Zscaler ThreatLabz (Oct 16) describes how attackers exploit CVE-2026-88771, the unauthenticated NetScaler ADC/Gateway command-execution bug that has been on KEV since Sep 27. Stage 1 sends GETs to /logon/LogonPoint/tmindex.html, /logon/LogonPoint/index.html, /vpn/index.html and /logon/tmindex.html with a User-Agent of INDEX: followed by Base64, which parks the payload in the HTTP access log. Stage 2 POSTs to /nf/auth/doAuthentication.do or /cgi/login with a login value that fakes a 'pitboss PPE missed too many heartbeats' or 'PPE unexpectedly died' record plus shell commands, often using ${IFS} for spaces. That lands in /var/log/ns.log. The built-in /netscaler/ns_monuploadd_err.pl later processes the record without escaping it and runs the command. What to look for: INDEX: User-Agents in access logs; 'pitboss PPE' strings in auth or system logs; Nx_7508 .html/.php/.pl files under /var/vpn/bookmark, /var/vpn/theme, /netscaler/ns_gui/vpn, /var/netscaler/gui/vpn, /var/netscaler/logon/LogonPoint and /var/netscaler/gui/admin_ui/apex; php_engine on or an added AddHandler cgi-script .pl in /etc/httpd.conf; and a FreeBSD implant at /var/kw2s11 fetched from 209.141.43[.]95. ThreatLabz saw at least 26 source IPs fire the chain within about 6 to 7 minutes and lists 28 IPs. The download server overlaps with Magento/Adobe Commerce StyleSmuggler (CVE-2026-75650) activity, which Zscaler says is an investigative lead, not attribution. Capture a snapshot, syslog, the tech-support bundle and core dumps before you upgrade, because updating can destroy evidence. Fixed builds start at 14.1-73.46 and 13.1-64.29.