The Shittrix Disclosure: 89 Flaws Collapse 20 Years of Trust in Citrix and XCP-ng

Independent researcher Jakob Wolffhechel disclosed 89 vulnerabilities in Citrix XenServer/Hypervisor and XCP-ng (dubbed “Shittrix”), describing pervasive input-validation failures since ~2006 that let minimally privileged management users execute single API calls to gain full host filesystem access, mount any host block device, proxy malformed storage-protocol commands, exfiltrate cross-VM data, and potentially install persistent bootkits; key issues (e.g., BOC-1, SMC-1) are rated CVSS 9.9 and the researcher recommends treating any production host exposed during the 20-year window as compromised.