Kiteworks & Citrix Incidents Expose the Hard Tradeoffs of Zero-Day Disclosure

DarkReading's analysis compares two late-September zero-day incidents and vendor playbooks: Kiteworks issued an aggressive nine-hour global shutdown for an unconfirmed Advanced Forms flaw that ultimately affected under 1% of customers with no evidence of exploitation, while Citrix remained largely silent until shipping patches for two NetScaler RCEs (CVE-2026-88771 / CVE-2026-88772) despite confirmed exploitation tracing back to September 3, 2026 and suspected state-sponsored intrusions; the piece concludes there is no single correct disclosure model and provides recommendations for vendors, security teams, and executives.