Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response

A late-September weekend turned into a stress test for zero-day disclosure after GreyNoise Intelligence spotted a single IP scanning and running RCE attempts against Citrix NetScaler on Sept. 24, triggering days of speculation before watchTowr's CEO publicly urged admins to pull systems offline. Citrix eventually released fixes for eight flaws, CVE-2026-88771 through CVE-2026-88778, confirming that two of them, CVE-2026-88771 and CVE-2026-88772, were zero-days already being actively exploited, though the vendor stopped short of recommending a shutdown and simply pushed customers to upgrade immediately. In parallel, Kiteworks chose the opposite approach: acting on threat intelligence about a possible imminent attack, it told customers to proactively disconnect their systems before confirming any breach, then issued a patch days later after determining only about 1% of its customer base was actually at risk. The contrasting responses have sparked debate among security professionals over whether Citrix was too slow and quiet, and whether Kiteworks overreacted by shutting down systems absent confirmed compromise, highlighting how vendors still lack a shared standard for handling early zero-day warnings.