For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:
https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/
Rapid7Rapid7In early October 2026, Rapid7 analysts investigated a confirmed compromise of an anonymized Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.
The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound c