Rapid7
Boston-based cybersecurity company selling managed detection, exposure management and the Metasploit framework.
Rapid7 logged the first known attempt to exploit the NetScaler flaw CVE-2026-88771 on 20 September 2026, a week before Citrix disclosed it, and then found attackers copying appliance secrets that a software update cannot revoke.
Last refreshed: 12 October 2026 · Appears in 1 active topic
What did Rapid7 see a week before Citrix disclosed its NetScaler zero-day?
Timeline for Rapid7
Reported first exploitation on 20 September and a planted web shell
Cybersecurity: Threats and Defences: Citrix replaces its own NetScaler fixMentioned in: A quiet KEV fortnight, then a 2008 bug
Cybersecurity: Threats and DefencesMentioned in: SharePoint patch clock runs out today
Cybersecurity: Threats and DefencesMentioned in: WebLogic flaw revived as ransomware vector
Cybersecurity: Threats and DefencesMentioned in: Drupal SQL flaw hits PostgreSQL sites
Cybersecurity: Threats and DefencesBackground
Rapid7 is a Nasdaq-listed security vendor based in Boston. Rapid7's business rests on three lines: managed detection and response, exposure management through products such as InsightVM, and Metasploit, the penetration-testing framework.
The company changed chief executive in June 2026. Wael Mohamed, a Rapid7 board member WHO previously ran Forescout, succeeded Corey Thomas, WHO stayed on as executive chairman. Mohamed's appointment came as growth stalled. Second-quarter revenue slipped 1.5% to $210.9m, annualised recurring revenue dropped 2% to $824m, and about 12% of staff heard that a restructuring around the core platform affected their roles.
Rapid7's research TEAM carries weight well beyond its own customers. Defenders sizing a newly exploited flaw routinely quote its internet exposure counts, as with the roughly 1.5 million cPanel hosts it tallied in April 2026, and its incident write-ups, such as the September 2026 account of stolen NetScaler configuration files.
Rapid7 caught the NetScaler attacks early
Rapid7's sensors picked up an exploitation attempt against CVE-2026-88771 on 20 September, seven days ahead of the Citrix disclosure on 27 September. On 24 September its responders found a web shell at a second customer. The company's analysis showed the payload zipping the /flash/nsconfig directory, where NetScaler keeps TLS private keys and bind passwords, and dropping the archive into a folder the appliance serves to the web.
That finding shaped Rapid7's advice to clients: a patched box can still leak, because copied keys and passwords stay valid until someone replaces them. Earlier, on 30 April, its tracker had sized the cPanel zero-day CVE-2026-41940 at about 1.5 million internet-facing instances.
