Please tell your friends about federated social media site that speaks several fediverse protocols thus serving as a hub uniting them, hubzilla.eskimo.com, also check out friendica.eskimo.com, federated
macroblogging social media site, mastodon.eskimo.com a federated microblogging site, and yacy.eskimo.com an uncensored federated search engine. All Free!
Tell me if this is happening to you. Fucking doctors, after I pay them, will issue a second copy of the bill. It's not a second notice, it's a duplicate bill.
Not paying attention, I was paying these bills. I recently called them out on it. $700 refund in the mail.
AND THEY'RE STILL DOING IT. This is a hospital and an ENT, completely separate from one another. I just got two more of these duplicate bills I already paid at the beginning of the month.
@Sirensabotage This isn't the first incident either. My wife went to the ER after a car accident. Our medical insurance paid for that. But the hospital double billed the insurance company. The second bill was rejected by insurance so they considered the whole thing unpaid. They were paid in full, and sent an entire 100% over the bill to collection. I didn't know about this until 3 years later when a collection agency called me.
sounds out right criminal. But everything else about the medical industry is a scam. How hard was it to get their error removed from your credit score? Also a thing thats fucking corrupt.
@Sirensabotage What I honestly think they did, was they intended to get duplicate payment from the car insurance. But they sent the second bill to the wrong place. They didn't realize it. The whole time they were claiming non-payment from the car insurance company. They had me going in circles with State Farm for 6 months. Then I managed to track down the actual payment from our medical insurance. When I showed them that they backed down instantly. I should sued. I regret not going to a lawyer.
When I was buying groceries the other day, I noticed that the cashier reminded me of an online friend I have known for years. And I got to thinking, what if my friend worked as a cashier at a grocery store? Customers would then see her, watch her scan items and pack them dutifully, hear her small pleasantries as they paid, and then leave and think no more about her. Nothing in that transaction would give them the slightest clue about her boundless creativity, her rich mind, her deep heart, all of which I have grown to admire and love. They would have no idea what an amazing person she is.
And then I wondered if perhaps my cashier today was in fact an amazing person and I simply had no idea. And now I am contemplating the notion that every person we see, that we pass by without a thought, might similarly amaze us with their depth and their wonder, if we only had the time and opportunity to learn them. I am left with a sense of being surrounded by invisible riches.
In the face of war and violence that disrupts and even extinguishes the lives of people, paradoxically I look for humanity in the birds I see every day. Sometimes it’s in the ingenuity of a jay, or in the apparent playfulness of a hummingbird. It’s easy to forget that to survive, a hummingbird needs to find food every ten to fifteen minutes. A reminder that while we’re trying our best just to survive, there’s still time to pay attention to other things, even a brief moment of relief.
Attached: 1 image
In the face of war and violence that disrupts and even extinguishes the lives of people, paradoxically I look for humanity in the birds I see every day.
I think I have all of the bookmarkers in from both sets of tests.
Turns out I have some work to do, and my general feeling that my bad diet, lack of sleep, stressed out life style and self-tyrannical attitude of just working harder at things is killing me.
And now I can see the evidence in my blood work.
I have a lot of work to do.
The app and process however have been great. And while it’s hard to be confronted with this info, it’s probably news I needed.
it's hard to learn to relax. But one thing that I've learned to do is pick a couple of hobbies that can keep me occupied but also relax. So I garden, do a daily yoga routine, pray, and I either cold plunge or sauna daily. I stay busy but I also am way healthier than I've ever been.
TEHRAN (Tasnim) – In a fresh act of aggression, the Israeli regime carried out a drone strike targeting a civilian vehicle in southern Lebanon, resulting in the martyrdom of three individuals, according to Lebanon’s Ministry of Health.
I was helping my friend install Mint on his laptop, it all went well and the installation finished, but the driver for the wi-fi module wouldn't turn on properly, or something. I assumed this was due to secure boot messing with the drivers, so I tried to disable it in the BIOS (it's an older laptop, no UEFI). But I have spent the last 3 hours trying and failing to open BIOS, and even GRUB. Nothing I try seems to work.
I tried all the function keys, as well as delete, escape, and enter, and the only thing I found is that F12 opens a boot options menu.
I tried holding and mashing shift throughout the boot procedure to get to GRUB.
I tried using the novo button (it's a Lenovo laptop) which did open a new menu allowing me to select a "BIOS options" button, but it just rebooted after showing me a few rolling lines of text.
I tried plugging in the installation media I used before, which does take me to it's GRUB, but choosing the UEFI options option there just causes a reboot.
I tried disconnecting the battery and the CMOS battery and waiting for 30 seconds in hopes of disabling fast boot, which didn't work.
I edited GRUB config files to change the timeout to 10 and the type away from hidden, which didn't do anything.
I disconnected the disk in hopes of it defaulting to the BIOS, which works for some laptops.
No option worked. I just cannot access BIOS or GRUB. I really don't know where to go next, and could use some help.
Broadcom chipsets are notoriously lacking in any sort of open driver operation or collaboration. I'd honestly just replace it with a $25 Intel chipset, but if you want to fight through it: help.ubuntu.com/community/Wifi…
You'll notice that your specific chipset isn't mentioned, but it might be different now, so I'd double check.
Secure Boot has nothing to do with, Broadcom keeps their drivers completely closed, and just doesn't support this chipset anywhere except Windows.
USB dongles would work fine, but probably cost more than an internal module. It sounded from your post like you're fine with opening the machine and navigating the internals, so swapping the WiFi module would only take 5m.
Just stay away from Broadcom in general. Intel has the best performing WiFi chipsets at current, but Atheros and Realtek work just fine as well.
Otherwise agree, but I did run into pain with Realtek on my Thinkpad - the module would sometimes crash and disconnect entirely (on a PCI-e level) from the system.
I did manage to find a fix, but I would not recommend Realtek to someone.
That's less likely to be the chipset, and more likely to be crap hardware. The chipset wouldn't cause PCIe disconnect/interrupt issues, but shitty power handling in a laptop would. Can I wager it happened when plugging/unplugging power or ramping up CPU or GPU util? That was a thing on those Lenovo convertibles for years, but they did throw that shoddy consumer hardware into the Thinkpad line which made it go downhill fast.
You're right that it was power-related - one of the options was an ASPM modification - but the issue seemed to be common to this chipset accross laptop brands.
My machine was a Thinkpad, but this article was also talking about problems on HP, Asus, etcetera. I think the 8852BE might just be cursed
To be fair, I was using an E series Thinkpad, but in my defense, the E series seems to have improved a lot in the past few years - this was luckily the only issue I've had. I've had much more difficult times with Linux on other laptops. Heck, even my desktop had more setup than this when I was first starting out, though it was because I was using a Broadcom Wi-Fi card, as I also dual-booted with a Hackintosh and macOS only supports Broadcom Wi-Fi chipsets.
Yeah, if you want to understand the dual-edged sword of Broadcom, just go look at the hardware support matrices of open source router platforms. NONE will support Broadcom, because they want to nab licensing for their drivers. You can't install a working ddrt, tomato, opensense, openwrt...etc on ANY Broadcom hardware platforms, but the manufacturers using them still are many.
It's finally starting to subside, but there was a decade where they ruled the wireless space. They refuse to capitulate on the open drivers issue though, it's insane.
I went an changed to an Intel AX200 I had lying around, though now I have problems with the wireless availability dipping in and out of service. Like the card is being constantly power cycled.
I was about to suggest disconnecting the disk until I read that you already tried that. What came up when you removed the disk? The fact that it doesn't go straight to ~~a boot device selection screen or ~~the BIOS is very curious.
If you haven't solved this yet I would try using the novo button again with your camera ready to get the text and see if it's useful. Beyond that, I'm not sure how to get into the bios. Assuming it still boots and doesn't have a soldered wifi card you could always get an AX210 for fairly cheap off of ebay. Should have good linux support.
Edit: Nvm the card suggestion, I see your comment on that.
Ο πόλεμος είναι μια πράξη βίας, και δεν υπάρχει όριο στην εκδήλωση αυτής της βίας. Καθένας από τους 2 αντιπάλους ακολουθεί το νόμο του άλλου, κι απ' αυτό προκύπτει μια αλληλεπίδραση, που ως έννοια οφείλει να φτάσει στα άκρα. -Κλάουζεβιτς
At least 410 Palestinians have been killed by the Israeli military while trying to fetch from controversial new aid hubs in Gaza – a likely war crime – the UN human rights office, OHCHR, said on Tuesday.
Meeting with even two other people and expressing support for the protest group could land you in prison for up to 14 years if Yvette Cooper's proscription of it goes into effect. Simon Childs on what the ban could mean for you.
Zionist regime makes fool of Trump, to the surprise of no one, and says it plans to continue Israel breached US president Donald Trump’s claimed ‘agreement’ for a ceasefire betwee…
08:33 Iranian National Security Council: Our operations pose no threat or danger to the friendly and brotherly nation of Qatar and its people english.masirahtv.net/news/359…
ah t'es revenue faire un tour ! oui les nouvelles du monde ne sont pas très bonnes, ça ne va pas en s'arrangeant et c'est déprimant... Mais il faut garder le moral, profiter des petits moments de bonheur comme celui que tu as posté avec cette photo. Je t'envoie plein de bonnes vibs 😀))))))))))))))))))❤
DHS can’t arrest and deport 15.4 million illegal aliens, but if it simply enforces the law, many aliens will get the message and leave on their own — as hundreds of thousands apparently already hav…
The Foreign Ministers of the Organization of Islamic Cooperation (OIC), with 57 member nations, the second largest international organization in the world after the United Nations, met in Istanbul, Türkiye over June 21-22 this past weekend.
Heute war es schon das zweite Mal, dass am Klavier im Bahnhof Südkreuz ein Mann saß, vom Aussehen her, Jacke, Hose, Füße ohne Socken in fragwürdigen Schuhen, vom Aussehen her einer auf der Straße. Und zum zweiten Mal saß er da an dem Klavier und spielte mit einer wunderschönen Eleganz und Leichtigkeit #Chopin. Als ich reinkam in die Halle, begrüßte mich der Minutenwalzer, und danach kam der da:
Waltz No. 2 from Waltzes, Op. 64Arthur Rubinstein, pianoWaltz in C-sharp minor is the second work of Chopin's opus 64 and the companion to the Minute Waltz (...
Bauernverband will weniger #Mindestlohn für ausländische #Erntehelfer als für Deutsche. Landwirte sollten Saisonarbeitern aus dem europäischen Ausland nur 80 % des normalen Mindestlohns zahlen müssen, so die Unternehmerorganisation. taz.de/Mindestlohn-fuer-Ernteh… #Landwirtschaft
The set is now complete. Order your copies today! https://dutchsheets.mybigcommerce.com/Learn more about Give Him Fifteen here:Website: https://www.givehim15...
"Behold, the Lamb of God, who takes away the sin of the world! This is he of whom I said, ‘After me comes a man who ranks before me, for he was before me.’ I myself did not know him; but for this I came baptizing with water, that he might be revealed to Israel."
In May, legendary Apple designer Jony Ive hooked up with OpenAI to announce an unspecified gadget. [WSJ, archive] To promote this complete vaporware, OpenAI released a video of Sam Altman and Ive b…
Stephen McNallen, the founder of the Asatru movement here in the United States, produced a series of 17 different presentations and interviews with Odinist luminaries a few years ago called Gods, Folk and Destiny.
They're both informative and entertaining. I wish he had done more.
TalieVision is television for a Whiter future. It's a growing archive of almost 600 pro-White and White-friendly (mostly) full-length videos, featuring news, interviews, speeches, lectures, documentary films, concerts & other live performances, movies, and much more.
B-2 wings are increasingly bringing on pilots directly from Air Education and Training Command — and they have to keep training and developing their skills.
@HunDriverWidow No, they are very experienced professionals, but even this article from 2019 states they are bringing them on right out of undergraduate pilot training. I wonder if it's tougher, now, to find candidates. And I'm thinking that to accomplish those protracted missions, successfully, they need stamina...and youth.
My late husband was a retired USAF fighter pilot. To be a pilot of this caliber, they are not 20 yrs old. 2019 was a long time ago in terms of a bird of this class.
@HunDriverWidow Yes, I know. We have USAF here, as well as other pilots. It was just a meme...and they do have to have stamina, as I'm sure you are aware.
I wasn't questioning you at all. I just thought the meme needed clarification as the widow of a fighter pilot & knowledge of all his training before going to Vietnam.
Rep. Buddy Carter nominated President Donald Trump for the Nobel Peace Prize, citing his role in brokering a ceasefire between Israel and Iran and preventing Iran's nuclear ambitions.
TEHRAN, Jun. 23 (MNA) – The funeral ceremony of a number of martyrs killed as a result of Israeli aggression against Iran was held at Behesht-e-Zahra Cemetery late on Sunday.
Rep. Buddy Carter nominated President Donald Trump for the Nobel Peace Prize, citing his role in brokering a ceasefire between Israel and Iran and preventing Iran's nuclear ambitions.
Israel has subverted our government and embedded themselves 100x worse than they did in Iran, yet people want you to talk about literally ANYTHING else.
“Pay no attention to the man behind the curtain!”
Nick Fuentes on his America First Show on Rumble last night
I'm reading that the HMS Queen Elizabeth & HMS Prince of Wales turned tail & fled towards the Suez Canal afore Operation Midnight Hammer began in full.
Israel knows exactly what they're doing, so for that reason I didn't like what he said. But I trust Trump, so am accepting there was a method to the madness.
Starship is the minimal, blazing fast, and extremely customizable prompt for any shell! Shows the information you need, while staying sleek and minimal.
That's also pretty high on the f scale there, bub. (All psycho analytics are for the purpose of political, soft warfare, to keep the right wing illegal, perfected in the Soviet Union, brought to us by the escapees, and instituted by Ewan Cameron and mk ultra docs)
In rural PA, we are trying to get back to normal. It's a little easier if you are around farms, Mennonites, Amish. Idk what the cities will do. I guess the same as the rest of us- read the Bible, live like our grandparents did and be mostly fine.
BREAKING: Hospital sources in Gaza report 71 people killed in a series of Israeli massacres in the Gaza Strip since dawn today, including 50 aid seekers.
Lower-than-expected pregnancy loss following flu vaccine, however. HHS wants 18-month hold on FOIA litigation related to vaccines including for COVID, litigant's lawyer says.
Remember CitrixBleed, the vulnerability where a simple HTTP request would dump memory, revealing session tokens? CVE-2023–4966 You may have missed it, as the original CVE on 17th June 2025 referred…
Worth noting that every write up says this vuln applies to the management interface - but that isn’t true, it’s because the initial CVE entry was wrong, and nobody does CVE entry updates in write ups.
I hope nobody is still misled by the pre-correction CVE into thinking that this is just a 'mitigate by controlling access to management interface like you should probably do anyway' thing that they can just defer to lower priority maintenance.
Relatively severe either way; but that teensy little correction was not loud enough for how dramatically an otherwise plausible mitigation turned out to be useless.
"At this time, there have been no reports or indications that the vulnerabilities described in CTX693420 (CVE-2025-5349 and CVE-2025-5777) are being actively exploited in the wild. However, due to the critical severity of these issues (CVSS scores of 8.7 and 9.3), We strongly recommends that affected customers apply the updated patches immediately to mitigate any potential risks."
CVE-2025-5777 poses serious threats to Citrix Netscaler devices—discover recommended actions to block exploitation and protect accounts from Citrix Bleed 2.
My view on that is I don’t have the data to back it up (because Citrix haven’t provided any way to identify exploitation, including to customers), but if true and the threat actor is running those tools with that provider, it’s probably a ransomware group again.
Over the past two weeks, Cloud Software Group has released builds to address CVE-2025-6543 and CVE 2025-5777, which affect NetScaler ADC and NetScaler Gateway if they are configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR an …
It’s not for CVE-2025-5777. It’s AI generated. The links in the README still have ChatGPT UTM sources.
The PoC itself is for a vuln addressed in 2023 - ChatGPT has hallucinated (made up) the cause of the vuln using an old BishopFox write up of the other vuln.
详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件. Contribute to mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC- development by creating an account on GitHub.
I’ve heard that Citrix are complaining me billing this CitrixBleed 2 is causing them reputational damage, and isn’t related in any way to CitrixBleed.
For the record - it was a dumb joke name to attraction attention for patching. I know it isn’t exactly the same cause.
But, ya know, it is a memory disclosure vuln which reveals sensitive info, and it does require ICA sessions be reset.. which only happened before with CitrixBleed.
I've published my scan in progress of CVE-2025-5777 patching status, listing IPs, hostnames, Citrix Netscaler build numbers and if they're vulnerable to CitrixBleed2.
The scan isn't finished yet so these are only about a quarter of the results - unfortunately my coding skills are shite and it's really slow - should be finished over weekend or early next week.
Also, the SSL certificate hostnames are separated by comma which throws out CSV - sorry, I'll fix that later.
- Of the 42 identified NHS Netscalers so far, 37 are patched🥳 The NHS are really good at this nowadays.
- Of the 65 identified .gov.uk Netscalers so far, only 48 are patched 😅 All of the unpatched are councils, which are obviously severely budget constrained in many cases - I'm also not sure they actually know they're supposed to be patching.
I wish they'd just put autoupdates on these things for orgs who can't manage it manually. 5 Min downtime at midnight local timezone wouldn't hurt much - 1 month downtime because of ransomware compromise really will...
If you call the login page, it leaks memory in the response 🤣
I don’t want to specify too much extra technical info on this yet - but if you keep leaking the memory via requests, there’s a way to reestablish existing ICA sessions from the leaked memory.
Before you dive into our latest diatribe, indulge us and join us on a journey.
Sit in your chair, stand at your desk, lick your phone screen - close your eyes and imagine a world in which things are great.
From watchtowr: "As we have discussed previously, we have a moral compass next to one of our favourite magnets, and we use it to guide our decision-making process."
CVE-2025-5777 (Citrix Netscaler vuln) has been under active exploitation since mid June, with people dumping memory and using this to try to access sessions.
TTPs to hunt for:
- In Netscaler logs, repeated POST requests to *doAuthentication* - each one yields 126 bytes of RAM
- In Netscaler logs, requests to doAuthentication.do with "Content-Length: 5"
- In Netscaler user logs, lines with *LOGOFF* and user = "*#*" (i.e. # symbol in the username). RAM is played into the wrong field.
Horizon3 have a good write up here, I don't think they were aware this is already being exploited for almost a month: horizon3.ai/attack-research/at…
Worth noting I was only able to find exploitation activity due to the WatchTowr and Horizon3 write ups - Citrix support wouldn't disclose any IOCs and incorrectly claimed (again - happened with CitrixBleed) that no exploitation in the wild. Citrix have gotta get better at this, they're harming customers.
Explore the CVE-2025-5777 vulnerability in Citrix, dubbed CitrixBleed 2. Learn how it works, attack details, and defensive steps from Horizon3.ai experts.
Just to be super clear, although Citrix claim that CitrixBleed 2 is in no way related to CitrixBleed, it allows direct session token theft - Citrix are wrong. Horizon3 have the POC and it's already being exploited - Citrix were also wrong.
"Not the most novel thing in the world… but this is much much worse than it initially appears. Take a look at the following video where you’ll see that it’s possible to receive legitimate user session tokens via this vector. "
Exploitation IOCs for CVE-2025-5777 aka CitrixBleed 2, these are actively stealing sessions to bypass MFA for almost a month. Some are also doing Netscaler fingerprint scanning first.
Look for lots of connections to your Netscaler devices over past 30 days. More IPs coming as also under mass exploitation. More IPs: viz.greynoise.io/tags/citrixbl…
My own honeypot only sees activity from Private VPN. No fingerprinting first. Most POST /p/u/doAuthentication.do, some POST /nf/auth/doAuthentication.do. User-Agent: "Vuln3rableVuln3rable..."
CitrixBleed 2 — CVE-2025–5777 — has been under active exploitation to hijack Netscaler sessions, bypassing MFA, globally for a month. At the time, I noted the similarities to CitrixBleed, and noted…
does anybody hear that statement and think anything other than “Citrix is aware that there is widespread, active exploitation. They just don’t want to admit it because it makes them look bad”?
Ich kann nun eine weitere Informationen zu den IT-Ausfällen bei Ameos-Kliniken und Einrichtungen beitragen. Nachdem ich über die IT-Probleme berichtete…
I believe Citrix may have made a mistake in the patching instructions for CitrixBleed2 aka CVE-2025-5777.
They say to do the instructions on the left, but they appear to have missed other session types (e.g. AAA) which have session cookies that can be stolen and replayed with CitrixBleed2. On the right is the CitrixBleed1 instructions.
The net impact is, if you patched but a threat actor already took system memory, they can still reuse prior sessions.
Obviously this is a Ripley Protocol type of situation; but is it known how long the session cookies would be expected to remain valid if not explicitly purged? Configurable and wide variation in plausible values? Life of connection until manual or enforced disconnect? Fixed or very likely default number of minutes after successful authentication?
CISA have modified the CVE-2025-5777 entry to link to my blog 🙌 I’m hoping this gets more visibility as a bunch of us can see from Netflow ongoing threat actor Netscaler sessions to.. sensitive orgs.
This is how Citrix are styling Citrix Bleed 2 btw. In the blog there’s no technical details or detection details or acknowledgement of exploitation. They also directly blame NIST for their CVE description.
From Netflow I can see active victims - including systems owned by the US federal government - so strap in to see where this goes.
this feels very much like a corp Comms team in crisis management mode, thinking obfuscation will make the situation better. It's a natural reaction, but not one that helps mitigation.
A brutally honest 'we screwed up, here is what we can share without making the situation worse' along with some willingness to offer hotfixes rather than full releases is the better path forward.
On the plus side, I did get to read their latest Tolly report for lolz
#Alt4You #AltText two screen captures from Citrix website, the other one from Akamai website. The first one says: "Can I fix these vulnerabilities using Web Application Firewall signatures? No, it is not possible to fix the vulnerabilities with Web Application Firewall signatures. The second one, posted later, says: "App & API Protector mitigation In response to CitrixBleed 2, the WAF Threat Research Team released a new Rapid Rule on July 7, 2025, with a default action set to "Alert": - 3000967-Citrix NetScaler Memory Disclosure Detected (CVE-2025-5777)".
The one-day deadline issued by CISA on Thursday appears to be the shortest one ever issued. Federal civilian agencies are typically given three weeks to patch bugs added to the known exploited vulnerability catalog.
1) the default logging isn’t enough to know if you’ve been exploited. So if you’re wondering where the victims are, they don’t know they’re victims as checks will come back clean unless they increased logging before. FW logs w/ IOCs fall back option.
2) the Citrix instructions post patch to clear sessions don’t include the correct session types - ICA will just reconnect as you (threat actor) still have the valid NSC_AAAC cookie.
If you ask Citrix support for IOCs for CVE-2025-5777 and they send you a script to run that looks for .php files - they’ve sent you an unrelated script, which has nothing to do with session hijacking or memory overread.
Imperva WAF have added detection and blocking for CitrixBleed 2 this weekend.
They see it being widely sprayed across the internet today - almost 12 million requests, log4shell level.
The only major vendor I’ve seen who hasn’t added a WAF rule is Citrix - they sell a WAF upsell module for Netscaler, but failed to add detection for their own vulnerability.
"The only major vendor I’ve seen who hasn’t added a WAF rule is Citrix - they sell a WAF upsell module for Netscaler, but failed to add detection for their own vulnerability." WHAAAAAAAA
- Citrix have finally, quietly admitted exploitation in the wild -- by not commenting to press and then editing an old blog post and not mentioning it on their security update page.
- Orgs have been under attack from threat actors in Russia and China since June
- It's now under spray and pray, wide exploitation attempts.
The ‘good news’, I suspect, is that most orgs will be too lacking in logs to have evidence. So they get to hope nothing too bad happened, I guess. The reason for this is the exploitation activity…
Citrix Netscaler internet scan still running, it's found another 1k vulnerable instances so far - will probably update Github later today or tomorrow morning.
It looks like we're back up to 18% of boxes being still vulnerable when the new list is out. It looks like a lot of orgs are patching from my list.
this is probably a silly question, but are you scanning netblocks most likely to have affected devices first? Eg I'm guessing not a lot likely in AWS, GCP, Azure, China, residential, etc address spaces.
GreyNoise blog just out about #CitrixBleed2, they see exploitation from IPs in China from June 23rd targeting specifically Netscaler appliances greynoise.io/blog/exploitation…
GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.
With the #CitrixBleed2 patch data I publish it's possible to view the history on Github for each new scan and see when hosts change from vuln to patched.
It's proving incredibly effective at getting orgs to patch. I tried private notifications via HackerOne and such for CitixBleed1 in 2023 and it took months to get orgs to patch. Putting the data public brings accountability for orgs who later get breached - so there's a rush to patch.
It's definitely interesting and may need a scale out.
This bit is still incomplete in the patching instructions btw - if it's a HA pair you need to additionally reset other session types or you're still vulnerable to session hijack after patching.
I'm still trying to get Citrix to update the instructions.
The Dutch Public Prosecution Office have shut down their Citrix Netscaler and removed all internet access, Dutch media speculating CitrixBleed 2 exploitation.
Justice minister David van Weel told MPs in a briefing that it appears the weakness had been used by third parties to access the department systems.
The justice ministry said the department had applied Citrix’s recommended patches, but these failed to fully eliminate the flaw. dutchnews.nl/2025/07/prosecuti…
Public Prosecution Service offline after security breach: hackers may exploit vulnerability in digital environment. Crisis meeting leads to complete internet shutdown.
Again to reiterate the point in the thread - Citrix’s patching instructions don’t include - for example - resetting AAA sessions when AAA cookies are stealable with the vulnerability. So we’re going to see orgs caught with Citrix’s pants down.
Update on the situation at The Hague and the shutdown of the Dutch Public Prosecution Service internet access, NCSC Netherlands issued an update today saying all orgs should hunt for CitrixBleed 2 activity, citing my blog.
They also advise clearing all session types, not just the ones Citrix say in their security advisory.
Fields - IP, SSL certification hostnames, Netscaler firmware, if vulnerable to CVE-2025-5777
I've had a few orgs contest that they're not vulnerable and the scan is wrong. I've assisted each org, and in each case they've been wrong - they'd patched the wrong Netscaler, the passive HA node etc.
I've been working with @shadowserver btw, their scan results for #CitrixBleed2 now show far more vulnerable systems. Their scanning is independent of mine, logic is improving, more orgs will get notifications. I'm going to try getting victims for notification across too.
I might move the Dutch Public Prosecution Service (OM) Citrix Netscaler incident out to a different thread, but the latest update an hour ago from local media is that they are still without internet and remote access, and they're working on several alternatives to continue criminal trials.
I expect we're going to see a wave of Netscaler incidents over the coming months, although how many will publicly disclose is another issue - the Dutch are culturally transparent.
The Public Prosecution Service (OM) has disconnected all internal systems from the internet. The reason for this is a warning from the National Cyber Security Centre (NCSC) that there is "a vulnerability" in the system that gives users access to the …
The Canadian government cyber centre are this weekend recommending all orgs review historic logs for #CitrixBleed2 compromise, and reset all user sessions cyber.gc.ca/en/alerts-advisori…
In late June 2025, Arctic Wolf issued a security bulletin addressing a critical out-of-bounds read vulnerability in Citrix NetScaler ADC and Gateway that Citrix disclosed, tracked as CVE-2025-5777.
The Dutch Public Prosecution Service (OM), which took their systems offline due to #CitrixBleed2 on Friday, are saying they will be offline for weeks. nos.nl/artikel/2575857 HT @moartn
#Alt4You #AltText news article from NOS: Public Prosecution Service may be closed off from the internet for weeks The Public Prosecution Service (OM) expects that it may be closed off from the internet for weeks to come. Last week, the Public Prosecution Service disconnected its systems after suspicions of a hack. This means that Public Prosecution Service employees cannot be reached by email and cannot log in remotely. That already had consequences for lawsuits last week. Public prosecutors could not look into the files, so the papers had to be printed. Officers can now consult a number of files, but do not work in them, as spokesperson said. "They can read the files, but not edit or print them, for example." The spokesperson could not say whether this will affect lawsuits scheduled for today or the coming weeks.
The Netherlands faced a significant Citrix related incident in 2019. The Dutch Safety Board investigated... report linked below.
It is now 2025, and another Citrix related incident has led to the NL public prosecutor office going offline.
The OM say they patched quickly (and my scan data backs this up - they patched around June 24th) however it appears somebody got in (or took a session cookie) before patching took place and now they’re trying to contain the situation.
Het Openbaar Ministerie blijft mogelijk nog weken afgesloten van het internet. Donderdag haalde het OM alle interne systemen offline vanwege een gat in de beveiliging van bepaalde software.
The NCSC are strongly advising orgs to follow the advice on my blog re #CitrixBleed2, in hindsight I probably shouldn’t have drawn the logo in MSPaint and titled a section “China goes brrrr”.
I think this thread exposes something about the cybersecurity industry and org posture btw - it almost all runs on Windows and EDR telemetry, hence why there’s little info on this from vendors (Netscaler is closed box appliance - they’re flying blind) and why orgs aren’t seeing anything, they don’t know how without vendors.
I keep contacting orgs and they have no idea they are compromised or how to investigate.
I'm really torn on whether to check into whether some third parties used by my clients are affected. I have no agreements with those entities and no special IT contacts so at best I'd be cautioning my clients about something they can't address and contacting the third parties as Joe Random User saying 'hey, you been hacked'
even many of those that do understand where to look don't have adequate logging around these features to definitively say whether or not they have been exploited. Your post about how all the attention is on SharePoint while the news is pretty quiet about this was pretty spot on.
if you’re in any way responsible for security of your own org, or customers’ orgs - you have to monitor for vuln news on every public facing vendor (esp remote access) you have in use - on a daily basis. I don’t understand why some haven’t yet come to terms with that. It’s one of the reasons I check your feed every morning..
'Appliances'(at least in general) seem to be in a particularly dire place. Not only are they represented as being suitable for use without heavy oversight; they tend to be in deeply rough shape as linux systems, old, weird, and mutilated compared to a normal distro install; but not actually that hardened(and vendors tend to be prickly about the idea of you having a look). This is Enterprise Security; not a $150 chromebook, after all.
The Dutch Public Prosecution Service #CitrixBleed2 incident rolls on - NRC report on an email from the Director of their IT service, where they say “It is clear that it’s a massive and dramatic incident”.
Cybercrime: Het Openbaar Ministerie is gehackt. Het zou nog weken kunnen duren om het netwerk veilig te stellen, blijkt uit een interne toelichting van het hoofd ict. Er is aangifte gedaan en melding gemaakt van een eventueel datalek.
you were the first to do an mspaint logo for a vulnerability? if now anyone publishes with a paint logo it will just be a weak attempt at copying your style. A good way to detect fearmongering.
Vanwege potentieel misbruik van een ‘kwetsbaarheid’ in bepaalde software heeft het Openbaar Ministerie (OM) donderdagavond alle interne systemen offline gehaald. Mogelijk zit een Chinese groep achter de hack.
It's obviously not ideal; but I do like seeing organizational willingness to just pull out the shears and apply them to the uptime wires if that is potentially what it takes; rather than insisting that access must remain even if some of it is pretty definitely not ours.
The great thing about "as far as I know"/"not as far as I know" class statements, unlike almost all other types of statements, is that you can increase their accuracy through the easy work of knowing less rather than the arduous task of knowing more.
Thanks so much for this info and for all the info provided prior to this. I was able to confirm with our Citrix team two weeks ago that we were patched already, and I'm just getting emails this week from higher ups to look into this, so I'm very much ahead of the game.
Aside from social media, is there anywhere you suggest keeping an eye on daily for vulnerability info?
@privateger It's honestly darkly impressive. ICA vs. RDP was a pretty compelling beatdown at one time; but that was a no, of course I'm not that old, time ago; and basically everything they've touched since is a matter of indifference or distaste.
Normally I'd jump straight to blaming the private equity knackers; but in this case I can see why they were headed to the bone mill.
I absolutely love how little of this I understand, but that it makes me go back through the whole thread, and now I've learned a whole new thing to be concerned about.
They should quit whining and do something about their crappy code + thank you for trying to get people to do something about it! Heck they should be sending you $$$
Is it normal for the IoCs section to just be "we are committed to transparency" followed by "If you encounter issues when updating your affected builds or need access to IoCs, please contact Citrix Customer Support"?
Now, I'm no computer security expert, but wouldn't threat actors immediately jump on any major new flaw with that high of a CVSS score? Just because they haven't been caught doesn't mean they're not there.
CVE-2025-5777 poses serious threats to Citrix Netscaler devices—discover recommended actions to block exploitation and protect accounts from Citrix Bleed 2.
@cR0w the only IOCs they will release is via a technical support request for CVE 2025-6543 and is literally a script that looks for a handful of vulnerable conditions and file types in locations they shouldnt be. No public IPs, domains, filenames, etc
@cR0w forgot about this but might help some people patching this week now that there is an official notice. Patching defaults some CSP setting to "on" which can cause blank login pages after updating. Citrix engineer we talked to last week stated they were getting inundated with calls about it. It extended our downtime by about an hour until a team member figured it. Never roll back, power through! support.citrix.com/support-hom…
tried updating systemd and the update process hung
Sirensabotage
in reply to Sir Matt • • •Sir Matt
in reply to Sirensabotage • • •Sirensabotage
in reply to Sir Matt • • •How hard was it to get their error removed from your credit score?
Also a thing thats fucking corrupt.
Sir Matt
in reply to Sirensabotage • • •Sir Matt
in reply to Sirensabotage • • •Sir Matt
Unknown parent • • •Sir Matt
Unknown parent • • •Sir Matt
Unknown parent • • •