A malicious actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker attempted to establish persistence using a password-protected webshell and tried to escalate privileges by setting setuid and setgid bits on /bin/sh. The attack involved disguising a PHP webshell as a CSS file and manipulating web server aliases to evade detection. Although the targeted sensor was not compromised, the attack demonstrated sophisticated post-exploitation techniques for maintaining access and evading detection.