Platypwned: When a Citrix 0-Day Lays an Egg

Binary Defense reports active exploitation of Citrix NetScaler zero-days CVE-2026-88771 (pre-auth command injection via logged fields) and CVE-2026-88772 (DTLS reassembly memory overflow), documents an incident where a modified open-source Platypus remote administration tool was dropped as a post-exploitation implant, and provides detailed IOCs, infrastructure analysis (entretiensol.com cluster and linked domains/IPs), YARA rules, Sentinel hunting queries, and mitigation guidance for detection and response.