Hackers exploit Citrix NetScaler zero-day to deploy web shells

Attackers are actively exploiting two unpatched zero-day vulnerabilities in Citrix NetScaler, a widely-deployed network appliance, to install web shells, achieve root-level access, and move laterally across victim networks. Because these are zero-days, no official patches were available at the time of exploitation, making proactive compensating controls and rapid detection the only viable defenses. Internet-facing network appliances like NetScaler are high-value targets because they sit at the perimeter, often with privileged access to internal resources. This incident underscores that organizations cannot rely solely on patching cycles — layered defenses, monitoring, and segmentation are critical to limiting blast radius when zero-days emerge.