Stop Reading and Go Patch Your Citrix NetScaler. Now.

In partnership with

If you're running Citrix NetScaler, stop scrolling and go patch. Right now. We'll still be here when you get back.

CVE-2026-3055 — a critical 9.3 CVSS vulnerability in Citrix NetScaler ADC and NetScaler Gateway — is being actively exploited in the wild. This isn't a theoretical risk. Attackers are using it today.

What's Actually Happening

The vulnerability is an insufficient input validation flaw that allows unauthenticated remote code execution. In plain English: someone can take over your NetScaler appliance without credentials. From there, they can pivot into your internal network, intercept VPN traffic, steal session tokens, or deploy ransomware.

Citrix released patches on March 25th. If you haven't applied them yet, you've had a week of exposure to active exploitation. Every day you wait increases the probability that someone has already established persistence in your environment.

The Patch List

Affected versions and their fixes:

• NetScaler ADC 14.1 before 14.1-29.72 → Update to 14.1-29.72 or later

• NetScaler ADC 13.1 before 13.1-55.34 → Update to 13.1-55.34 or later

• NetScaler Gateway 14.1 before 14.1-29.72 → Update to 14.1-29.72 or later

• NetScaler Gateway 13.1 before 13.1-55.34 → Update to 13.1-55.34 or later

If you're running NetScaler ADC FIPS or NDcPP builds, check Citrix's advisory for your specific version numbers. Don't assume you're safe because you're on a hardened build.

Three More Things That Need Your Attention This Week

Axios NPM supply chain attack: Malicious versions 1.14.1 and 0.30.4 of the Axios HTTP client were published to NPM, injecting a fake dependency called "plain-crypto-js." If your dev team uses Axios (and statistically, they probably do), audit your lockfiles immediately. Run npm ls axios across your projects and verify you're on a clean version.

TrueConf zero-day targeting government entities: CVE-2026-3502 (CVSS 7.8) targets the TrueConf video conferencing platform, with Chinese threat actors focusing on Southeast Asian government networks. If your org uses TrueConf — especially in government or defense sectors — patch immediately and review logs for indicators of compromise dating back to early March.

NVIDIA's new AI Agent Toolkit: On the less terrifying end of the spectrum, NVIDIA launched an open platform for building autonomous AI agents with OpenShell, Nemotron models, and AI-Q blueprints. If you're the person in your org evaluating AI infrastructure, this is worth a look — it combines open and proprietary models to reduce costs while maintaining enterprise-grade capabilities. Not urgent, but potentially relevant for Q2 planning.

The Supply Chain Problem Is Getting Worse

Step back for a second and look at the pattern: Trivy (security scanner) was compromised two weeks ago. LiteLLM (AI library) was compromised the same week. Now Axios (HTTP client used by millions of projects). Three major supply chain attacks in 14 days.

This isn't a coincidence — it's a trend. Attackers have figured out that poisoning widely-used open source packages is more efficient than targeting individual organizations. Why breach one company when you can compromise a dependency and breach thousands?

If your organization doesn't have a software composition analysis (SCA) tool running in your CI/CD pipeline, this is the week to make that case to management. Tools like Snyk, Socket.dev, or even GitHub's built-in Dependabot can catch known-malicious packages before they hit production. The ROI argument writes itself: three supply chain attacks in two weeks, each capable of exfiltrating credentials and source code.

Your Wednesday Morning Checklist

• Patch Citrix NetScaler if you haven't already (CVE-2026-3055, CVSS 9.3)

• Audit Axios versions across all Node.js projects (npm ls axios)

• Check for TrueConf installations and update if present

• Review your SCA tooling — if you don't have any, start evaluating this week

• Brief your team on the supply chain attack trend — three in two weeks is a pattern, not a coincidence

The theme this week is clear: trust nothing, verify everything, and patch before coffee.

Stay paranoid. Stay patched. See you Thursday

1,000+ Proven ChatGPT Prompts That Help You Work 10X Faster

ChatGPT is insanely powerful.

But most people waste 90% of its potential by using it like Google.

These 1,000+ proven ChatGPT prompts fix that and help you work 10X faster.

Sign up for Superhuman AI and get:

• 1,000+ ready-to-use prompts to solve problems in minutes instead of hours—tested & used by 1M+ professionals

• Superhuman AI newsletter (3 min daily) so you keep learning new AI tools & tutorials to stay ahead in your career—the prompts are just the beginning

Claim your free prompts

.