Last updated 28 October 2026.
You've closed the change ticket. The version string now matches the advisory. The dashboard is green. That still leaves the only question that matters: was the box already compromised before you patched it?
That is the thesis of this post, and the last month of edge exploitation keeps proving it. Citrix NetScaler ADC and Gateway have been under active attack since September, with Australian organisations confirmed among the victims. PHP shipped an emergency mid-October release for what the industry has labelled PHP2Shell, working shells turned up on honeypots days later, and on 26 October CISA confirmed active exploitation and told federal agencies to check for compromise, not just patch. Then on 27 October CISA added the Magento flaw known as PolyShell to its exploited list, the same week researchers showed fully patched stores still serving an attacker's loader. Three products, same operational trap: patching an already-compromised host does not make it clean.
In this post we'll walk that story through all three, the CVEs and builds that close them, what exploitation has looked like in the wild, and the detection steps worth finishing before anyone declares the weekend over.
Start with PHP, because the timeline is short enough to make the point without much ceremony. On 20 October 2026 the PHP project pre-announced two critical flaws (CVSS v4.0 9.2). Patches landed on 21 October 2026 as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
CVE-2026-109618 is remote code execution (RCE) via out-of-memory corruption. A memory_limit longjmp can interrupt partially initialised request data (for example during multipart upload parsing). On Apache with mod_php, an unauthenticated request can trigger it before any application code runs. Full RCE has been demonstrated with default settings, and also confirmed on PHP-FPM through application paths. CVE-2026-109619 is a second RCE path via stale global state: a use-after-free across requests after a fatal error, demonstrated against a real-world app on mod_php.
Affected supported branches run 8.5.0 through 8.5.11, 8.4.0 through 8.4.26, 8.3.0 through 8.3.35, and 8.2.0 through 8.2.34. PHP 8.1 and older are end of life with no upstream binary fix (minimal source backports exist for 7.4, 8.0 and 8.1). ASD's ACSC notes PHP 5 onwards may be affected. Scope is every PHP install serving web requests; mod_php is rated highest risk. A third informational advisory, CVE-2026-115560 (23 October), is an unlikely RCE path still mitigated by session.upload_progress.enabled=0.
CISA and ASD's ACSC both published critical alerts. ACSC was not aware of successful Australian exploitation at its 22 October review. CERT-EU notes PoCs are circulating. Then, on 24 October, honeypots run by Adel Karimi recorded 35 shells on PHP 8.4.26 under Apache mod_php, consistent with CVE-2026-109618, from 15[.]204[.]59[.]70 and 162[.]35[.]99[.]94. The chain was four HTTP/1.1 multipart POSTs to / or /index.php with no User-Agent; the resulting /bin/sh ran as a child of the Apache worker.
On 26 October 2026 CISA added both CVEs to KEV with a federal due date of 29 October. The detail worth pausing on is the flag beside them: forensic triage required. Under CISA's new BOD 26-04 guidance, agencies are expected to check whether a system was compromised before the patch went on, not simply to apply it. PHP also hides inside products you might not think of as PHP. Palo Alto Networks lists the PAN-OS management interface as affected and is rolling out hotfixes, and Cisco has listed Expressway among its affected products. If your inventory only counts web servers, it is short.
Interim mitigations help buy time, but only the patched builds close these bugs. Until you can upgrade:
memory_limit=-1 via php_admin_value.post_max_size small.session.upload_progress.enabled=0 in php.ini or the FPM pool (not via ini_set), then restart workers.RLIMIT_AS.None of that answers whether someone already got a shell before your change window. That is the same question NetScaler has been asking Australian teams for a month.
If PHP2Shell is the short version of the thesis, NetScaler is the long one: multiple patch waves, confirmed Australian victims, and persistence that survives a version bump.
On 27 September 2026 Citrix disclosed eight CVEs (CTX697096). CISA added CVE-2026-88771 and CVE-2026-88772 to KEV the same day. ASD's ACSC published a critical alert on 28 September and by 30 September had confirmed Australian exploitation, recommending review of evidence since at least 4 September 2026.
CVE-2026-88771 is unauthenticated RCE via improper input validation, with all deployments in scope under default config (CVSS v4.0 9.5, in KEV). CVE-2026-88772 is a memory overflow RCE/DoS when DTLS is enabled, which is the default on VPN vServers (CVSS v4.0 9.5, in KEV). Those two were enough to force the first emergency weekend. Then the SAML follow-ons arrived and moved the goalposts again.
CVE-2026-88779 is an unauthenticated memory-overflow DoS on SAML SP/IdP (CVSS v4.0 8.7), added to KEV on 4 October. CISA notes it may force a reboot that accelerates code previously injected via 88771. Fixed builds start at 14.1-73.41 and 13.1-64.28. CVE-2026-107406, published 8 October, is a SAML SP/IdP memory overflow leading to RCE or DoS (CVSS v4.0 9.5). Earlier patches are not sufficient. Fixed builds start at 14.1-73.46 and 13.1-64.29 (and matching FIPS/NDcPP). It was not in KEV as at 23 October; Citrix was not aware of unmitigated exploits at publication.
First-wave fixed builds for CVE-2026-88771 through 88778 were 14.1-73.37 and 13.1-64.23. That is the build many teams stopped on, and it is also the trap. Unit 42 documented pre-disclosure activity from mid-August, including DTLS exploitation dropping .deb PHP web shells under /vpn/scripts/linux/, and a three-stage log-poisoning chain for 88771 that implants a shell under /var/netscaler/logon/LogonPoint/custom/ and patches httpd.conf to re-enable PHP. Those artefacts do not disappear because show ns version now looks modern.
Two configuration checks belong alongside the upgrade:
add authentication samlAction (SP) or add authentication samlIdPProfile (IdP).set ns tcpParam -enhancedISNgeneration ENABLED.That persistence-after-patch lesson did not stay on the appliance. The next day it showed up again in Magento and Adobe Commerce stores.
The third example arrived on 27 October, when CISA added CVE-2026-48356, the Adobe Commerce and Magento upload flaw known as PolyShell, to KEV. Adobe rates it critical (CVSS 9.6, no authentication required) and fixes it in APSB26-73, covering Adobe Commerce 2.4.4 through 2.4.9 and Magento Open Source 2.4.6 through 2.4.9. Magento is a PHP application, so plenty of Australian online stores are now sitting at the intersection of both stories.
What makes PolyShell fit this post is Sansec's research published on 24 October. A single operator has planted a JavaScript loader on 953 stores since July 2025, mostly Magento, and PolyShell was the way in for an estimated 471 of them. The loader lives in the cms_block database table and fingerprints each visitor, so automated scanners see a clean page while real shoppers can be served the payload. Earlier versions pushed visitors toward a fake Ledger crypto wallet site. And the line every store owner should read twice: one store on Magento 2.4.7-p10, with no missing core patches, picked up the new loader an hour after a clean scan. The attacker had added a rogue admin account in September and a GSocket backdoor a week later. Patching closed the original hole. It did nothing about the account and the backdoor already inside.
Sansec is blunt about it: if your store loads any of the campaign's domains, the attacker can write to your database, and deleting the script does not remove that access.
The defence section is where the title turns into a checklist. Inventory and version checks first, then hunt for what the patch cannot erase, then remediate in an order that assumes the host may already be someone else's.
php -v on every host and container that serves web traffic (PHP is often embedded; see the NCSC-NL php2shell inventory).show ns version and aim for 14.1-73.46 or 13.1-64.29 so the SAML RCE is covered./ or /index.php with empty User-Agent. The final request in a successful chain may leave no access-log line./bin/sh, curl or wget.15[.]204[.]59[.]70, 162[.]35[.]99[.]94.cms_block and cms_page for fpCode, se_referrer or localStorage.getItem, and check update_time for the attacker's last write.pub/media/custom_options/ and pub/media/customer_address/ (PolyShell webshells have been disguised as PNG images).accesson.php and admin accounts nobody recognises.deepveindrilling[.]com, additionalver[.]com.Patched isn't clean. PHP2Shell showed how fast an emergency release can be followed by working shells, and CISA now attaches forensic triage to the patch deadline. Magento PolyShell showed a fully patched store serving an attacker's code an hour after a clean scan. The NetScaler September and October wave showed the longer version: confirmed Australian exploitation, SAML follow-ons that outran the first patch wave, and webshells that stay put after the version string changes. Unauthenticated RCE on internet-facing infrastructure moves from advisory to working exploit in days. Closing the change ticket is necessary. It is not the same as finishing the job.
Inventory what you actually run, hunt for the persistence patterns above, then patch to the build that closes the latest CVE. For NetScaler that currently means 14.1-73.46 or 13.1-64.29 territory, not the first September drop.
If you want a second set of eyes on exposure, need a compromise assessment, or think you may already be dealing with one of these, talk to our incident response team, or ask about penetration testing and managed detection and response.