View Ridge Security
Back to Cyber Hose

Hackers exploit Citrix NetScaler zero-day to deploy web shells

Citrix NetScaler zero-day under active exploitation headlines this run, alongside a GitHub supply chain campaign and a WordPress plugin flaw.

🚨 ACTIVE EXPLOITATION

  • UPDATE: Hackers exploit Citrix NetScaler zero-day CVE-2026-88771 to deploy web shells and steal configs CVE-2026-88771
    Attackers are exploiting the Citrix NetScaler zero-day CVE-2026-88771 to run commands, install web shells, and steal appliance configuration data.

    • Applies to Citrix NetScaler ADC and NetScaler Gateway; all deployments are vulnerable by default, including 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23.
    • CVE-2026-88771 is an improper input validation flaw (CVSS 9.5) allowing unauthenticated remote command execution; CVE-2026-88772 is a DTLS memory overflow also rated 9.5, both exploited in the wild and added to CISA KEV on September 27, 2026.
    • Attackers embed shell commands in authentication usernames (often with pitboss, NSPPE, or died), using whoami, curl, and wget, with ${IFS} command substitution to evade detection.
    • Python payloads overwrite an appliance component with a reverse shell over TCP port 443; Perl payloads create a superuser account, archive the configuration, install a PHP web shell disguised as a CSS resource, then delete themselves.
    • Observed IOCs include exploitation source IPs 70.172.58[.]168, 162.243.36[.]88, 173.40.135[.]209, and payload URLs like hxxp://23.27.143[.]20:9000/main.py; fixed builds are 14.1-73.37 and 13.1-64.23.
    Sources 📄 Source: levelblue.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News

  • GhostAction Supply Chain Campaign Resurges, Hits 772 GitHub Repos to Steal CI/CD Secrets
    The GhostAction campaign injected malicious GitHub Actions workflows into 772 public repositories between August 31 and September 30, 2026, targeting 2,577 CI/CD secrets.

    • Affects public GitHub repositories: 772 repos across 373 users and organizations were hit, targeting 2,577 secrets including SSH keys (446), Azure credentials (218), container registry logins (142), database credentials (112), AWS keys (106), and GitHub, Google Cloud, npm, PyPI, and bot tokens.
    • Attackers use stolen GitHub credentials to commit a workflow named github_actions_security.yml (commit message 'Add Github Actions Security workflow') under the victim's own identity; it scrapes existing workflows for ${{ secrets.NAME }} references and exfiltrates values via curl POST over plain HTTP to 193.32.204.199.
    • A variant in 7 repos used security-check.yml posting to hxxp://193.32.204.199:3000/api/workflow/receive?inj=<id>; earlier waves used bold-dhawan.45-139-104-115.plesk.page, carte-avantage.com, 170.39.218.2, and *.oast.fun endpoints.
    • Of 3,669 workflow runs observed, only 499 executed and 336 succeeded, exfiltrating 26 secrets from 13 repositories; only 124 repos (16%) were cleaned by October 5, and in 92 cases old injected workflows were updated rather than newly added.
    • A separate XMRig cryptominer was found injected into kuafuai/DevOpsGPT's Docker image as /usr/local/bin/pyworker, likely from a different operator reusing the same compromised account.
    Sources 📎 Coverage: blog.gitguardian.com · 👁 via Cyber Security News

  • Critical unauthenticated file upload flaw in Bricksforge WordPress plugin actively exploited (CVE-2026-85097)
    The Bricksforge WordPress plugin is being actively exploited via an unauthenticated arbitrary file upload vulnerability leading to remote code execution.

    • Affects WordPress sites running the Bricksforge plugin (a Bricks Builder extension), versions up to and including 3.1.8.9; fixed in 3.1.8.10.
    • The flaw (CVE-2026-85097, CVSS 9.8-10.0) stems from insufficient validation of the attacker-controlled url field in the temporaryFileUploads parameter during form submission.
    • Attackers obtain a nonce via the unauthenticated bricksforge_regenerate_nonce AJAX endpoint, upload a GIF/PHP polyglot that passes MIME checks, then submit a form whose file path points to the image but whose url ends in .php, placing executable PHP on the server.
    • Exploitation targets POST /wp-json/bricksforge/v1/form_submit and /wp-admin/admin-ajax.php, with payload variations using alternative, case-manipulated, and URL-encoded PHP extensions; some payloads drop login_admin_*.php files into the regular uploads directory.
    • Patchstack telemetry recorded 63 unique source IPs with coordinated automated activity starting October 7, 2026; top sources include 177.75.57.20, 23.97.62.146, and 84.247.60.125.
    Sources 📄 Source: wordfence.com · 📎 Coverage: patchstack.com · 👁 via patchstack.com (discovered)

🔓 CVEs & KEV

  • CVE-2026-14991 — IBM DataPower Gateway 10.6CD — CVSS 9.8 — IBM DataPower Gateway Out-of-bounds WriteIBM DataPower Gateway 10.5.0.0 throu...

  • CVE-2026-15762 — IBM DataPower Gateway 10.6CD — CVSS 9.8 — IBM DataPower Gateway Out-of-bounds WriteIBM DataPower Gateway 10.5.0.0 throu...

  • CVE-2026-14990 — IBM DataPower Gateway 10.6.0 — CVSS 9.3 — IBM DataPower Gateway affected by cross-site scriptingIBM DataPower Gateway 1...

  • CVE-2026-16159 — IBM DataPower Gateway 10.6CD — CVSS 8.6 — IBM DataPower Gateway Out-of-bounds WriteIBM DataPower Gateway 10.5.0.0 throu...

  • CVE-2026-15824 — IBM DataPower Gateway 10.6CD — CVSS 8.2 — IBM DataPower Gateway Denial of ServiceIBM DataPower Gateway 10.5.0.0 through...

  • CVE-2026-15784 — IBM DataPower Gateway 10.6CD — CVSS 8.1 — IBM DataPower Gateway Out-of-bounds WriteIBM DataPower Gateway 10.5.0.0 throu...

  • CVE-2026-15781 — IBM DataPower Gateway 10.6CD — CVSS 8.0 — IBM DataPower Gateway Buffer OverflowIBM DataPower Gateway 10.5.0.0 through 1...

  • CVE-2026-107615 — GlavSoft TightVNC — CVSS 7.8 — DLL search order hijacking via screenhooks libraries in TightVNC ServerAn unc...

  • CVE-2026-107612 — GlavSoft TightVNC — CVSS 7.8 — World-accessible IPC shared memory with predictable name in TightVNC ServerIn...

  • CVE-2026-15819 — IBM DataPower Gateway 10.6CD — CVSS 7.5 — IBM DataPower Gateway Out-of-bounds WriteIBM DataPower Gateway 10.5.0.0 throu...

  • CVE-2026-15822 — IBM DataPower Gateway 10.6CD — CVSS 7.5 — IBM DataPower Gateway Denial of ServiceIBM DataPower Gateway 10.5.0.0 through...

  • CVE-2026-16111 — IBM DataPower Gateway 10.6CD — CVSS 7.5 — IBM DataPower Gateway Type ConfusionIBM DataPower Gateway 10.5.0.0 through 10...

  • CVE-2026-107611 — GlavSoft TightVNC — CVSS 7.1 — Out-of-bounds read in TightVNC Viewer ZRLE palette decodingAn out-of-bounds r...

  • CVE-2026-107614 — GlavSoft TightVNC — CVSS 6.1 — Integer underflow in TightVNC Server cursor shape trimming leads to out-of-bo...

🕵️ RESEARCH & DEEP DIVES

  • Russia-aligned UAC-0099 targets Ukrainian government with new ASHVEIN .NET stealer/RAT
    TrendAI attributes a previously undocumented .NET infostealer and RAT called ASHVEIN to the Russia-aligned group UAC-0099 in attacks on Ukrainian government personnel.
    • Targets Ukrainian government, defense, border guard, and logistics entities; TrendAI tracks the cluster as Earth Sirrush (formerly SHADOW-EARTH-065), overlapping CERT-UA's UAC-0099.
    • ASHVEIN (internally 'TelemetryBrowser') steals Chrome/Firefox credentials, captures screenshots, retrieves files, runs remote PowerShell, and fingerprints systems via WMI.
    • It hides tasking inside invisible HTML elements, encrypts C2 communications, checks for analysis tools like Wireshark and IDA, and some variants use a GitHub-based dead drop resolver as fallback.
    • Delivery includes DLL sideloading, VHD containers, and .NET droppers such as AnswerFromPolice, which displays a decoy document impersonating Ukraine's National Police.
    • The group has used 10+ malware families since 2022, including MATCHBOIL, DRAGSTARE, CINDERBLOT/BadPaw, and LUNCHPOKE, with PNG steganography and Notepad++ plugin abuse; ESET says UAC-0099 may act as an initial access broker for Sandworm.
    Sources 📄 Source: welivesecurity.com · 📎 Coverage: thehackernews.com · 👁 via <https://thehackernews.com/2026/10/u

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check