SLAPSHOT (Malware): news timeline & CVEs

Google Warns of Hackers Actively Exploiting Citrix 0-Day Vulnerabilities to Deploy Web Shells

Attackers are exploiting two critical Citrix NetScaler zero-days to deploy WHIPSHOT web shells and tunnel inward.

Mandiant and Google Threat Intelligence Group say attackers have exploited Citrix NetScaler zero-days CVE-2026-88772 and CVE-2026-88771 since at least early September 2026. Both flaws are scored CVSS 9.5; exploitation bypasses authentication, crashes the packet engine, and gives root on the FreeBSD-based appliance. Operators install the WHIPSHOT PHP web shell and the SLAPSHOT Python tunnel to reach internal hosts, steal credentials, and retain root with a setuid /bin/sh. Victims include government, finance, technology, education, and professional services in North America and Europe; fixed builds include NetScaler 14.1-73.37 and 13.1-64.23 and later.

Cyber Security NewsSep 30, 16:50 UTC · 13h agoExploit / PoC in the wild 30 sources CVE-2026-88771 CVE-2026-88772

Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)

Suspected state-sponsored actors exploited NetScaler zero-day CVE-2026-88772 since early September, affecting dozens of organizations.

Mandiant and Google Threat Intelligence Group say suspected state-sponsored actors have exploited Citrix NetScaler zero-day CVE-2026-88772 since at least early September 2026. Citrix confirmed on September 27 that CVE-2026-88771 and CVE-2026-88772 were exploited for remote code execution; the latter works only when DTLS is enabled and bypasses authentication by crashing the packet engine to gain root on FreeBSD. Dozens of organizations in North America and Europe were hit across government, finance, education, telecommunications, and legal services. Attackers modified httpd.conf, planted web shells, and proxied traffic with a TCP tunnel called SLAPSHOT. Patching does not evict intruders or revoke stolen credentials, and broader opportunistic exploitation is expected.

Help Net Securityupdated Sep 30, 16:50 UTC · 13h agofirst Sep 30, 12:33 UTC · 17h agoExploit / PoC in the wild 30 sources

Hackers Exploit Citrix NetScaler Zero-Day to Gain Root Access and Deploy Web Shells

Attackers exploit Citrix NetScaler zero-day CVE-2026-88772 for root access and PHP web shells.

Mandiant and Google’s Threat Intelligence Group say attackers have exploited Citrix NetScaler zero-day CVE-2026-88772 since at least early September 2026 against organizations in North America and Europe. The CVSS 9.5 memory overflow is triggered by malformed DTLS records on UDP port 443 and gives unauthenticated root execution on ADC and Gateway appliances when DTLS is enabled. Operators then installed WHIPSHOT PHP web shells, deployed the SLAPSHOT TCP tunneler, and set the SUID bit on /bin/sh. Citrix fixes are 14.1-73.37 and 13.1-64.23 or later, and CVE-2026-88771 has also been exploited in the wild.

GBHackersupdated Sep 30, 16:50 UTC · 13h agofirst Sep 30, 09:47 UTC · 20h agoExploit / PoC in the wild 30 sources CVE-2026-88772 CVE-2026-88771

WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign

Attackers exploit Citrix NetScaler zero-days and deploy WHIPSHOT and SLAPSHOT for persistent root access.

Mandiant and Google Threat Intelligence Group reported in-the-wild exploitation of Citrix NetScaler ADC and Gateway zero-day CVE-2026-88772, a CVSS 9.5 memory overflow in DTLS processing that can give unauthenticated remote code execution as root on FreeBSD. Activity has been seen since at least early September 2026 against government, financial services, education, and legal organizations in North America and Europe. Citrix disclosed a second exploited zero-day, CVE-2026-88771. Intruders install the WHIPSHOT PHP web shell and SLAPSHOT Python proxy, make /bin/sh setuid, and reboot to retain root. Mandiant recommends patching immediately, or disabling DTLS and blocking inbound UDP/443 as a temporary mitigation for this path, and treating credentials handled by a compromised appliance as exposed.

Security Affairsupdated Sep 30, 16:50 UTC · 13h agofirst Sep 30, 07:25 UTC · 22h agoExploit / PoC in the wild 30 sources

Hackers exploit Citrix NetScaler zero-day to deploy web shells

Attackers exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunnel into networks.

Attackers exploited two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, sometimes called PitScaler, to gain root on ADC and Gateway appliances and move into internal networks. CVE-2026-88771 is unauthenticated remote code execution on all deployments, while CVE-2026-88772 is a DTLS memory-overflow flaw that can yield code execution or denial of service. Mandiant says activity began by early September against organizations in North America and Europe across government, financial services, education, legal, and professional services. Intruders installed PHP web shells, including new families WHIPSHOT and SLAPSHOT, rewrote httpd.conf so benign-looking files executed PHP, and set the setuid bit on /bin/sh.

BleepingComputerupdated Sep 30, 16:50 UTC · 13h agofirst Sep 29, 18:37 UTC · 1d agoExploit / PoC in the wild 30 sources CVE-2026-88771

SLAPSHOT

Timeline5 articles

Related CVEsby mentions

Appears with

Google Warns of Hackers Actively Exploiting Citrix 0-Day Vulnerabilities to Deploy Web Shells

Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)

Hackers Exploit Citrix NetScaler Zero-Day to Gain Root Access and Deploy Web Shells

WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign

Hackers exploit Citrix NetScaler zero-day to deploy web shells