Two critical Citrix NetScaler zero-days were exploited for days before the public heard a word, and a Pentagon human resources system was open to unauthorized users for roughly nine months before notification letters went out to more than 3 million people. Bitget, one of the world’s largest crypto exchanges, lost $387.5 million after attackers got in through zero-days in third-party security products. Meanwhile, the FBI breach claimed by ShinyHunters last week took two turns: a reported arrest, and new evidence that the group walked through a flaw Oracle patched in June by sidestepping a firew