httpd[.]pidDomain
Reported by 2 independent sources · first reported by GreyNoise · last reported
Last reported 8 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability“kill -HUP $(cat /var/run/httpd[.]pid)The same Base64-encoded payload in the User-Agent field was sent to multiple paths.”
-
Swarming Against Citrix 0-Day Exploitation“kill -HUP `cat /var/run/httpd[.]pid`”
Indicators reported together
named in the same reports- doauthentication[.]doin 1 report
- 149.104.78[.]141in 1 report
- 6f5a2a452a790132…2f3b11e4b1e7in 1 report
- activity[.]toin 1 report
- enablement[.]searchin 1 report
- logs[.]searchin 1 report
- syntax[.]reviewin 1 report
- executed[.]atin 1 report
- hxxp://209.141.43[.]95/files/kw2-freebsd-x64-s11;chmod$in 1 report
- 209.141.43[.]95in 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2026-88771, CVE-2025-5777, CVE-2026-75650, CVE-2026-107406
Thanks — we review every report.