Citrix's NetScaler has two zero-days and no patch yet

Two unpatched Citrix NetScaler zero-days are being exploited after a leaked NCSC-NL pre-notification, with Citrix confirming nothing and a fix not expected until next week. Also: Salesforce's Agentforce agents were hijacked via poisoned web forms, Microsoft names the first agentic ransomware operation, and the ICO renames itself. Sources Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation Citrix NetScaler Zero-Day RCE vulnerabilities: FAQ 'SalesBleed' Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration Storm-3168: Agentic-driven cloud attacks using compromised service principals ICO to become Information Commission on 30 September 2026 Read the written version