For some reason, Citrix removed my name from the acknowledgements section of their advisory: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Original credits: > Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov Now: > Michael Tucker and Chew Keong Tan of the JPMorgan Chase XOR Team I reported CVE-2026-88778, a vulnerability that (a) allows IP spoofing and (b) allows thousands of NetScaler hosts to participate in TCP/HTTP/TLS Amplification attacks (a small spoofed TLS Client Hello results in a huge reply being sent to a victim, its amplification factor starts from 40). UPD. Citrix fixed that, now my name is back...