Crims claim HexStrike AI penetration tool makes quick work of Citrix bugs

Check Point researchers report that CVE-2025-7775, a critical pre-auth remote code execution in Citrix NetScaler, was exploited as a zero-day to drop webshells and backdoor appliances prior to patching. Threat actors on underground forums have claimed rapid adoption of HexStrike AI—an open-source, LLM-orchestrated penetration-testing framework—to generate exploit code and scan for vulnerable NetScaler instances within hours of the disclosure, raising concerns that AI-driven tooling will dramatically shorten the window between disclosure and mass exploitation.