On September 21, intruders used a NetScaler command-injection flaw to turn routine appliance logs into a PHP web shell, according to Palo Alto Networks Unit 42. The attackers hid the shell behind a CSS file path on a U.S. organization’s NetScaler devices. ADC and Gateway operators whose appliances were reachable before the September 27 disclosure should investigate the logs and web-server configuration.
October 10, 2026: Unit 42’s report adds a log-poisoning and implant trail to Nulltap’s earlier build guidance and Mandiant’s separate DTLS intrusion findings. For an appliance exposed before the fix, check whether it processed the attacker’s text and acquired the disguised PHP handler, even if its running build is now fixed.
Two logs feed one command
The NetScaler-assigned record for CVE-2026-88771 describes improper input validation leading to unauthenticated command execution. Unit 42 observed an actor place encoded text in an HTTP request’s user-agent field. The request returned 404, while the appliance wrote the user-agent to /var/log/httpaccess-vpn.log. A subsequent login request put attacker-controlled text into a failure message in /var/log/ns.log, the appliance’s authentication log. Later, the vulnerable /netscaler/ns_monuploadd_err.pl log-processing script interpreted that message as a command, which drew the encoded text from the access log and ran it. The two entries can look unrelated until responders connect the timestamps and the processed text.
Unit 42 traced this chain to a shell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver. The attacker changed /etc/httpd.conf to enable PHP execution and map a CSS-looking request, /logon/LogonPoint/custom/receiver.min.css, to that hidden file; a variant added a hexadecimal suffix before .css. The same configuration normally disables the PHP engine. Treat a new handler for the hidden file, an unexpected alias, or an enabled PHP engine as a compromise finding and preserve the configuration before cleanup. The implant used the CsrfToken and NSC_TASS cookies as its authentication and command channels. Unit 42 also found a change making /bin/sh SUID and SGID, allowing later commands to run with root privileges.
The other exploit used DTLS
Unit 42 separately observed crafted Datagram Transport Layer Security traffic associated with CVE-2026-88772, followed by requests for .deb files in /vpn/scripts/linux/, an appliance directory normally used for Citrix client installers. The requested filenames included nsgclient18.deb, nsgser18.deb, nsgsupport.deb, nsgpackage64.deb and nsgbuild.deb. Its recovered nsg64.deb web shell had SHA-256 ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec. The NetScaler CNA record for CVE-2026-88772 describes remote code execution or denial of service. The .deb path is a second hunt lane; the log-poisoning path above involves a hidden PHP file and a CSS alias. Nulltap’s Mandiant account covers another observed DTLS implant and proxy trail.
Unit 42 counted 50,277 internet-exposed instances potentially vulnerable to the two flaws in its September 27 Cortex Xpanse telemetry. Use that exposure estimate to prioritize an appliance inventory and investigate intrusion evidence on each device. The firm sells the Cortex products it discusses in the report; its appliance observations and product-protection claims should be read separately. Unit 42 says post-compromise activity is still under investigation. It presents unexpected outbound connections as general hunting guidance for this investigation.
Correlate requests with appliance files
Start with traffic and logs near the September 21 intrusion and the earlier August 21 fingerprinting. Unit 42 saw requests for /admin_ui/common/css/ns/ui.css and /vpn/js/rdx/core/lang/rdx_en.json.gz from 104.248.244[.]66 and 77.83.199[.]39, with 78.47.24[.]217 in the broader probing. Examine access-log user-agent entries near failed logins in /var/log/ns.log for the pitboss PPE missed too many heartbeats and NSPPE markers. Unit 42 says, “We believe any activity to this URL path is anomalous and worth investigating,” referring to /logon/LogonPoint/Authentication/GetUserName. Correlate those requests with the same appliance, the poisoned log entries and any unauthorized web-server changes before treating them as evidence of this intrusion.
Unit 42’s published network indicator list is 45.61.136[.]143, 66.227.183[.]84, 77.83.199[.]39, 104.28.215.137, 104.248.244[.]66, 104.28.247.136, 162.33.178[.]9, 193.149.176[.]207, and 216.245.184[.]164. The two 104.28 addresses are Cloudflare WARP VPN egress, a shared service; correlate them with appliance requests and artifacts rather than treating every connection from WARP as malicious. Inspect /vpn/scripts/linux/nsgclient18.deb, /vpn/scripts/linux/nsg64.deb, and /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, then compare the installed web-server configuration and shell permissions with a known-good appliance. Unit 42’s recovered Base64 payload and decoded shell-script text have SHA-256 1bd314b661396c7086f6367fbbb48025e03ca2de69c073d53a8b0a38aa5fbb7d and 79c65fa04541032e251fa4796b97800374b63c7982593dd1a2e0db605d429186, respectively; those are text-file hashes, while the .deb hash above belongs to the recovered package.
Preserve evidence before recovery
For ADC and Gateway owners, compare the running edition and complete build with the CNA release floors for both flaws: ordinary 14.1-73.37 and 13.1-64.23, plus ADC 14.1-73.37 FIPS and 13.1.37.279 FIPS and NDcPP. Use Citrix’s current bulletin to check the device-specific exposure preconditions and upgrade path. Unit 42 recommends isolating vulnerable systems and collecting a VPX snapshot, remote-syslog and NetScaler Console records, a technical support bundle, and a packet-engine core dump. Coordinate potentially disruptive collection and recovery with the appliance owner. Upgrade affected nodes to the applicable fixed or newer release; Unit 42 warns that patching alone will not remove an attacker’s existing persistence.
For an appliance with the log-chain markers or a PHP alias, preserve its logs and configuration before replacement or cleanup. Verify the running build after upgrading, then compare /etc/httpd.conf, the hidden shell path, /bin/sh permissions and the preserved log timeline with known-good state. An unauthorized CSS-to-PHP alias or SUID shell needs incident response even when the version is fixed.