Please tell your friends about federated social media site that speaks several fediverse protocols thus serving as a hub uniting them, hubzilla.eskimo.com, also check out friendica.eskimo.com, federated
macroblogging social media site, mastodon.eskimo.com a federated microblogging site, and yacy.eskimo.com an uncensored federated search engine. All Free!
DHS can’t arrest and deport 15.4 million illegal aliens, but if it simply enforces the law, many aliens will get the message and leave on their own — as hundreds of thousands apparently already hav…
The Foreign Ministers of the Organization of Islamic Cooperation (OIC), with 57 member nations, the second largest international organization in the world after the United Nations, met in Istanbul, Türkiye over June 21-22 this past weekend.
Heute war es schon das zweite Mal, dass am Klavier im Bahnhof Südkreuz ein Mann saß, vom Aussehen her, Jacke, Hose, Füße ohne Socken in fragwürdigen Schuhen, vom Aussehen her einer auf der Straße. Und zum zweiten Mal saß er da an dem Klavier und spielte mit einer wunderschönen Eleganz und Leichtigkeit #Chopin. Als ich reinkam in die Halle, begrüßte mich der Minutenwalzer, und danach kam der da:
Waltz No. 2 from Waltzes, Op. 64Arthur Rubinstein, pianoWaltz in C-sharp minor is the second work of Chopin's opus 64 and the companion to the Minute Waltz (...
Bauernverband will weniger #Mindestlohn für ausländische #Erntehelfer als für Deutsche. Landwirte sollten Saisonarbeitern aus dem europäischen Ausland nur 80 % des normalen Mindestlohns zahlen müssen, so die Unternehmerorganisation. taz.de/Mindestlohn-fuer-Ernteh… #Landwirtschaft
The set is now complete. Order your copies today! https://dutchsheets.mybigcommerce.com/Learn more about Give Him Fifteen here:Website: https://www.givehim15...
"Behold, the Lamb of God, who takes away the sin of the world! This is he of whom I said, ‘After me comes a man who ranks before me, for he was before me.’ I myself did not know him; but for this I came baptizing with water, that he might be revealed to Israel."
In May, legendary Apple designer Jony Ive hooked up with OpenAI to announce an unspecified gadget. [WSJ, archive] To promote this complete vaporware, OpenAI released a video of Sam Altman and Ive b…
Stephen McNallen, the founder of the Asatru movement here in the United States, produced a series of 17 different presentations and interviews with Odinist luminaries a few years ago called Gods, Folk and Destiny.
They're both informative and entertaining. I wish he had done more.
TalieVision is television for a Whiter future. It's a growing archive of almost 600 pro-White and White-friendly (mostly) full-length videos, featuring news, interviews, speeches, lectures, documentary films, concerts & other live performances, movies, and much more.
B-2 wings are increasingly bringing on pilots directly from Air Education and Training Command — and they have to keep training and developing their skills.
@HunDriverWidow No, they are very experienced professionals, but even this article from 2019 states they are bringing them on right out of undergraduate pilot training. I wonder if it's tougher, now, to find candidates. And I'm thinking that to accomplish those protracted missions, successfully, they need stamina...and youth.
My late husband was a retired USAF fighter pilot. To be a pilot of this caliber, they are not 20 yrs old. 2019 was a long time ago in terms of a bird of this class.
@HunDriverWidow Yes, I know. We have USAF here, as well as other pilots. It was just a meme...and they do have to have stamina, as I'm sure you are aware.
I wasn't questioning you at all. I just thought the meme needed clarification as the widow of a fighter pilot & knowledge of all his training before going to Vietnam.
Rep. Buddy Carter nominated President Donald Trump for the Nobel Peace Prize, citing his role in brokering a ceasefire between Israel and Iran and preventing Iran's nuclear ambitions.
📣 Arizona voters abroad: Your voice matters! Cast your vote in the July 15 Special Primary Election—choose the Democrat to replace Rep. Grijalva. 🗳️ Get started at VoteFromAbroad.org!
TEHRAN, Jun. 23 (MNA) – The funeral ceremony of a number of martyrs killed as a result of Israeli aggression against Iran was held at Behesht-e-Zahra Cemetery late on Sunday.
Rep. Buddy Carter nominated President Donald Trump for the Nobel Peace Prize, citing his role in brokering a ceasefire between Israel and Iran and preventing Iran's nuclear ambitions.
Israel has subverted our government and embedded themselves 100x worse than they did in Iran, yet people want you to talk about literally ANYTHING else.
“Pay no attention to the man behind the curtain!”
Nick Fuentes on his America First Show on Rumble last night
I'm reading that the HMS Queen Elizabeth & HMS Prince of Wales turned tail & fled towards the Suez Canal afore Operation Midnight Hammer began in full.
Israel knows exactly what they're doing, so for that reason I didn't like what he said. But I trust Trump, so am accepting there was a method to the madness.
Starship is the minimal, blazing fast, and extremely customizable prompt for any shell! Shows the information you need, while staying sleek and minimal.
That's also pretty high on the f scale there, bub. (All psycho analytics are for the purpose of political, soft warfare, to keep the right wing illegal, perfected in the Soviet Union, brought to us by the escapees, and instituted by Ewan Cameron and mk ultra docs)
In rural PA, we are trying to get back to normal. It's a little easier if you are around farms, Mennonites, Amish. Idk what the cities will do. I guess the same as the rest of us- read the Bible, live like our grandparents did and be mostly fine.
Mahmoud Abdullah, member of the Agricultural Cooperative Society in Al-Khader, told WAFA that the colonists erected the gates along agricultural roads that were previously obstructed by earth mounds.
🆘 📢 Dr Asaad Al-Nawajaa said Monday that tens of newborn babies in the #gaza strip are at imminent risk due to Israel’s ban on the entry of essential medical supplies including baby formula
He explained that Israel’s ban on the entry of food and medical supplies, especially baby formula (1)+(2), has severe repercussions on the health of babies under six months old who are completely dependent on this type of formula.
BREAKING: Hospital sources in Gaza report 71 people killed in a series of Israeli massacres in the Gaza Strip since dawn today, including 50 aid seekers.
Lower-than-expected pregnancy loss following flu vaccine, however. HHS wants 18-month hold on FOIA litigation related to vaccines including for COVID, litigant's lawyer says.
Remember CitrixBleed, the vulnerability where a simple HTTP request would dump memory, revealing session tokens? CVE-2023–4966 You may have missed it, as the original CVE on 17th June 2025 referred…
Worth noting that every write up says this vuln applies to the management interface - but that isn’t true, it’s because the initial CVE entry was wrong, and nobody does CVE entry updates in write ups.
I hope nobody is still misled by the pre-correction CVE into thinking that this is just a 'mitigate by controlling access to management interface like you should probably do anyway' thing that they can just defer to lower priority maintenance.
Relatively severe either way; but that teensy little correction was not loud enough for how dramatically an otherwise plausible mitigation turned out to be useless.
"At this time, there have been no reports or indications that the vulnerabilities described in CTX693420 (CVE-2025-5349 and CVE-2025-5777) are being actively exploited in the wild. However, due to the critical severity of these issues (CVSS scores of 8.7 and 9.3), We strongly recommends that affected customers apply the updated patches immediately to mitigate any potential risks."
CVE-2025-5777 poses serious threats to Citrix Netscaler devices—discover recommended actions to block exploitation and protect accounts from Citrix Bleed 2.
My view on that is I don’t have the data to back it up (because Citrix haven’t provided any way to identify exploitation, including to customers), but if true and the threat actor is running those tools with that provider, it’s probably a ransomware group again.
Over the past two weeks, Cloud Software Group has released builds to address CVE-2025-6543 and CVE 2025-5777, which affect NetScaler ADC and NetScaler Gateway if they are configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR an …
It’s not for CVE-2025-5777. It’s AI generated. The links in the README still have ChatGPT UTM sources.
The PoC itself is for a vuln addressed in 2023 - ChatGPT has hallucinated (made up) the cause of the vuln using an old BishopFox write up of the other vuln.
详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件. Contribute to mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC- development by creating an account on GitHub.
I’ve heard that Citrix are complaining me billing this CitrixBleed 2 is causing them reputational damage, and isn’t related in any way to CitrixBleed.
For the record - it was a dumb joke name to attraction attention for patching. I know it isn’t exactly the same cause.
But, ya know, it is a memory disclosure vuln which reveals sensitive info, and it does require ICA sessions be reset.. which only happened before with CitrixBleed.
I've published my scan in progress of CVE-2025-5777 patching status, listing IPs, hostnames, Citrix Netscaler build numbers and if they're vulnerable to CitrixBleed2.
The scan isn't finished yet so these are only about a quarter of the results - unfortunately my coding skills are shite and it's really slow - should be finished over weekend or early next week.
Also, the SSL certificate hostnames are separated by comma which throws out CSV - sorry, I'll fix that later.
- Of the 42 identified NHS Netscalers so far, 37 are patched🥳 The NHS are really good at this nowadays.
- Of the 65 identified .gov.uk Netscalers so far, only 48 are patched 😅 All of the unpatched are councils, which are obviously severely budget constrained in many cases - I'm also not sure they actually know they're supposed to be patching.
I wish they'd just put autoupdates on these things for orgs who can't manage it manually. 5 Min downtime at midnight local timezone wouldn't hurt much - 1 month downtime because of ransomware compromise really will...
If you call the login page, it leaks memory in the response 🤣
I don’t want to specify too much extra technical info on this yet - but if you keep leaking the memory via requests, there’s a way to reestablish existing ICA sessions from the leaked memory.
Before you dive into our latest diatribe, indulge us and join us on a journey.
Sit in your chair, stand at your desk, lick your phone screen - close your eyes and imagine a world in which things are great.
From watchtowr: "As we have discussed previously, we have a moral compass next to one of our favourite magnets, and we use it to guide our decision-making process."
CVE-2025-5777 (Citrix Netscaler vuln) has been under active exploitation since mid June, with people dumping memory and using this to try to access sessions.
TTPs to hunt for:
- In Netscaler logs, repeated POST requests to *doAuthentication* - each one yields 126 bytes of RAM
- In Netscaler logs, requests to doAuthentication.do with "Content-Length: 5"
- In Netscaler user logs, lines with *LOGOFF* and user = "*#*" (i.e. # symbol in the username). RAM is played into the wrong field.
Horizon3 have a good write up here, I don't think they were aware this is already being exploited for almost a month: horizon3.ai/attack-research/at…
Worth noting I was only able to find exploitation activity due to the WatchTowr and Horizon3 write ups - Citrix support wouldn't disclose any IOCs and incorrectly claimed (again - happened with CitrixBleed) that no exploitation in the wild. Citrix have gotta get better at this, they're harming customers.
Explore the CVE-2025-5777 vulnerability in Citrix, dubbed CitrixBleed 2. Learn how it works, attack details, and defensive steps from Horizon3.ai experts.
Just to be super clear, although Citrix claim that CitrixBleed 2 is in no way related to CitrixBleed, it allows direct session token theft - Citrix are wrong. Horizon3 have the POC and it's already being exploited - Citrix were also wrong.
"Not the most novel thing in the world… but this is much much worse than it initially appears. Take a look at the following video where you’ll see that it’s possible to receive legitimate user session tokens via this vector. "
Exploitation IOCs for CVE-2025-5777 aka CitrixBleed 2, these are actively stealing sessions to bypass MFA for almost a month. Some are also doing Netscaler fingerprint scanning first.
Look for lots of connections to your Netscaler devices over past 30 days. More IPs coming as also under mass exploitation. More IPs: viz.greynoise.io/tags/citrixbl…
My own honeypot only sees activity from Private VPN. No fingerprinting first. Most POST /p/u/doAuthentication.do, some POST /nf/auth/doAuthentication.do. User-Agent: "Vuln3rableVuln3rable..."
CitrixBleed 2 — CVE-2025–5777 — has been under active exploitation to hijack Netscaler sessions, bypassing MFA, globally for a month. At the time, I noted the similarities to CitrixBleed, and noted…
does anybody hear that statement and think anything other than “Citrix is aware that there is widespread, active exploitation. They just don’t want to admit it because it makes them look bad”?
Ich kann nun eine weitere Informationen zu den IT-Ausfällen bei Ameos-Kliniken und Einrichtungen beitragen. Nachdem ich über die IT-Probleme berichtete…
I believe Citrix may have made a mistake in the patching instructions for CitrixBleed2 aka CVE-2025-5777.
They say to do the instructions on the left, but they appear to have missed other session types (e.g. AAA) which have session cookies that can be stolen and replayed with CitrixBleed2. On the right is the CitrixBleed1 instructions.
The net impact is, if you patched but a threat actor already took system memory, they can still reuse prior sessions.
Obviously this is a Ripley Protocol type of situation; but is it known how long the session cookies would be expected to remain valid if not explicitly purged? Configurable and wide variation in plausible values? Life of connection until manual or enforced disconnect? Fixed or very likely default number of minutes after successful authentication?
CISA have modified the CVE-2025-5777 entry to link to my blog 🙌 I’m hoping this gets more visibility as a bunch of us can see from Netflow ongoing threat actor Netscaler sessions to.. sensitive orgs.
This is how Citrix are styling Citrix Bleed 2 btw. In the blog there’s no technical details or detection details or acknowledgement of exploitation. They also directly blame NIST for their CVE description.
From Netflow I can see active victims - including systems owned by the US federal government - so strap in to see where this goes.
this feels very much like a corp Comms team in crisis management mode, thinking obfuscation will make the situation better. It's a natural reaction, but not one that helps mitigation.
A brutally honest 'we screwed up, here is what we can share without making the situation worse' along with some willingness to offer hotfixes rather than full releases is the better path forward.
On the plus side, I did get to read their latest Tolly report for lolz
#Alt4You #AltText two screen captures from Citrix website, the other one from Akamai website. The first one says: "Can I fix these vulnerabilities using Web Application Firewall signatures? No, it is not possible to fix the vulnerabilities with Web Application Firewall signatures. The second one, posted later, says: "App & API Protector mitigation In response to CitrixBleed 2, the WAF Threat Research Team released a new Rapid Rule on July 7, 2025, with a default action set to "Alert": - 3000967-Citrix NetScaler Memory Disclosure Detected (CVE-2025-5777)".
The one-day deadline issued by CISA on Thursday appears to be the shortest one ever issued. Federal civilian agencies are typically given three weeks to patch bugs added to the known exploited vulnerability catalog.
1) the default logging isn’t enough to know if you’ve been exploited. So if you’re wondering where the victims are, they don’t know they’re victims as checks will come back clean unless they increased logging before. FW logs w/ IOCs fall back option.
2) the Citrix instructions post patch to clear sessions don’t include the correct session types - ICA will just reconnect as you (threat actor) still have the valid NSC_AAAC cookie.
If you ask Citrix support for IOCs for CVE-2025-5777 and they send you a script to run that looks for .php files - they’ve sent you an unrelated script, which has nothing to do with session hijacking or memory overread.
Imperva WAF have added detection and blocking for CitrixBleed 2 this weekend.
They see it being widely sprayed across the internet today - almost 12 million requests, log4shell level.
The only major vendor I’ve seen who hasn’t added a WAF rule is Citrix - they sell a WAF upsell module for Netscaler, but failed to add detection for their own vulnerability.
"The only major vendor I’ve seen who hasn’t added a WAF rule is Citrix - they sell a WAF upsell module for Netscaler, but failed to add detection for their own vulnerability." WHAAAAAAAA
- Citrix have finally, quietly admitted exploitation in the wild -- by not commenting to press and then editing an old blog post and not mentioning it on their security update page.
- Orgs have been under attack from threat actors in Russia and China since June
- It's now under spray and pray, wide exploitation attempts.
The ‘good news’, I suspect, is that most orgs will be too lacking in logs to have evidence. So they get to hope nothing too bad happened, I guess. The reason for this is the exploitation activity…
Citrix Netscaler internet scan still running, it's found another 1k vulnerable instances so far - will probably update Github later today or tomorrow morning.
It looks like we're back up to 18% of boxes being still vulnerable when the new list is out. It looks like a lot of orgs are patching from my list.
this is probably a silly question, but are you scanning netblocks most likely to have affected devices first? Eg I'm guessing not a lot likely in AWS, GCP, Azure, China, residential, etc address spaces.
GreyNoise blog just out about #CitrixBleed2, they see exploitation from IPs in China from June 23rd targeting specifically Netscaler appliances greynoise.io/blog/exploitation…
GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.
With the #CitrixBleed2 patch data I publish it's possible to view the history on Github for each new scan and see when hosts change from vuln to patched.
It's proving incredibly effective at getting orgs to patch. I tried private notifications via HackerOne and such for CitixBleed1 in 2023 and it took months to get orgs to patch. Putting the data public brings accountability for orgs who later get breached - so there's a rush to patch.
It's definitely interesting and may need a scale out.
This bit is still incomplete in the patching instructions btw - if it's a HA pair you need to additionally reset other session types or you're still vulnerable to session hijack after patching.
I'm still trying to get Citrix to update the instructions.
The Dutch Public Prosecution Office have shut down their Citrix Netscaler and removed all internet access, Dutch media speculating CitrixBleed 2 exploitation.
Justice minister David van Weel told MPs in a briefing that it appears the weakness had been used by third parties to access the department systems.
The justice ministry said the department had applied Citrix’s recommended patches, but these failed to fully eliminate the flaw. dutchnews.nl/2025/07/prosecuti…
Public Prosecution Service offline after security breach: hackers may exploit vulnerability in digital environment. Crisis meeting leads to complete internet shutdown.
Again to reiterate the point in the thread - Citrix’s patching instructions don’t include - for example - resetting AAA sessions when AAA cookies are stealable with the vulnerability. So we’re going to see orgs caught with Citrix’s pants down.
Update on the situation at The Hague and the shutdown of the Dutch Public Prosecution Service internet access, NCSC Netherlands issued an update today saying all orgs should hunt for CitrixBleed 2 activity, citing my blog.
They also advise clearing all session types, not just the ones Citrix say in their security advisory.
Fields - IP, SSL certification hostnames, Netscaler firmware, if vulnerable to CVE-2025-5777
I've had a few orgs contest that they're not vulnerable and the scan is wrong. I've assisted each org, and in each case they've been wrong - they'd patched the wrong Netscaler, the passive HA node etc.
I've been working with @shadowserver btw, their scan results for #CitrixBleed2 now show far more vulnerable systems. Their scanning is independent of mine, logic is improving, more orgs will get notifications. I'm going to try getting victims for notification across too.
I might move the Dutch Public Prosecution Service (OM) Citrix Netscaler incident out to a different thread, but the latest update an hour ago from local media is that they are still without internet and remote access, and they're working on several alternatives to continue criminal trials.
I expect we're going to see a wave of Netscaler incidents over the coming months, although how many will publicly disclose is another issue - the Dutch are culturally transparent.
The Public Prosecution Service (OM) has disconnected all internal systems from the internet. The reason for this is a warning from the National Cyber Security Centre (NCSC) that there is "a vulnerability" in the system that gives users access to the …
The Canadian government cyber centre are this weekend recommending all orgs review historic logs for #CitrixBleed2 compromise, and reset all user sessions cyber.gc.ca/en/alerts-advisori…
In late June 2025, Arctic Wolf issued a security bulletin addressing a critical out-of-bounds read vulnerability in Citrix NetScaler ADC and Gateway that Citrix disclosed, tracked as CVE-2025-5777.
The Dutch Public Prosecution Service (OM), which took their systems offline due to #CitrixBleed2 on Friday, are saying they will be offline for weeks. nos.nl/artikel/2575857 HT @moartn
#Alt4You #AltText news article from NOS: Public Prosecution Service may be closed off from the internet for weeks The Public Prosecution Service (OM) expects that it may be closed off from the internet for weeks to come. Last week, the Public Prosecution Service disconnected its systems after suspicions of a hack. This means that Public Prosecution Service employees cannot be reached by email and cannot log in remotely. That already had consequences for lawsuits last week. Public prosecutors could not look into the files, so the papers had to be printed. Officers can now consult a number of files, but do not work in them, as spokesperson said. "They can read the files, but not edit or print them, for example." The spokesperson could not say whether this will affect lawsuits scheduled for today or the coming weeks.
The Netherlands faced a significant Citrix related incident in 2019. The Dutch Safety Board investigated... report linked below.
It is now 2025, and another Citrix related incident has led to the NL public prosecutor office going offline.
The OM say they patched quickly (and my scan data backs this up - they patched around June 24th) however it appears somebody got in (or took a session cookie) before patching took place and now they’re trying to contain the situation.
Het Openbaar Ministerie blijft mogelijk nog weken afgesloten van het internet. Donderdag haalde het OM alle interne systemen offline vanwege een gat in de beveiliging van bepaalde software.
The NCSC are strongly advising orgs to follow the advice on my blog re #CitrixBleed2, in hindsight I probably shouldn’t have drawn the logo in MSPaint and titled a section “China goes brrrr”.
I think this thread exposes something about the cybersecurity industry and org posture btw - it almost all runs on Windows and EDR telemetry, hence why there’s little info on this from vendors (Netscaler is closed box appliance - they’re flying blind) and why orgs aren’t seeing anything, they don’t know how without vendors.
I keep contacting orgs and they have no idea they are compromised or how to investigate.
I'm really torn on whether to check into whether some third parties used by my clients are affected. I have no agreements with those entities and no special IT contacts so at best I'd be cautioning my clients about something they can't address and contacting the third parties as Joe Random User saying 'hey, you been hacked'
even many of those that do understand where to look don't have adequate logging around these features to definitively say whether or not they have been exploited. Your post about how all the attention is on SharePoint while the news is pretty quiet about this was pretty spot on.
if you’re in any way responsible for security of your own org, or customers’ orgs - you have to monitor for vuln news on every public facing vendor (esp remote access) you have in use - on a daily basis. I don’t understand why some haven’t yet come to terms with that. It’s one of the reasons I check your feed every morning..
'Appliances'(at least in general) seem to be in a particularly dire place. Not only are they represented as being suitable for use without heavy oversight; they tend to be in deeply rough shape as linux systems, old, weird, and mutilated compared to a normal distro install; but not actually that hardened(and vendors tend to be prickly about the idea of you having a look). This is Enterprise Security; not a $150 chromebook, after all.
The Dutch Public Prosecution Service #CitrixBleed2 incident rolls on - NRC report on an email from the Director of their IT service, where they say “It is clear that it’s a massive and dramatic incident”.
Cybercrime: Het Openbaar Ministerie is gehackt. Het zou nog weken kunnen duren om het netwerk veilig te stellen, blijkt uit een interne toelichting van het hoofd ict. Er is aangifte gedaan en melding gemaakt van een eventueel datalek.
you were the first to do an mspaint logo for a vulnerability? if now anyone publishes with a paint logo it will just be a weak attempt at copying your style. A good way to detect fearmongering.
Vanwege potentieel misbruik van een ‘kwetsbaarheid’ in bepaalde software heeft het Openbaar Ministerie (OM) donderdagavond alle interne systemen offline gehaald. Mogelijk zit een Chinese groep achter de hack.
It's obviously not ideal; but I do like seeing organizational willingness to just pull out the shears and apply them to the uptime wires if that is potentially what it takes; rather than insisting that access must remain even if some of it is pretty definitely not ours.
The great thing about "as far as I know"/"not as far as I know" class statements, unlike almost all other types of statements, is that you can increase their accuracy through the easy work of knowing less rather than the arduous task of knowing more.
Thanks so much for this info and for all the info provided prior to this. I was able to confirm with our Citrix team two weeks ago that we were patched already, and I'm just getting emails this week from higher ups to look into this, so I'm very much ahead of the game.
Aside from social media, is there anywhere you suggest keeping an eye on daily for vulnerability info?
@privateger It's honestly darkly impressive. ICA vs. RDP was a pretty compelling beatdown at one time; but that was a no, of course I'm not that old, time ago; and basically everything they've touched since is a matter of indifference or distaste.
Normally I'd jump straight to blaming the private equity knackers; but in this case I can see why they were headed to the bone mill.
I absolutely love how little of this I understand, but that it makes me go back through the whole thread, and now I've learned a whole new thing to be concerned about.
They should quit whining and do something about their crappy code + thank you for trying to get people to do something about it! Heck they should be sending you $$$
Is it normal for the IoCs section to just be "we are committed to transparency" followed by "If you encounter issues when updating your affected builds or need access to IoCs, please contact Citrix Customer Support"?
Now, I'm no computer security expert, but wouldn't threat actors immediately jump on any major new flaw with that high of a CVSS score? Just because they haven't been caught doesn't mean they're not there.
CVE-2025-5777 poses serious threats to Citrix Netscaler devices—discover recommended actions to block exploitation and protect accounts from Citrix Bleed 2.
@cR0w the only IOCs they will release is via a technical support request for CVE 2025-6543 and is literally a script that looks for a handful of vulnerable conditions and file types in locations they shouldnt be. No public IPs, domains, filenames, etc
@cR0w forgot about this but might help some people patching this week now that there is an official notice. Patching defaults some CSP setting to "on" which can cause blank login pages after updating. Citrix engineer we talked to last week stated they were getting inundated with calls about it. It extended our downtime by about an hour until a team member figured it. Never roll back, power through! support.citrix.com/support-hom…
In the same conversation, this lady told me she doesn't eat fruits, vegetables, rice or meat. Also, she always orders the same thing when she goes to a restaurant.
It's nice to see someone with worse eating habits than me.
(I'm not a fussy eater - I fail to always plan a balanced meal.)
οκ νόμιζε ότι θες, αλλά η κοινωνία των αδιάφορων τριγύρω μας είναι εντελώς διαφορετική, νομίζεις εσύ ότι ο χιπστεράς που πάει για μπάνιο αντί να ψηφίσει, ο σκυλάς που κάθεται για καφέ κλπ κλπ θα πάει και θα ψηφίσει κάτι άλλο από ΝΔ; @Feleki
προφανώς αλλά εγώ δεν ελπίζω στην συμμετοχή για αλλαγή, μετά από 30 χρόνια σε συλλογικότητες και μέσα στην μικρογραφία της χώρας που λέγεται επαρχία, βλέπεις την καθολική πραγματικότητα. Ο αδιάφορος και ο "δεν βαριέσαι όλοι ίδιοι είναι" ή "θα πάνε μώρε οι άλλοι να ψηφίσουν", δεν υπάρχει περίπτωση να αλλάξει κανένα εκλογικό αποτέλεσμα. @Feleki
@baskin θεωρίες που προσπαθούν να περιγράψουν την γενική εικόνα συμφωνα με τις προσλαμβανουσες του καθενός. Τα αδιαψευστα νούμερα λένε ότι ποτέ μετά την μεταπολίτευση η δεξιά δεν έχει ξεπεράσει νούμερα μεγαλύτερα του 25% ακόμα και όταν ήταν όλοι υποχρεωμένοι να ψηφίζουν. @Feleki
Τέλος για τις προσλαμβάνουσες, δυστυχώς στις μεγάλες πόλεις χάνεις κάθε επαφή με τον κοινωνικό ιστό και ζεις στο bubble σου. Η αφαίρεση και η ανάλυση πιο διαχειρίσιμων μοντέλων λέει πολλά για το σύνολο. @Feleki
σε κάθε περίπτωση και το κλείνω εδώ, ο μη πολιτικοποιημένος ΠΑΝΤΑ ιστορικά πάει δεξιά, δεν πάει από την άλλη, οπότε ψάξτε κάτι άλλο από το ευσεβή πόθο να πάνε να ψηφίζουν οι μαλάκες που είναι γεμάτη η χώρα και απλά βαριούνται. @Feleki
οκ θα μας πεις και ότι όσοι δεν κατεβαίνουν για την Γάζα στον δρόμο είναι "καλοι" και όχι απλά συνένοχοι μαλάκες. Άλλά ντάλα είναι να νομίζεις ότι η αποχή φταίει που βγαίνει η δεξιά, άμα θες να ρίξουμε το επίπεδο. Ούτε εγώ θα σε πείσω. @Feleki
Στις τελευταίες εκλογές είχε 55% αποχή Όταν είχε 4% αποχή γιατί ΗΤΑΝ ΥΠΟΧΡΕΩΤΙΚΉ η ψήφος πάλι τα ίδια νου ΕΡΑ είχαν. Αν θελεις να το καταλαβεις πάει καλά. Αν όχι, δικό σου προβλημα Τέλος εδώ @Feleki
@baskin Το ξεκαθαρίσαμε αυτό. Ο καθένας νομιζει ότι θελει. Εδώ υπάρχουν ακόμα FlatEarthers ανάμεσα μας. Και εγώ δεν είπα ότι θα μας σώσει η αποχή, αν ψηφίσει. Είπα ότι το 42,5 του Κούλη θα ήταν 28% η 32% Αν έκανε η όχι κυβέρνηση με αυτά τα ποσοστά είναι άγνωστο αλλά τουλάχιστον δεν θα είχε αυτοδυναμία. Ελπίζω τώρα να έγινε κατανοητό. @Feleki
και ποιος σου λέει ότι η παραπάνω συμμετοχή θα αλλάξει τα ποσοστά; Δηλαδή όποιος απέχει αν πάει θα ψηφίσει κάτι άλλο από Κούλη για να πέσει το ποσοστό; Το ποσοστό βγαίνει επί των ΨΗΦΙΣΑΝΤΩΝ όχι επί των εγγεγραμμένων. Το ποσοστό του Κούλη θα ήταν 28% αν οι παραπάνω που θα ψήφιζαν ψήφιζαν κάτι άλλο και όχι Κούλη. Οκ με τα μαθηματικά τώρα; @Feleki
τι σχέση έχει η συσπείρωση με το αν ο απέχοντας θα ψηφίσει κάτι άλλο από ΝΔ, έχεις μπλέξει άσχετα πράματα, τέσπα άσε το, δεν πα να ψηφίσουν 10.000.000 η ΝΔ θα βγει, αυτή είναι η κοινωνία των παρτάκηδων ραγιάδων. @Feleki
@baskin η συσπείρωση έχει σχέση γιατί σημαίνει ότι ΔΕΝ απείχε κανείς απ' αυτούς. Πήγε συσωμη η δεξιά με αυστηρη γραμμή να διώξει τον ΣΡΖ. ΑΡΑ η αποχή του 47% του 2019 ΔΕΝ ήταν από δεξιούς. Crystal clear Αυτά και τέλος @Feleki
άντε πάλι, και ποιος σου λέει ότι οι άλλοι που δεν πάνε, όταν πάνε θα ψηφίσουν κάτι άλλο πέραν από ΝΔ; Η συσπείρωση ΠΟΤΕ δεν τους υπολογίζει. Κρίνεις με την συσπείρωση τα ποιοτικά χαρακτηριστικά του απέχοντα; @Feleki
ε ναι και εγώ βαρέθηκα αλλά με το πήγαν όλοι οι δεξιοί γελάμε, πήγαν οι δεξιοί που γενικά ψηφίζουν και σου ξαναλέω, ο παρτάκιας που πάει παραλία αντί να ψηφίσει, τον έχεις για αριστερό δηλαδή; @Feleki
πρώτα από όλα να κοιτάξεις να βγάζεις 2.500.000 από τους εγγεγραμμένους για να υπολογίζεις την αποχή, αλλά εγώ σου μιλάω από την αρχή για ποιοτικά χαρακτηριστικά της κοινωνίας των αδιάφορων που απέχουν. Αν ελπίζεις ότι δεν θα ψηφίσουν ΝΔ αν και όποτε πάνε τότε θα μείνεις με την ελπίδα. @Feleki
element still works but when joining a room it's initially slow posting messages, then it figures something out and works fine thereafter. sketchy behavior
Hallo #Fediverse, ich suche eine zweite, kostengünstige (keine billige) #Powerbank. Ansprüche relativ wenig. Was nice wäre: - Laden des Laptops über USB-C - Laden von mehreren angesteckten Geräten
Hace un tiempo le soltaron un bofetón a un youtuber (ricky edit) por llevar una de estas gafas.
Para mi son una red flag total. Hace unas semanas una persona que estaba en una charla con la gente de la Marea en el teatro del Barrio en Madrid levantó la mano.
Dijo que estaba con unas gafas con IA y no recuerdo si dijo grabando o sin grabar. En realidad no existe forma de saberlo.
Es como un espía quien la lleva. Grabando todo todo el rato.
"Two out of three Germans support the creation of a European nuclear shield"
Well,......no big deal. Two out of three Germans supported the Nazis once... I guess two out of three Germans are extremely susceptible to government propaganda.
Thank you to our sponsors:📞 Mint Mobile: https://mintmobile.com/insideofyou👕 Quince: https://quince.com/inside❤️ This episode is sponsored by BetterHelp. G...
A web port of Marble Blast Gold and Marble Blast Platinum: In this 3D platformer classic, race your marble to the finish as fast as possible in more than 4100 diverse levels taken from Marble Blast Gold, Platinum and Ultra.
Starship is the minimal, blazing fast, and extremely customizable prompt for any shell! Shows the information you need, while staying sleek and minimal.
Aquí lo mismo. Por lo visto cuando tiras petardos las cajas de los mismos se tiran al suelo y ahí se van apilando y nadie los recoge. Por no hablar de los restos de pirotecnia y el daño que hace a la fauna. En fin, que soy como tu cada día más asqueada de las fiestas y el gentío sucio.
Da haben die Rüstungskonzerne absolut Recht!! 500 Milliarden in die Aufrüstung zu pumpen und ständige Waffenlieferungen in Kriegsgebiete sind die totale Verschwendung von Steuergeldern ^^ Das sich die Herrschaften den 'Abbau der Bürokratie' (aka Mitarbeiterabbau in den Kontrollinstitutionen) wünschen kann ich total verstehen, wer will sich beim Geschäft im rechtlichen Graubereich schon gerne auf die Finger schauen lassen ^^ ... #militarismus #neoliberalismus
Nach langen Debatten wollen die NATO-Mitglieder beim Gipfel in Den Haag offiziell beschließen, ihre Verteidigungsbudgets deutlich anzuheben. Ausgerechnet von der Rüstungsindustrie kommen jetzt Warnungen.
Ahora que es imposible ocultar la cantidad de palestinos asesinados por el sionismo y la OTAN, los medios hablan de "desaparecidos", no de asesinados, e incluso las voces propalestinas utilizan ese discurso.
Cómo vas a hablar de desaparecidos en un lugar sin salidas y bombardeado por 2 años?
If I pluck a story at random on the Tesla Robotaxi fail, not a single one mentions that the Trump administration and his courts have taken an absolute hatchet to corporate oversight and consumer protection. Why? It's kind of important context that regulators can't/won't do their jobs anymore?
A free tool that allows anyone to upload a photo of an LAPD officer to get their name and badge number.
A new site, FuckLAPD.com, is using public records and facial recognition technology to allow anyone to identify police officers in Los Angeles they have a picture of. The tool, made by artist Kyle McDonald, is designed to help people identify cops who may otherwise try to conceal their identity, such as covering their badge or serial number.
“We deserve to know who is shooting us in the face even when they have their badge covered up,” McDonald told me when I asked if the site was made in response to police violence during the LA protests against ICE that started earlier this month. “fucklapd.com is a response to the violence of the LAPD during the recent protests against the horrific ICE raids. And more broadly—the failure of the LAPD to accomplish anything useful with over $2B in funding each year.”
“Cops covering up their badges? ID them with their faces instead,” the site, which McDonald said went live this Saturday. The tool allows users to upload an image of a police officer’s face to search over 9,000 LAPD headshots obtained via public record requests. The site says image processing happens on the device, and no photos or data are transmitted or saved on the site. “Blurry, low-resolution photos will not match,” the site says.
“fucklapd.com uses data provided by the City of Los Angeles directly to the public,” McDonald told me in an email. “This data has been provided in response to either public records requests or public records lawsuits. That means all of this information belongs to the public and is a matter of public record. fucklapd.com is not scraping any data.”
In addition to potentially identifying officers by name and serial number, FuckLAPD.com also pulls up a police officer’s salary.
“Surprisingly it [the domain name] only costs $10 a year to exercise my first amendment right to say fucklapd.com,” McDonald said. playlist.megaphone.fm?p=TBIEA2… I tested the tools by grabbing an image of a white and bald police officer from an LAPD press conference addressing its use of force during the anti-ICE protests in Los Angeles. I uploaded the image to the site, and within a few seconds the site presented me with nine headshots of officers who could be possible matches, all of them bald white men. The first correctly identified the cop in the image I uploaded.
Clicking “view profile” under the result sent me to the Watch the Watchers site by the Stop LAPD Spying Coalition, a community group based in the Skid Row neighborhood of downtown Los Angeles. “All of the information on this website comes from records that were deliberately made public by the City of Los Angeles in response to either public records requests or public records lawsuits,” the Watch the Watchers site says. “We plan to keep refreshing this data from new public records requests as well as to add other data.” Stop LAPD Spying Coalition is not associated with FuckLAPD.com and did not endorse the site.
McDonald told me that since the site launched, it had around 50,000 visitors, but “Because the analysis happens on-device I have no way of knowing what people are using it for, except for some people who have posted screenshots to Twitter or Instagram,” he said.
In 2018 McDonald made another tool called ICEspy which used hundreds of photos of ICE employees from LinkedIn and does much the same thing as FuckLAPD.com. “This app is designed to highlight and embarrass the organization committing atrocities against refugees and immigrants to the United States,” ICEspy’s website says. That tool originally used a Microsoft API, before Microsoft restricted access to it. McDonald said on X that he recently relaunched the tool to run locally on devices. 404 Media tested ICEspy using images of ICE employees on LinkedIn to verify if the tool worked and each result was incorrect; McDonald indicated on X he was looking for others to re-scrape LinkedIn and update the database.
Over the last few months ICE officers have consistently worn masks, neck gaiters, sunglasses, and baseball caps to shield their identity while often refusing to provide their name or even confirm the agency they belong to. This includes while violently assaulting people, detaining U.S. citizens, and pointing weapons at bystanders, leaving little room for recourse or accountability against the individual agents or the agency.
ICE’s constant use of masks has created a climate where people cannot be sure that the heavily armed group of men coming towards them are really federal agents or not. In Philadelphia, a man pretended to be an ICE agent in order to rob an auto repair shop and zip tie an employee. In Brooklyn, a man posed as an immigration officer before attempting to rape a woman.
Bitte diese Petition unterzeichnen und verbreiten. Danke! - Bin mir leider nicht sicher, ob nur Bajuwar:innen unterschreiben dürfen, da es an den Landtag geht. Hab's trotzdem gemacht.
"Sınav sistemi ona anlatıldığında çok şaşırmıştı; doğal öğrenme isteğini, bu bilgiyle doldurulma ve istendiğinde geri kusma dizisinden daha fazla engelleyebilecek bir şey düşünemiyordu."
Trump's ceasefire is already collapsing #Zionists threaten to strike #Tehran #Iran denies having launched missiles
"In response to Iran's violation of the truce, we will respond with force," the zionazi chief of staff said.
Meanwhile in #TelAviv it is one step closer to civil war as Iranian missiles strike at will without any obstruction from the supposedly "invulnerable" dome's.
Now that we have made PEACE abroad, we must finish the job here at home by passing “THE GREAT, BIG, BEAUTIFUL BILL,” and getting the Bill to my desk, ASAP. It will be a Historic Present for THE GREAT PEOPLE OF THE UNITED STATES OF AMERICA, as we begin the Celebration of our Country’s 250th Birthday. We are finally entering our Golden Age, which will bring unprecedented Safety, Security, and Prosperity for ALL of our Citizens. To my friends in the Senate, lock yourself in a room if you must, don’t go home, and GET THE DEAL DONE THIS WEEK. Work with the House so they can pick it up, and pass it, IMMEDIATELY. NO ONE GOES ON VACATION UNTIL IT’S DONE. Everyone, most importantly the American People, will be much better off thanks to our work together. MAKE AMERICA GREAT AGAIN!
Toplumun, herkesin en yüksek düzeyde refaha, mümkün olan en yüksek ahlaki ve ruhsal gelişime ulaşması için gerekli araçları sağlamayı amaçlayacak şekilde kurulmasını istiyoruz; herkes için ekmek, özgürlük, sevgi ve bilim istiyoruz.
phantomwise
in reply to SnokenKeekaGuard • • •