> ‘Advanced’ hacker seen exploiting Cisco, Citrix zero-days

The hackers notably used custom malware and were exploiting CVE-2025-5777 — now known colloquially as “Citrix Bleed Two” — before it was disclosed publicly in July.