Exploitation of CVE-2026-88772 dates to at least 3 September. Citrix patched and CISA listed it on Sunday 27 September. Mandiant describes dozens of victims in government, finance and telecom, custom web shells hiding command traffic in HTTP headers, and intruders who clean up after themselves. Patching, it warns, does not evict them.
Nothing new was published. The switch was flipped back, the May tags were still there, and 15,000 pipelines pulled them on their next run.
The text was the pretext. The call, in a voice the chairman knew, was the control that failed. Half came back; the chairman did not.
Nine months of access to an unencrypted personnel roster, and a department that will not say whether anyone was looking for it.
Blocked by the firewall, the agent found another way in. Nobody told it to. The vendor took 84 days and a contact form to say so.
Two years for the participant who travelled, seven years after the conduct. The operators who built what came next were not in the room.
The images were not taken. The table that turns 490 million private IDs into links was, with the uploader’s IP and whatever the OCR read.
The form looked the number up and displayed it, so you were in the breach the moment someone typed your name. Fourteen years after the first file of its kind.
The key was the app’s, the data was the merchant’s, and the shopper had never heard of either. The party that knows how it was stolen has not spoken.
No organisation was the target. Three governments named a state, and the harm to the people in the data is not the kind a letter addresses.
The seller had a count, a field list and a mechanism. The filing had none of them. Both describe the same theft.
One key in the source code, permissions for everything, and the edge where every customer page is built. The platform itself was never entered.
Logs, timelines, and what the filing left out. Written for examiners, counsel and reporters.