{"uuid": "a314ed89-abf3-44cd-85a6-68cd90defb28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/pphm_HackerNews/3382", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "creation_timestamp": "2026-09-30T15:31:04.000000Z"}