Hackers exploit Citrix NetScaler zero-day to deploy web shells

Cybersecurity firms reported that attackers exploited the Citrix NetScaler zero-day vulnerability CVE-2026-88772 to deploy custom web shells and tunneling malware. The hackers gained root access, stole credentials, and spread into internal networks, according to researchers. Organizations using affected NetScaler devices are urged to patch immediately and hunt for signs of compromise.