--- title: Hackers exploit Citrix NetScaler zero-day to deploy web... description: Attackers are exploiting two Citrix NetScaler ADC and Gateway zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, dubbed 'PitScaler', to gain root... canonical: https://daily.dev/posts/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells-wzitssi01 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers exploit Citrix NetScaler zero-day to deploy web shells | daily.dev og:description: Attackers are exploiting two Citrix NetScaler ADC and Gateway zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, dubbed 'PitScaler', to gain root... og:url: https://daily.dev/posts/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells-wzitssi01 og:image: https://api.daily.dev/og/posts/WZITsSi01.png og:image:alt: Hackers exploit Citrix NetScaler zero-day to deploy web shells og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers exploit Citrix NetScaler zero-day to deploy web shells **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 6 min read · 0 upvotes · 0 comments ## Summary Attackers are exploiting two Citrix NetScaler ADC and Gateway zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, dubbed 'PitScaler', to gain root access, deploy custom web shells (WHIPSHOT) and a Python tunneling tool (SLAPSHOT), steal credentials, and pivot into internal networks. Mandiant and GreyNoise report exploitation began by early September, targeting government, financial, education, legal, and professional services organizations in North America and Europe. Citrix has released patches; disabling DTLS and blocking UDP/443 mitigates only CVE-2026-88772, not CVE-2026-88771, so patching is the only complete fix. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are CVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler? CVE-2026-88771 is an unauthenticated remote code execution flaw affecting all NetScaler ADC and Gateway deployments, while CVE-2026-88772 is a memory overflow vulnerability enabling remote code execution or denial of service when DTLS is enabled. Both were exploited as zero-days on unmitigated appliances before Citrix disclosed and patched them, with researchers nicknaming them 'PitScaler'. _Teams running NetScaler track disclosures like these on daily.dev to patch before exploitation spreads._ ### How can I detect if my Citrix NetScaler appliance has been compromised by the WHIPSHOT and SLAPSHOT malware? Check for unauthorized PHP handlers or Alias/AliasMatch entries in /etc/httpd.conf, suspicious .deb or .sig files containing PHP code, unexpected NSPPE crashes, unusual HTTP 404 responses, and files at /tmp/.uxdport or /tmp/.uxdlock. Also verify whether /bin/sh has been modified with the setuid bit to grant root execution, and look for Python processes launched with nohup carrying Base64-encoded payloads. _Defenders hardening NetScaler deployments use daily.dev to keep indicators of compromise like these on hand._ ### Can disabling DTLS protect against the Citrix NetScaler zero-day exploits? Disabling DTLS and blocking inbound UDP/443 only mitigates CVE-2026-88772, since that flaw requires DTLS to be enabled; it provides no protection against the separately exploited CVE-2026-88771. Installing the latest Citrix NetScaler security updates is the only way to address both vulnerabilities. _Admins weighing stopgap mitigations against full patches follow updates like this through daily.dev._ ## Similar posts on daily.dev - [Citrix NetScaler bug may be multiple flaws in one](https://daily.dev/posts/citrix-netscaler-bug-may-be-multiple-flaws-in-one-kggs3gauu) · The Register · 0 upvotes · 0 comments - [CVE‑2026‑3055](https://daily.dev/posts/cve-2026-3055-agwr1jxtq) · Arctic Wolf · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells-wzitssi01) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers exploit Citrix NetScaler zero-day to deploy web shells","url":"https://daily.dev/posts/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells-wzitssi01","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells-wzitssi01"},"datePublished":"2026-09-29T18:39:02.817Z","dateModified":"2026-10-01T14:50:06.864Z","description":"Attackers are exploiting two Citrix NetScaler ADC and Gateway zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, dubbed 'PitScaler', to gain root...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e91ed4277968be33ef35ee6f9828173d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e91ed4277968be33ef35ee6f9828173d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells-wzitssi01","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hackers exploit Citrix NetScaler zero-day to deploy web shells"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells-wzitssi01#faq","mainEntity":[{"@type":"Question","name":"What are CVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-88771 is an unauthenticated remote code execution flaw affecting all NetScaler ADC and Gateway deployments, while CVE-2026-88772 is a memory overflow vulnerability enabling remote code execution or denial of service when DTLS is enabled. Both were exploited as zero-days on unmitigated appliances before Citrix disclosed and patched them, with researchers nicknaming them 'PitScaler'. Teams running NetScaler track disclosures like these on daily.dev to patch before exploitation spreads."}},{"@type":"Question","name":"How can I detect if my Citrix NetScaler appliance has been compromised by the WHIPSHOT and SLAPSHOT malware?","acceptedAnswer":{"@type":"Answer","text":"Check for unauthorized PHP handlers or Alias/AliasMatch entries in /etc/httpd.conf, suspicious .deb or .sig files containing PHP code, unexpected NSPPE crashes, unusual HTTP 404 responses, and files at /tmp/.uxdport or /tmp/.uxdlock. Also verify whether /bin/sh has been modified with the setuid bit to grant root execution, and look for Python processes launched with nohup carrying Base64-encoded payloads. Defenders hardening NetScaler deployments use daily.dev to keep indicators of compromise like these on hand."}},{"@type":"Question","name":"Can disabling DTLS protect against the Citrix NetScaler zero-day exploits?","acceptedAnswer":{"@type":"Answer","text":"Disabling DTLS and blocking inbound UDP/443 only mitigates CVE-2026-88772, since that flaw requires DTLS to be enabled; it provides no protection against the separately exploited CVE-2026-88771. Installing the latest Citrix NetScaler security updates is the only way to address both vulnerabilities. Admins weighing stopgap mitigations against full patches follow updates like this through daily.dev."}}]} ```