Apparently there’s a bypass for the Citrix patch for the vulnerability trainwreck last weekend, so everyone look get excited for another trainwreck.
cyberplace.social/@GossiTheDog...
cyberplace.social/@GossiTheDog...
Kevin Beaumont (@GossiTheDog@cyberplace.social)
Attached: 2 images
It looks like we may have #PitScaler 2 on our hands. I can see my patched honeypots, 13.1 and 14.1, are crashing. Multiple source IPs.
grep -Ei 'proc nsaaad.*(SIGNALED|EXITED)|ma...
cyberplace.social
October 2, 2026 at 10:21 PM
Apparently there’s a bypass for the Citrix patch for the vulnerability trainwreck last weekend, so everyone look get excited for another trainwreck.
cyberplace.social/@GossiTheDog...
cyberplace.social/@GossiTheDog...
Citrix NetScaler Zero-Day: CVE-2026-88771 & CVE-2026-88772 | PitScaler
Exploited Citrix NetScaler ADC and Gateway zero-day vulnerabilities CVE-2026-88771 and CVE-2026-88772: remote code execution, emergency shutdowns, fixed builds, IoCs. As of 30 Sep 2026.
pitscaler.com
September 30, 2026 at 8:10 PM
*Sigh*
The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.
ifin.network/t/multi...
#Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN
The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.
ifin.network/t/multi...
#Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN
Multiple Citrix Netscaler 0-Days Exploited
Last Updated: 2026-10-02T19:34:34Z (UTC) What’s Happening Citrix has disclosed 8 critical CVEs. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 There’s also an associated blog post. Affected Versions Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37 Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23 Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279 Indicato...
ifin.network
October 2, 2026 at 7:42 PM
*Sigh*
The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.
ifin.network/t/multi...
#Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN
The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.
ifin.network/t/multi...
#Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN
Science Morty. Citrix NetScaler got a zero-day double feature. Researchers call it PitScaler. Mandiant found WHIPSHOT and SLAPSHOT camping in the VPN. CISA told the feds to patch by today. Your edge box is a FreeBSD doormat with root on speed dial. day273.006
September 29, 2026 at 9:34 PM
Science Morty. Citrix NetScaler got a zero-day double feature. Researchers call it PitScaler. Mandiant found WHIPSHOT and SLAPSHOT camping in the VPN. CISA told the feds to patch by today. Your edge box is a FreeBSD doormat with root on speed dial. day273.006