Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response

According to Dark Reading, Citrix posted an update that patched eight vulnerabilities (CVE-2026-88771 through CVE-2026-88778), including two zero-days that had been exploited in the wild.[1] The outlet says Citrix did not recommend taking servers offline[1] and told customers to upgrade right away.Dark Reading reports that Citrix's response has come under fire from many in the cybersecurity community as being too little, too late.[1] In earlier Dark Reading coverage, a researcher named Harris said Citrix's silence seemed "almost purposeful"[2]. On Sept. 25, the company[1] told customers to proactively take their systems offline based on intelligence about an imminent attack.[1] Kiteworks CISO Frank Balonis told TechCrunch that the warning came from "credible threat intelligence from law enforcement"[3].The Hacker News reports that Kiteworks said "As of September 27th, the shutdown recommendation is now lifted for all customers."[4] Cyber Security News reports that the company stressed that it had no evidence of a compromise[5].Kiteworks CEO Jonathan Yaron said, according to Dark Reading: "We would rather be proactive on credible warning than wait for certainty and be too late."[1] Dark Reading reports that John Strand of Black Hills Information Security called the shutdown request "wild"[1]. The outlet also notes that only 1% of customers were vulnerable[1].