CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD

This Perl backdoor script targets Citrix NetScaler appliances: it removes/creates a privileged user with a hashed password, drops a base64-encoded PHP webshell into /var/netscaler/logon/LogonPoint/.local_journal, patches httpd.conf to enable the webshell, uploads the nsconfig directory to a remote server (64.94.85.67:443) and sets /bin/sh SUID — providing persistent remote access and potential data exfiltration.