Google warned that two critical Citrix NetScaler zero-days are being exploited for root access, web-shell deployment, and network intrusion.