Citrix runbook calls for wiping and rebuilding compromised NetScaler VPX instances, then upgrading firmware and monitoring for 90 days

Citrix's incident runbook for a suspected NetScaler ADC or Gateway compromise puts evidence preservation at step one, and it is specific about the order. Snapshot the VPX. Record the system time, timezone and NTP settings. Pull the logs off the remote syslog server and the Console, not just the appliance. Generate a Packet Engine core dump, a step that forces a warm restart and has to run on the suspected box itself. ^[1][2] Only after that does the document reach the part most people reach for first. Wipe and rebuild the instance, upgrade to the latest firmware, and restore a configuration backup that pre-dates the breach. ^[3] The runbook's own words on the backup: "If restoring from backups, verify they pre-date the compromise." ^[4]

Run the order backwards and you have the common failure mode. Upgrade first and the snapshot is gone, the core dump captures a clean image, and Cloud Software Group has already said it does not perform forensic investigations for you. ^[5] The firmware upgrade sits at step four of five, after the wipe, because on NetScaler the vendor treats the upgrade as part of recovery; it tells you to replace the instance and watch the rebuilt one for at least 90 days. ^[3][6] NetScaler's own gateway flaws, CVE-2026-88771 and CVE-2026-88772, are among those under in-the-wild exploitation. ^[16]

What the upgrade leaves on the box

Microsoft's Zimbra writeup shows what the upgrade walks past. CVE-2026-73570 is an unauthenticated command injection in the Zimbra Collaboration Suite SNMP notification path: a crafted SMTP message carries shell metacharacters into an snmptrap invocation and runs commands as the zimbra service account, with no authentication and no user interaction, on servers where the optional zimbra-snmp package is installed and SNMP notifications are enabled. ^[7] By the time an operator applies the fix, Microsoft says the box may already hold JSP web shells written into the webroot, interactive reverse shells, privilege escalation and persistent remote-access tooling. ^[10] It saw web shells copied across Jetty and mailboxd paths and onto peer mailbox nodes, giving the intruder alternative doors before the first one closes. ^[11] Other chains used cron, systemd and memfd_create to keep execution running from memory. ^[12]

The timing is the second loss. Zimbra's remediation shipped in version 10.1.20 on July 20, 2026, and the flaw was publicly disclosed on August 13. ^[8] Between July 28 and August 7, inside that window, Microsoft watched two out-of-band scanning tools probe the same injection point before most defenders had any reason to rush the upgrade. ^[9] The fix existed for 24 days before the disclosure that would have told people why to apply it. ^[32]

The FortiMail flaw was exploited as a zero-day. CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog after active exploitation; the flaw lets an unauthenticated attacker write arbitrary files over crafted HTTP or HTTPS. ^[13] For several branches Fortinet listed the fixed build as "upcoming," so the interim advice was to disable the IBE feature and take the management interface off the internet. ^[14] Most of Fortinet's published indicators are files an attacker leaves on disk: an added /data/lib/liblog.so, /data/bin/webconsole and /data/etc/ld.so.preload, and a modified /bin/smit. ^[15] A firmware upgrade is not guaranteed to remove files added under /data, which is where those indicators sit.

In the WordPress case, Sucuri calls the SC backdoor a "self-healing mesh" whose payload lives in at least eight places at once, spread across files, the database and a System V shared-memory segment, with every copy able to rebuild the others. ^[20] Researcher Gabriel Barbosa put it plainly: "Delete the plugin and a drop-in rewrites it. Delete the drop-in and the theme rewrites it. Clean every file on disk, and the next page load restores the whole set from the database or from a shared-memory segment." ^[21] The shared-memory copy sits in RAM, survives both file deletion and database cleanup, and on shared hosting can be owned by a different account entirely. ^[22]

Upgrading blind

Two of the week's advisories make the forensic gap explicit. GitLab's fix for CVE-2026-90970, a 9.9 that lets a user with Duo Agent Platform access escape the AI Gateway's prompt-template sandbox and run commands, ships with no workaround for gateways that cannot be updated yet and, in GitLab's own account, no way to check whether a gateway was attacked before it was updated. ^[17] Dell's Container Storage Modules advisory covers flaws rated as high as CVSS 10.0 with "no workarounds or mitigations other than updating" to version 1.18.0, and it also tells customers to rotate their JWT signing secrets. ^[18] The reason is in the detail of CVE-2026-54472: a hard-coded credential lets an unauthenticated attacker forge cryptographically valid administrative tokens, and new software does not invalidate a token minted before the upgrade. ^[19]

What the AI benchmark actually shows

The premise under all of this is that AI has made working exploits cheap. The evidence people cite is Hacktron's benchmark, and it is worth reading before repeating. Hacktron handed GPT-5.6 Sol Ultra the V8 source tree at a pinned Chrome version and a sandbox-enabled d8 build, then asked it to inspect V8 security-fix commits, build the standard exploit primitives, escape the V8 sandbox and execute a command. ^[23] Over three days Sol Ultra built the full renderer chain on recent Chrome and ran its command with limited nudges, while Grok 4.5 and Sol Medium reached an information leak and stalled. ^[24] The author's conclusion was blunt: "exploit development as we know it is dead for anyone who can throw inference-scale compute at a model at GPT-5.6's level or above." ^[26]

Read the resource line, and "cheap" is the wrong word. The root agent spent 819.6 million input tokens; its 74 sub-agents spent another 1.27 billion, about 70% of the work. ^[25] Add the two and one chain against one bug class cost roughly 2.09 billion input tokens. ^[31] What fell is the cost in human expertise and time. And the setup was generous: the model was pointed at the commits that fixed the bugs, so it was reversing known-and-patched defects, not finding an unknown one cold. ^[23] For that result to transfer to your threat model you would need the source tree, the fix commits, a test harness and an inference budget of that size.

The direction still bears on the runbook. ThreatsDay's framing for the week is that attackers increasingly let automation stitch together a rough path that still works, and faster tools are changing the pace. ^[28] Chainalysis reports that blockchain dead-drop techniques "have surged 440% since the launch of Chinese high-capacity open-source AI models that place no restrictions on generating malicious code." ^[27] As the time from fix to working exploit shrinks, the window in which a patch is protective shrinks with it, and the Zimbra timeline shows that window can close before public disclosure. ^[9]

The runbook that follows

For an internet-facing appliance the sequence changes. Treat exploited-in-the-wild as the default, image the box before you touch it, assume persistence the upgrade will not reach, and rebuild rather than update when the indicators say you were in scope. Automox's Justin Talerico stated the posture in one line: "Patch what's patchable, mitigate what isn't, and govern the endpoint continuously." ^[30] The forensic half of that is starting to appear in platforms. Android 17's Advanced Protection adds Intrusion Logging, which Google describes as "persistent, privacy-preserving forensics logging to investigate sophisticated spyware attacks," though a user has to switch it on. ^[29] On the appliances in this story that logging mostly does not exist. Citrix tells you to capture the core dump yourself before you wipe. ^[1]