What happened. A new CitrixBleed-class vulnerability in Citrix NetScaler appliances is being exploited by attackers using publicly available proof-of-concept code to retrieve arbitrary memory contents from the device's HTTP responses — the same memory-leak pattern that made the original CitrixBleed so damaging, because leaked memory can contain session tokens that bypass authentication and MFA entirely.

Who's affected. Anyone running exposed NetScaler ADC / Gateway appliances. These sit at the network edge by design, which is exactly why they are a first-choice target: compromise the appliance and you are already inside.

What to do now. Apply Citrix's fix immediately and, critically, terminate all active sessions after patching — a patch alone does not invalidate tokens an attacker may have already stolen from memory. Treat any session that predates your patch as suspect.

Our read. The headline detail is the timeline: exploitation began immediately after public disclosure. There was no grace period, no window to schedule a test. This is the single clearest argument against point-in-time security: the moment of maximum risk is the moment of disclosure, and any defense that operates on a weekly or quarterly cadence is structurally too slow. Edge appliances like NetScaler are precisely where continuous, always-on verification earns its keep — the alternative is finding out you were exposed after the session tokens are already gone.

Reporting by SecurityWeek, linked above.