Skip to content

WHIPSHOT

Named by 2 kept items in this workspace.

Search every workspace for WHIPSHOT. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD
    writeup2026-10-06

    Custom PHP web shell used in the 2026 Citrix NetScaler exploitation campaign, disguised as non-PHP files (.deb, .sig, .ico, .local_journal/.ctxs.receiver), reachable via fake CSS URLs under /logon/LogonPoint/; supports RCE, file upload/download, bridges to SLAPSHOT; some variants password-protected

  • Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
    writeup2026-09-29It is written here as WHIPSHOT: custom PHP web shell and tunneling frontend on NetScaler; hides Base64 C&C payloads in HTTP headers, returns a spoofed 404 and relays requests to SLAPSHOT over loopback.

    custom PHP web shell and tunneling frontend on NetScaler; hides Base64 C&C payloads in HTTP headers, returns a spoofed 404 and relays requests to SLAPSHOT over loopback

All threat actors in this workspace.