Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response

According to Dark Reading, Citrix posted an update that patched eight vulnerabilities (CVE-2026-88771 through CVE-2026-88778), including two zero-days that had been exploited in the wild.[1] Dark Reading also reports that Citrix's response has come under fire from many in the cybersecurity community as being too little, too late.[1]A Security Check-in Quick Hits post by Rod Trent reports that CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate action.[2] 25 issued a recommendation to customers, urging them to proactively take their systems offline based on intelligence about an imminent attack.[1] Cybersecurity Dive reports that the advice was a shut down their systems for a nine-hour period, while the threat was investigated[3], while Cybernews put the window at six hours[4].Kiteworks CISO Frank Balonis told TechCrunch that "this advisory is preventative rather than a response to a confirmed breach."[5] Cybersecurity News reports that Kiteworks updated its advisory on September 27 and said customers could bring their systems back online[6].Kiteworks CEO Jonathan Yaron said in a statement cited by Dark Reading: "We would rather be proactive on credible warning than wait for certainty and be too late.[1]According to Dark Reading, John Strand of Black Hills Information Security called the shutdown call "wild"[1]. Dark Reading notes that only 1% of customers were vulnerable[1].