They still have nearly 10k employees and are a big, affluent company. None of their project should be a one-man project, but, even if it were, they should still be able to find enough engineers to work on it in case of emergencies.

If it can be done by a small startup with a total of 3 devs in the entire company (and I have seen it done), it can be done by a company the size of Citrix.

I guess you'd be surprised at how easy it is for an organization to just de-staff a launched product.

why are we defending gross incompetence and laid back attitudes again?

Who is defending, exactly?

thedance is pointing out that we have no idea of the inner workings of Citrix, and how they staff their projects. It's not completely unreasonable to believe a non-core project has minimal staffing levels.

The vulnerability in Netscaler was an old bug in a web server that let you trivially break out of the virtual directory.

So you could navigate to <URL>/vpn/../path and read/write files.

The device is a freaking load balancer. It took the company a month from public disclosure to push out a rule to workaround to stop most exploits on some devices, and 6 weeks to patch it. Something went horribly wrong.

Netscaler was a potential spinoff product awhile back — my guess is that they stripped the division in the anticipation of a sale to make the numbers look good.