From v17.29 to v17.43
On October 23, PHP2Shell was added with v17.30 (CTX697263, CVE-2026-109618, and CVE-2026-109619 in the Management Portal), one day after the Citrix blog post “Protecting NetScaler Management Access” and two days after the analyses by Unit 42 and Zscaler.
Citrix did not release the fix builds until the evening of October 27, along with the patches. Prior to that, our rule sets used the fix builds from the SAML bulletin for PHP2Shell; as a result, appliances running versions 14.1-73.41 through 73.46 were considered patched.
Only 14.1-73.49 (13.1-64.32, FIPS 73.49 or 37.286) has been fixed; until the update is released, the mitigation via DENY-ACL will help.
If you ran a test using a rule set from before October 28, 2026, please run it again.
We now only adopt fix builds from the CTX article. If there isn't one yet, the verdict reports "pending" and lists the mitigation instead of a target build.
Crashes as an Indicator
The biggest increase is in crashes. A failed exploit attempt doesn't always leave a log entry, but it sometimes causes a process to crash:
- Every event is at least yellow. It turns red if it matches an open vulnerability (nsaaad with SAML, httpd with an open PHP2Shell, nsppe with DTLS), recurs, or if an external request was received within the preceding 120 seconds.
- Evidence includes pitboss and kernel logs, core files, kernel panics, memory pressure, and reboots that no one triggered
Also new
- Trust list with expiration date: Trusted addresses are treated as internal for management, SSH, and login errors, and appear in blue as
[TRUST], with no effect on the verdict. Findings that do have an effect remain red - Allowlist with a SHA-256 pin per file
- Observed addresses, including anonymized ones, along with a share file for sending to us, without the appliance ID
- Footer showing the tool, version, control status, and source in every report
- Anonymization now also masks hostnames from URLs and domains from the configuration. Anyone who has shared older reports should review them
Standard Condition and Classification
Rule Status 2026-10-28e. The crash rules are heuristic; they do not rely on a manufacturer's signature, and "OK" still means "no known pattern matched."
Feedback
Have you encountered crashes that the script doesn't classify? Please send us the anonymized report.