Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →WHIPSHOT is the HTTP-facing PHP web shell; SLAPSHOT is the Python TCP tunneler it uses to reach internal systems. Google Threat Intelligence Group (GTIG) and Mandiant reported the pair in a NetScaler campaign involving exploitation of CVE-2026-88772. They are post-compromise tools, not proof that every vulnerable appliance was breached or that every intrusion had the same impact. This article reflects the reporting and vendor guidance available on October 5, 2026.
What are WHIPSHOT and SLAPSHOT?
GTIG and Mandiant’s September 29, 2026 analysis describes two custom tools that work together to give an attacker a route from HTTP traffic on a NetScaler appliance into other network destinations.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Citrix NetScaler MPX 7500/9500 (8x10/100/1000Base-T Copper Ethernet Ports) with 320GB Hard Disk... | $399.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
| Tool | What it does | Network position |
|---|---|---|
| WHIPSHOT | A PHP web shell and HTTP-facing tunneling frontend. It hides Base64-encoded command-and-control payloads in ordinary HTTP headers, suppresses PHP errors, and can return an HTTP 404 status while placing the tunneled TCP response in the response body. | Receives attacker traffic over HTTP on the appliance, then relays it to SLAPSHOT over loopback. |
| SLAPSHOT | A Python TCP tunneler that accepts instructions from WHIPSHOT and opens or forwards TCP streams to internal hosts. | Runs as a local daemon and bridges the appliance to other network destinations. |
The report describes this as a way to use a compromised appliance as a proxy. In at least one observed intrusion, the threat actor routed traffic through the proxy to manually conduct internal reconnaissance and credential theft. That observation does not establish that the same activity occurred in every affected environment.
How does WHIPSHOT communicate with SLAPSHOT?
WHIPSHOT receives an HTTP request, encodes the command-and-control payload in HTTP headers, and relays the request over the appliance’s loopback interface to SLAPSHOT’s local listener. SLAPSHOT then handles the requested TCP connection or data transfer. Responses travel back through SLAPSHOT and WHIPSHOT to the HTTP client; WHIPSHOT’s unusual 404 response can therefore conceal a tunneled response in the body.
#1 Best Overall
- Citrix NetScaler MPX 7500/9500 (8x10/100/1000Base-T copper Ethernet ports)
SLAPSHOT’s local listener and protocol
SLAPSHOT binds an ephemeral port on 127.0.0.1 and records the active port in /tmp/.uxdport. It uses /tmp/.uxdlock to prevent concurrent copies. Its custom protocol frames each message with a four-byte big-endian length followed by a JSON command. GTIG and Mandiant list commands including open, push, pull, exch, close, and ping.
The report says an individual session socket closes after 15 minutes idle, while the daemon exits after 10 minutes without commands or active sessions, subject to its configurable idle-exit setting. These implementation details can help investigators interpret artifacts; they are not a safe way to determine that a device is clean.
What is known about the campaign and the vulnerabilities?
GTIG and Mandiant published their campaign analysis on September 29, 2026. They reported active in-the-wild exploitation of CVE-2026-88772 identified in late September, with activity dating back to at least early September. Their telemetry indicated organizations in North America and Europe, in government, financial services, technology, education, and legal or professional services, were likely impacted. The report and the Singapore Cyber Security Agency (CSA) advisory do not give a victim count.
The tools are post-exploitation activity; their presence does not establish which vulnerability enabled initial access on a particular appliance. GTIG and Mandiant connect the campaign to CVE-2026-88772 and say Citrix disclosures also identify active exploitation of CVE-2026-88771.
| Vulnerability | Citrix’s description | Stated condition or impact |
|---|---|---|
| CVE-2026-88771 | Unauthenticated remote-code-execution vulnerability affecting NetScaler ADC and Gateway deployments; CVSS v4 base score 9.5. | Citrix describes it as unauthenticated RCE. The bulletin’s description does not specify an additional feature precondition. |
| CVE-2026-88772 | Memory overflow that can lead to remote code execution or denial of service. | DTLS must be enabled; Citrix says it is enabled by default on VPN virtual servers. |
Citrix’s September 27 bulletin covers eight vulnerabilities in total, with the other six including HTTP request smuggling, feature policy bypass, additional memory-overflow issues, and TCP initial sequence number prediction. Their conditions and impacts differ; the full set should not be treated as eight instances of the same exploit or as all proven in this campaign.
GTIG and Mandiant say they do not possess exploit code for CVE-2026-88772. Their telemetry-based analysis suggests specially malformed or fragmented DTLS record headers cause heap memory boundary corruption in the NetScaler Packet Processing Engine, enabling shellcode execution with root-level privileges on the underlying FreeBSD platform. This is the report’s assessment of the mechanism, not a reproduced exploit.
Which Citrix NetScaler versions are affected?
Citrix’s September 27, 2026 bulletin lists supported versions below the following builds as affected and recommends installing the corresponding fixed build or a later one. Confirm applicability and the latest build in Citrix’s current bulletin before making a change.
| Appliance track | Fixed build |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.37 |
| NetScaler ADC and Gateway 13.1 | 13.1-64.23 |
| NetScaler ADC and Gateway 14.1-FIPS | 14.1-73.37 FIPS |
| NetScaler ADC and Gateway 13.1-FIPS/NDcPP | 13.1.37.279 |
The bulletin applies to customer-managed appliances. Citrix says Citrix-managed cloud services and Citrix-managed Adaptive Authentication are updated by Cloud Software Group.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I check whether a NetScaler appliance was compromised?
Installing a fixed build closes the vulnerability addressed by that build; it does not establish that an appliance was not compromised before patching. If compromise is suspected, treat the appliance and systems it can reach as an incident, not as a routine patch-only task.
- Preserve and contain. Follow the CSA recommendation to isolate an appliance when compromise is suspected or confirmed, while coordinating with incident responders so containment does not destroy evidence. GTIG and Mandiant discuss preserving virtual appliance state for forensic analysis before reboot when operationally possible.
- Review configuration changes. Inspect
/etc/httpd.conffor unauthorized PHP handlers or aliases. Check staging and client-plugin directories for unexpected plain-text or PHP code disguised with other file types. - Inspect access and error logs. Look for suspicious request paths, deceptive 404 responses, unusually large responses, and gaps or truncation. A 404 alone is not proof of WHIPSHOT; consider it alongside other indicators and artifacts.
- Use the published detection material. GTIG and Mandiant provide YARA rules for WHIPSHOT, SLAPSHOT, and related artifacts. Apply them as part of a broader investigation; a match or a lack of matches should be interpreted in context.
- Investigate beyond the appliance. Review connected Citrix infrastructure and other downstream systems for possible lateral movement. Determine whether credentials or sessions could have been exposed.
GTIG and Mandiant recommend treating credentials stored on a compromised appliance as potentially exposed, revoking sessions, and rotating appliance and integration credentials after patching. Coordinate rotations with the investigation and service owners to avoid disrupting dependent systems.
What should administrators do while patching is delayed?
Prioritize installing the fixed build. For CVE-2026-88772 specifically, Citrix advises checking whether DTLS is enabled; GTIG and Mandiant describe disabling DTLS or restricting inbound UDP/443 upstream as temporary controls if patching cannot happen immediately. Those measures address CVE-2026-88772 only and should not be relied on to mitigate CVE-2026-88771. They are not substitutes for updating and investigating an exposed appliance.
Free tools Windows power users keep installed
One-click scans. No signup required.
Because the campaign is recent and threat activity, indicators, and vendor builds can change, use the current Citrix bulletin and GTIG/Mandiant and CSA guidance when making operational decisions. The evidence available in those reports establishes likely impact across named regions and sectors, but not a count of victim organizations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
