watchTowr ads

🥲 Today, watchTowr Labs is releasing analysis of CVE-2026-88772 - the second Citrix NetScaler Remote Code Execution (RCE) zero-day exploited in the wild. This vulnerability is slightly different to CVE-2026-88771: exploitation requires DTLS to be enabled (which is the default on VPN virtual servers) and the flaw lives within DTLS parsing code. This research powers the watchTowr Platform, and enabled watchTowr clients to rapidly react to this emerging threat and validate their exposure when rumors were circulating. This is what industry-leading Preemptive Exposure Management looks like in practice 🫡 Reach out via our website for a demo of the watchTowr Platform. https://lnkd.in/gyBtMDsF

🚨 Early on Saturday, watchTowr publicly confirmed the rumors: there were RCE zero-days in Citrix NetScaler appliances being exploited in the wild to compromise organizations. Today, watchTowr Labs has published the industry's first technical analysis of CVE-2026-88771. An unauthenticated attacker can run commands as root on a default-configured appliance that often sits at the edge of the network and controls remote access for the entire organization. Citrix has released fixes for eight vulnerabilities in their bulletin, two of which are confirmed exploited in the wild. Organizations running NetScaler ADC or NetScaler Gateway should upgrade immediately and begin incident response. As always, watchTowr Platform clients are ahead. * Our Rapid Reaction capability identified and validated client exposure before Citrix disclosed the vulnerabilities, and * Active Defense mitigations are already available for deployment across client networks. This is what industry-leading Preemptive Exposure Management looks like in practice 🫡 Reach out via our website for a demo. https://lnkd.in/gsXiQbdg

🚀 NEW: Active Defense now mitigates exposure beyond the edge. Exposure doesn’t just exist at the edge, so we’ve enhanced our Active Defense mitigation capabilities to match other types of exposure that the watchTowr Platform finds, including: - Dangling DNS records - Abandoned cloud assets - Expired domains Here’s what it looks like in practice: Your login page loads JavaScript from a domain that expired without anyone noticing. Every customer requests that script on every visit. If an attacker registers the domain, they run code in your customers' browsers. → watchTowr finds it, validates the exposure, and registers the domain before an attacker can. The same goes for the forgotten DNS record and the cloud asset that wasn’t reclaimed. The watchTowr Platform identifies and validates the exposure, then mitigates it, autonomously or customer-controlled. Learn more about Active Defense here: https://lnkd.in/dw9KjXrN The watchTowr Platform - built to outpace attackers.

Project Red is our autonomous vulnerability reproduction capability, and last Friday, it did what it was built to do for the watchTowr Platform. When wp2shell dropped, the watchTowr Platform, leveraging Project Red, autonomously reproduced and validated the vulnerability in 22 minutes, followed by Active Defense producing and deploying mitigations 11 minutes later. 33 minutes total to reproduce and mitigate, all before in-the-wild exploitation began. In-the-wild exploitation, driven by AI, now begins in hours, and this story will repeat. Together, Project Red and Active Defense let watchTowr clients validate and mitigate emerging threats autonomously. Leveraging AI, the watchTowr Platform combines threat intelligence, reproduction, validation, and mitigation into a single system operating at attacker speed. Preemptive Exposure Management, built to outpace attackers. Reach out for a demo, and to learn more.

wp2shell: 22 minutes to reproduce by watchTowr's Project Red. 11 minutes later, Active Defense autonomously mitigated. All before in-the-wild exploitation began. wp2shell, a pre-authentication remote code execution flaw in WordPress and the most widely deployed CMS on the web, is the latest example of how far exploitation timelines have compressed. Within hours of disclosure, in-the-wild exploitation of wp2shell began. The watchTowr Platform moved faster: * Within 22 minutes, Project Red autonomously reproduced the vulnerability, validated the safety of the capability, and began validating client exposure. * 11 minutes later, Active Defense autonomous mitigations were released, enabling network-level protection where configured. The new normal is here. The timeline between disclosure and exploitation is now measured in hours, and AI is compressing it further. When a critical vulnerability drops, the question is no longer only about understanding exposure, but whether an organization can understand and mitigate exposure before attackers act. Mitigation is now an essential part of rapidly reacting to emerging threats. This is what is possible when AI combines threat intelligence, reproduction, validation, and mitigation into a single system, operating at attacker speed. Preemptive Exposure Management, built to outpace attackers.

Knowing you’re exposed when threats emerge and having the ability to rapidly react before exploitation are two different problems. Solving neither on its own is enough. Especially when AI-driven threats have collapsed exploitation timelines. The watchTowr Platform, our Preemptive Exposure Management solution, was built to solve this problem: *AI-Driven Rapid Reaction validates exposure to emerging threats *Active Defense autonomously deploys intelligence-driven mitigations at the edge So when enterprise remediation takes weeks, but threat actors are weaponizing vulnerabilities in hours, the watchTowr Platform delivers what no one else can: time to respond.