Unknown attackers exploit a patched Citrix NetScaler flaw to gain root access and deploy web shells and a tunneler.