VAD 2603".

#SCOM #SysCtr https://opsmtrs.com/3z4TsF2

Citrix flags a NetScaler SAML authentication issue as patched NetScaler appliances reboot after CVE-2026-88771 attacks. Check your config.

#Citrix #NetScaler #SAML #CVE202688771 #CVE202688772 #ZeroDay #Vulnerability

*Sigh*

The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.

ifin.network/t/multi...

#Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN

Citrix is reportedly down for some users. Are you one of them? #Citrix #CitrixCloud #CitrixDown https://statusisdown.com/service/citrix/

Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE

🌐 cyber[.]netsecops[.]io

Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE

🌐 cyber[.]netsecops[.]io

Cisco warned of an actively exploited SD-WAN auth-bypass zero-day, while Citrix NetScaler flaws enabled pre-auth shellcode and web shells. Bitget also disclosed a third-party security product hack. #Cisco #Citrix #Bitget

Critical zero-days hit Cisco SD-WAN Manager, Citrix NetScaler gateways, and Zimbra mail servers as threat actors seize root access and deploy tunnels while China-nexus espionage cluster UAT-11587 breaches Asian agencies.

inferlume.com/reports/dail...

#ZeroDay #Cisco #Citrix #Zimbra #ThreatIntel

NetScaler zero-days: exploited for weeks before anyone noticed. 50k+ gateways exposed. Patching now is changing the locks after someone copied your keys. Go hunt for web shells.

https://webtechkitchen.com/citrix-netscaler-zero-days-front-door-was-open-weeks-911

#infosec #Citrix

Hackers exploit #Citrix #NetScaler zero-day to deploy web shells

https://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/

#cybersecurity

⚠️ Deux failles critiques RCE non corrigées exploitables dans #Citrix #NetScaler confirmées le 27 sept. Citrix a publié des correctifs. Impact large, y compris en config par défaut. #CyberSecurity #Automatisation

NetScaler exploit CVE-2026-88771/72 grants attackers root & hides web shell in CSS-like URLs. #Citrix #NetScaler #Vulnerability #Cybersecurity #WebShell #ThreatIntel https://thedailytechfeed.com/critical-post-auth-payload-abuses-netscaler-to-create-superuser-web-shell-access/

Active exploitation of Citrix NetScaler CVE-2026-88771 enables pre-auth command injection, payload retrieval, reverse shells, privileged account creation, and web-shell deployment. #Citrix #NetScaler #CVE-2026-88771

CVE-2026-88772, a Citrix NetScaler DTLS memory overflow, is exploited in the wild. A watchTowr PoC and full details are now public. Patch NetScaler now.

#Citrix #NetScaler #CVE202688772 #DTLS #watchTowr #KEV #ZeroDay #RCE

I created a small informative website.
pitscaler.com
#citrix #netscaler #pitscaler

A DTLS buffer overflow in Citrix NetScaler lets attackers execute code without login via CVE-2026-88772. #CVE2026-88772 #Citrix #NetScaler #Cybersecurity #RemoteCodeExecution https://thedailytechfeed.com/citrix-netscaler-critical-flaw-cve-2026-88772-enables-pre-auth-remote-code-execution/

Das #IoC Script vom Hersteller #Citrix ist nur in Version 3 vom 29.09. verlässlich! false positive Erkennungen in Version 1 und 2.