Top Tweets for #NETSCALER

🚨 BREAKING: Finland's cyber agency reports several intrusions through the Citrix NetScaler zero-days. NCSC-FI has contacted the owners of hundreds of NetScaler instances in Finland and warns that patching alone will not remove an attacker who is already inside. CVE-2026-88771 allows command execution without authentication.

For the last two days, our Research Team has been looking into the recently disclosed Citrix NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 and building detection coverage to help identify compromised systems. The new THOR Preview signature set currently includes: - EXPL_CVE_2026_88772_POC_Sep26 Detects artifacts related to the public CVE-2026-88772 PoC - LOG_SUSP_EXPL_CVE_2026_88771_Sep26 Detects potential CVE-2026-88771 exploitation traces in NetScaler logs - WEBSHELL_CSS_PassThrough_Sep26 Detects the PHP webshell pattern observed in the post-exploitation activity reported by GreyNoise We also released a new IOC set: - NetScaler ADC suspicious file artifacts It contains filesystem indicators derived from the Citrix IOC scanner script and covers suspicious PHP/XHTML files and other unusual artifacts in NetScaler web directories. The Preview signatures are already available with: ./thor-util update --sigdev We’ll keep adding signatures as new technical details become available from public research and from information shared with us by partners and customers. Details: https://t.co/3JZKTSWgXG And if you’re wondering how to actually scan a NetScaler appliance with THOR: we documented a remote scanning approach using SSHFS a few years ago, which still applies here: https://t.co/Q4NWOZxAWL