eSentire tracks four clusters behind CVE-2026-88771 exploitation, planting NetScaler web shells and backdoor accounts. Learn how to detect them.

Related Posts:

• ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes
• Moroccan Intelligence Deploys Vast Surveillance Panopticon
• DragonForce Backdoor Adds MQTT Fallback to Microsoft Teams TURN Command Channel

The post Four Attacker Clusters Exploit Citrix NetScaler Flaw CVE-2026-88771 to Plant Web Shells appeared first on Daily CyberSecurity.

Attackers exploit Citrix NetScaler zero-day CVE-2026-88772 for root access, then hide WHIPSHOT web shells and a SLAPSHOT tunneler. Patch now.

Related Posts:

• China-Aligned TA419 Credential Phishing Hits AI Experts
• Phishing Abuses RMM Tools for Persistent Network Access
• Russia's Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor

The post Attackers Exploit Citrix NetScaler Zero-Day CVE-2026-88772 to Plant Hidden Web Shells appeared first on Daily CyberSecurity.

Attackers used a PaperCut zero-day to plant a web shell and an AdaptixC2 implant hidden in fake Microsoft Copilot, then took over Active Directory.

Related Posts:

• UAT-11587 Targets Asian Governments With Antino Backdoor
• Microsoft Details NeedyMantis Malware Used for Long-Term Access in Targeted Intrusions
• New MacSync macOS Infostealer Targets Crypto Wallets

The post PaperCut Zero-Day Attack Hides AdaptixC2 Implant Inside Fake Microsoft Copilot appeared first on Daily CyberSecurity.

Zimbra CVE-2026-73570 lets one crafted email run code. Microsoft details the Zimbra command injection attacks: web shells, root access, and key theft.

Related Posts:

• PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545
• ASUS Security Vulnerabilities Expose Routers and Motherboards
• MediaWiki External Data CVE-2026-100382 (CVSS 10) Unauthenticated RCE Exploited in the Wild, PoC Public

The post Microsoft Tracks Zimbra CVE-2026-73570 Attacks That Steal Mail and Auth Keys appeared first on Daily CyberSecurity.

ShinyHunters PeopleSoft attacks are back. A one-letter WAF bypass lets the group exploit CVE-2026-35273 and plant web shells on unpatched servers.

Related Posts:

• Operation Master Turns GlobalProtect Breaches Into Brazilian Invoice Fraud
• Konni Launches Operation Conflict Compass Against Ukraine
• Kiteworks Mandates Global Precautionary Server Shutdown

The post ShinyHunters Renews Oracle PeopleSoft Attacks With One-Character WAF Bypass appeared first on Daily CyberSecurity.