Google researchers trace NetScaler attacks to early September

Mandiant and Google Threat Intelligence Group have identified dozens of organizations affected by exploitation of NetScaler flaw CVE-2026-88772 across North America and Europe, Help Net Security reported. Their findings trace attacks to at least early September and describe intrusions into government, financial services, education, telecommunications and professional services organizations. The flaw affects appliances with DTLS enabled and lets attackers bypass authentication to gain root-level access. Researchers found web shells used for persistence and a tunneling tool that proxies traffic into internal networks. Mandiant CTO Charles Carmakal warned that installing a fixed version does not remove existing attackers or address stolen credentials.