Citrix
Every ZeroDayFeed story on Citrix — across breaches, zero-days, ransomware, patches, policy, and industry, newest first.
-
Zero-Days & Exploits
CISA Adds Both PHP2Shell Flaws to KEV After Confirmed Honeypot RCE; Federal Deadline Is Oct. 29
CISA has put both PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) in its Known Exploited Vulnerabilities catalog with an Oct. 29 deadline, days after a researcher confirmed unauthenticated code execution against honeypots. Censys counts more than 32.5 million PHP services still on affected versions.
-
Zero-Days & Exploits
Citrix NetScaler zero-day CVE-2026-88771 moves to mass exploitation after PoC; CVE-2026-88772 also exploited
Two NetScaler ADC and Gateway flaws rated CVSS v4 9.5 were exploited before disclosure; CVE-2026-88771 was then attacked widely after a public PoC. Responders found stolen config archives and webshells, and CISA's September 30 deadline has passed.
-
Zero-Days & Exploits
Citrix NetScaler SAML flaw CVE-2026-88779 exploited in targeted attacks; CISA deadline has passed
Citrix says attackers are targeting CVE-2026-88779, a memory-buffer flaw in SAML-configured NetScaler ADC and Gateway appliances, and CISA's October 7 federal patch deadline has now passed.
