--- title: Kiteworks, Citrix Incidents Show Challenge of Zero-Day... description: Two vendors faced zero-day crises the same weekend with very different disclosure approaches. Citrix stayed quiet about reported attacks on NetScaler until it... canonical: https://daily.dev/posts/kiteworks-citrix-incidents-show-challenge-of-zero-day-response-cpvjzj3ye twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kiteworks, Citrix Incidents Show Challenge of Zero-Day Response | daily.dev og:description: Two vendors faced zero-day crises the same weekend with very different disclosure approaches. Citrix stayed quiet about reported attacks on NetScaler until it... og:url: https://daily.dev/posts/kiteworks-citrix-incidents-show-challenge-of-zero-day-response-cpvjzj3ye og:image: https://api.daily.dev/og/posts/CpVJZJ3yE.png og:image:alt: Kiteworks, Citrix Incidents Show Challenge of Zero-Day Response og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kiteworks, Citrix Incidents Show Challenge of Zero-Day Response **[Dark Reading](https://daily.dev/sources/dr)** · 6 min read · 0 upvotes · 0 comments ## Summary Two vendors faced zero-day crises the same weekend with very different disclosure approaches. Citrix stayed quiet about reported attacks on NetScaler until it released patches for eight vulnerabilities (CVE-2026-88771 through CVE-2026-88778), including two zero-days already under active exploitation, drawing criticism for being too slow to share intelligence. Kiteworks, by contrast, proactively told customers to take its data-protection platform offline for a nine-hour window based on credible threat intelligence, later determining only 1% of customers were actually vulnerable. Security experts are split on whether Kiteworks' shutdown call was an overreaction or the right proactive move, while Citrix's silence is seen as the bigger failure. Experts note that shutdown advisories carry real operational costs and need to be specific about scope and duration to be actionable. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What vulnerabilities did Citrix patch in the September 2026 NetScaler security bulletin? Citrix patched eight vulnerabilities, CVE-2026-88771 through CVE-2026-88778, in its NetScaler ADC and NetScaler Gateway security bulletin. Two of them, CVE-2026-88771 and CVE-2026-88772, were zero-days already being exploited in the wild before the patch was released, and they continued to see widespread exploitation afterward. Citrix urged customers to upgrade to the fixed versions immediately rather than take systems offline. _Teams tracking NetScaler exposure can follow CVE disclosures and vendor advisories as they break on daily.dev._ ### Why did Kiteworks tell customers to shut down their systems during a reported zero-day threat? Kiteworks asked customers to take systems offline for a nine-hour window based on credible threat intelligence about an imminent attack, developed with its engineering team and external national intelligence experts, before confirming an actual exploit. It later found the vulnerability would have affected only about 1% of customers, but CEO Jonathan Yaron said the company would rather act on credible warning than wait for certainty. _Weighing proactive shutdowns against patch timing is easier when incident analyses like this surface on daily.dev._ ### What should a vendor include when it asks customers to shut down systems during a security incident? Vendors should specify exactly which customers and configurations are at risk and give a defined shutdown duration rather than an open-ended instruction. Tenable's Satnam Narang noted that Kiteworks' nine-hour, scoped shutdown was more actionable than a vague 'turn it off' directive, since blanket shutdowns cut off remote access, disrupt customer-facing applications, and halt data access with real operational costs. _Incident response planning benefits from comparing real vendor shutdown decisions surfaced through daily.dev._ ## Similar posts on daily.dev - [What Zero-Day Response Should Be in the Post-Mythos Era](https://daily.dev/posts/what-zero-day-response-should-be-in-the-post-mythos-era-sy5pwxui7) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/kiteworks-citrix-incidents-show-challenge-of-zero-day-response-cpvjzj3ye) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kiteworks, Citrix Incidents Show Challenge of Zero-Day Response","url":"https://daily.dev/posts/kiteworks-citrix-incidents-show-challenge-of-zero-day-response-cpvjzj3ye","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kiteworks-citrix-incidents-show-challenge-of-zero-day-response-cpvjzj3ye"},"datePublished":"2026-10-02T17:01:19.937Z","dateModified":"2026-10-02T17:05:25.446Z","description":"Two vendors faced zero-day crises the same weekend with very different disclosure approaches. Citrix stayed quiet about reported attacks on NetScaler until it...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/da02c00996e6e52915935a428454b0cd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/da02c00996e6e52915935a428454b0cd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kiteworks-citrix-incidents-show-challenge-of-zero-day-response-cpvjzj3ye","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,zero-day","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Kiteworks, Citrix Incidents Show Challenge of Zero-Day Response"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/kiteworks-citrix-incidents-show-challenge-of-zero-day-response-cpvjzj3ye#faq","mainEntity":[{"@type":"Question","name":"What vulnerabilities did Citrix patch in the September 2026 NetScaler security bulletin?","acceptedAnswer":{"@type":"Answer","text":"Citrix patched eight vulnerabilities, CVE-2026-88771 through CVE-2026-88778, in its NetScaler ADC and NetScaler Gateway security bulletin. Two of them, CVE-2026-88771 and CVE-2026-88772, were zero-days already being exploited in the wild before the patch was released, and they continued to see widespread exploitation afterward. Citrix urged customers to upgrade to the fixed versions immediately rather than take systems offline. Teams tracking NetScaler exposure can follow CVE disclosures and vendor advisories as they break on daily.dev."}},{"@type":"Question","name":"Why did Kiteworks tell customers to shut down their systems during a reported zero-day threat?","acceptedAnswer":{"@type":"Answer","text":"Kiteworks asked customers to take systems offline for a nine-hour window based on credible threat intelligence about an imminent attack, developed with its engineering team and external national intelligence experts, before confirming an actual exploit. It later found the vulnerability would have affected only about 1% of customers, but CEO Jonathan Yaron said the company would rather act on credible warning than wait for certainty. Weighing proactive shutdowns against patch timing is easier when incident analyses like this surface on daily.dev."}},{"@type":"Question","name":"What should a vendor include when it asks customers to shut down systems during a security incident?","acceptedAnswer":{"@type":"Answer","text":"Vendors should specify exactly which customers and configurations are at risk and give a defined shutdown duration rather than an open-ended instruction. Tenable's Satnam Narang noted that Kiteworks' nine-hour, scoped shutdown was more actionable than a vague 'turn it off' directive, since blanket shutdowns cut off remote access, disrupt customer-facing applications, and halt data access with real operational costs. Incident response planning benefits from comparing real vendor shutdown decisions surfaced through daily.dev."}}]} ```