> TritonInfoSec News
Home / Oct 01, 2026 / Story
0
#7 The Hacker News general September 30, 2026 at 08:24 UTC

Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

By [email protected] (The Hacker News)

AI Summary

Mandiant and Google GTIG observed threat actors deploying novel post-exploitation payloads dubbed WHIPSHOT and SLAPSHOT after exploiting the Citrix NetScaler pre-auth flaw against government, financial services, technology, education, and legal organizations in North America and Europe throughout September 2026. The attackers also mapped web shells to CSS-like URLs to evade detection and created superuser accounts. The suspected state-sponsored attribution and breadth of targeted sectors make this a high-priority incident for network defenders.

Read full article → https://thehackernews.com/2026/09/attackers-exploi…

Relevance score: 81.0/100

# More from October 01

  1. 1
    Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution The Hacker News
  2. 2
    Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected CyberScoop
  3. 3
    Cisco warns of new SD-WAN zero-day exploited in attacks BleepingComputer
  4. 4
    Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets The Hacker News
  5. 5
    Bitget hacked via zero-day in third-party security products BleepingComputer
  6. 6
    New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses The Hacker News
  7. 8
    Alleged ShinyHunters leader arrested in the Netherlands CyberScoop
  8. 9
    Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks SecurityWeek
  9. 10
    Over 543,000 valid credentials exposed in public GitHub repositories BleepingComputer