Post by @GossiTheDog@cyberplace.social

Technical write up of the latest Citrix Netscaler incident, which I’m calling PitScaler - you’ll find out why from this:

https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771

You may notice it matches the hunting hints earlier in this thread. Guess who found it first

It’s a really interesting vuln scenario. I’m tracking over 100 victim orgs now. Each one has a unique webshell which can’t be scanned for remotely unless you’re the attacker. It’s espionage.

Taking 'execute logging' a bit too literally - CVE-2026-88771

0 Boosts

0 Likes

Kevin Beaumont

@[email protected] 2 wk. ago

/tmp/not_a_good_sanitation

Threat actor is correct

#PitScaler

Kevin Beaumont

@[email protected] 2 wk. ago

One of the NCSCs need to make a script for #PitScaler detection btw as the Citrix one is incomplete (it doesn’t check for suid on /bin/sh etc etc) and it’s locked behind support obscurity. Some really big orgs are backdoored after patching still.

Kevin Beaumont

@[email protected] last wk.

#PitScaler is under mass exploitation, seeing it spray and pray now.

I’ve done some firmware version scanning, fewer than 10% of boxes are patched as of an hour ago.

Kevin Beaumont

@[email protected] last wk.

IR vendors have started sharing their #PitScaler write ups but they’re sharing webshell names (.sig files) and attacker IPs - which are unique per victim, so it’s helping me map out the victim orgs via network traffic.

If they failed to remediate you can also then access with the webshell name. One also uploaded their IR investigation to VirusTotal.

1 more reply