Citrix ships an emergency patch to cover a pre-auth code execution flaw in network appliances and the NSA blames a Chinese hacking group for zero-day exploitation.