ThreatPaper

#web-shell

4 cases

Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: three weeks of exploitation before the patch

Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 were exploited from at least September 3, 2026, three weeks before the September 27 patch. Web shells survive the update; attribution is still only suspected.

Malware
ShinyHunters (UNC6240) bypass a WAF with one URL-encoded character to mass-exploit PeopleSoft CVE-2026-35273

GTIG tracked UNC6240 (linked to ShinyHunters) mass-exploiting PeopleSoft's CVE-2026-35273 (CVSS 9.8 unauth RCE). Defenders who blocked /PSEMHUB at a WAF instead of patching were bypassed: the actor requested /%50SEMHUB/, one URL-encoded character, then dropped web shells and the SIDEEYE backdoor.

Data BreachMalwareExtortion & Blackmail
Ivanti Connect Secure zero-days: one December intrusion, 2,100 backdoored appliances and a federal disconnect order

CVE-2023-46805 and CVE-2024-21887 gave a suspected China-nexus actor unauthenticated code execution on Ivanti VPN gateways from December 2023. Disclosure turned it into 2,100 compromised appliances in a week, a bypassed mitigation and CISA's order to unplug every federal device.

State-SponsoredMalware
Cl0p and PTC Windchill: The Custom Implant That Turned Engineering Vaults Into an Extortion Campaign

Cl0p exploited an unauthenticated deserialization flaw in PTC Windchill as a zero-day in June 2026, deployed a purpose-built web shell that decrypts the application's keystore, and named 43 manufacturers, including Shell, Philips and GE. It was the second such flaw in three months.

Extortion & BlackmailOT & Industrial SystemsData Breach