Exclusive: London mayor is most senior party figure to call for plans to be dropped, as Starmer vows to press aheadAletha Adu (The Guardian)
Meeting with even two other people and expressing support for the protest group could land you in prison for up to 14 years if Yvette Cooper's proscription of it goes into effect. Simon Childs on what the ban could mean for you.Novara Media
Opposition to Labour's disability benefit cuts is snowballing. More than 120 Labour MPs have signed — and the pressure could topple the bill.Mike Sivier (Vox Political)
Zionist regime makes fool of Trump, to the surprise of no one, and says it plans to continue Israel breached US president Donald Trump’s claimed ‘agreement’ for a ceasefire betwee…SKWAWKBOX
Finding a 27-year-old easter egg in the Power Mac G3 ROM
Link: downtowndougbrown.com/2025/06/…
Discussion: news.ycombinator.com/item?id=4…
The following article was made possible by paid subscribers of The Dissenter. Become a subscriber and support journalism that defends press freedom.Kevin Gosztola (The Dissenter)
Good grief..no wonder the Tories are done for..
independent.co.uk/news/uk/home…
Andrew Edwards had initially claimed the voice recording was a ‘deep fake’Holly Evans (The Independent)
tried updating systemd and the update process hung
"I know Denver is holding firm, but this was another f-word altogether."Bennito L. Kelty (Denver Westword)
like this
John Hummel and whuffo like this.
N. E. Felibata 👽 reshared this.
like this
Andrew Pam, stefani banerian, Michael Fenichel and hummingbird like this.
like this
John Hummel and whuffo like this.
N. E. Felibata 👽 reshared this.
pernilla likes this.
N. E. Felibata 👽 reshared this.
dorumon likes this.
nypost.com/2025/06/15/opinion/…
static-assets-1.truthsocial.co…
DHS can’t arrest and deport 15.4 million illegal aliens, but if it simply enforces the law, many aliens will get the message and leave on their own — as hundreds of thousands apparently already hav…Andrew Arthur (New York Post)
The Foreign Ministers of the Organization of Islamic Cooperation (OIC), with 57 member nations, the second largest international organization in the world after the United Nations, met in Istanbul, Türkiye over June 21-22 this past weekend.Gretchen Small (EIR News)
Dangerous Show: America on Stage
#cartoon by Muzaffar #Yulchiboev
like this
John Hummel and whuffo like this.
like this
Benedikt Bauer, Tony Langmach, Aladár Mézga, Torsten Appelhagen, Elias Schwerdtfeger and whuffo like this.
like this
Kenny Chaffin, suseoddvibes, John Hummel, whuffo and samuel like this.
like this
Kenny Chaffin, suseoddvibes, Stefan H., born at 322 ppmv and whuffo like this.
Heute war es schon das zweite Mal, dass am Klavier im Bahnhof Südkreuz ein Mann saß, vom Aussehen her, Jacke, Hose, Füße ohne Socken in fragwürdigen Schuhen, vom Aussehen her einer auf der Straße. Und zum zweiten Mal saß er da an dem Klavier und spielte mit einer wunderschönen Eleganz und Leichtigkeit #Chopin. Als ich reinkam in die Halle, begrüßte mich der Minutenwalzer, und danach kam der da:Das sind so die Momente in der Stadt.
Chopin - Waltz Op. 64 No. 2 (Rubinstein)
Waltz No. 2 from Waltzes, Op. 64Arthur Rubinstein, pianoWaltz in C-sharp minor is the second work of Chopin's opus 64 and the companion to the Minute Waltz (...YouTube
like this
Stefan H., born at 322 ppmv, Aladár Mézga, Elias Schwerdtfeger and whuffo like this.
♲ Jost Maurin - 2025-06-24 06:31:14 GMT
Bauernverband will weniger #Mindestlohn für ausländische #Erntehelfer als für Deutsche. Landwirte sollten Saisonarbeitern aus dem europäischen Ausland nur 80 % des normalen Mindestlohns zahlen müssen, so die Unternehmerorganisation. taz.de/Mindestlohn-fuer-Ernteh… #Landwirtschaft
N. E. Felibata 👽 reshared this.
N. E. Felibata 👽 likes this.
like this
M-J-Revenge ✮☮★━NOK 4 U 2━★☮✮, billyidle, Aladár Mézga, HU Art Sound (2) and Jochen bei Geraspora* like this.
givehim15.com/post/june-24-202…
GH15 prayer for June 24, 2025
Order Into Chaos, Light Into Darkness
Dutch Sheets
The set is now complete. Order your copies today! https://dutchsheets.mybigcommerce.com/Learn more about Give Him Fifteen here:Website: https://www.givehim15...YouTube
whuffo likes this.
"Behold, the Lamb of God, who takes away the sin of the world! This is he of whom I said, ‘After me comes a man who ranks before me, for he was before me.’ I myself did not know him; but for this I came baptizing with water, that he might be revealed to Israel."
— John The Baptist (John 1:29-31)
Jony and Sam are both suddenly real quiet; wonder how their honeymoon is going
Oh
pivot-to-ai.com/2025/06/23/iyo…
*Nelson laugh*
h/t @davidgerard
In May, legendary Apple designer Jony Ive hooked up with OpenAI to announce an unspecified gadget. [WSJ, archive] To promote this complete vaporware, OpenAI released a video of Sam Altman and Ive b…Pivot to AI
gocomics.com/theargylesweater/…
Read The Argyle Sweater—a comic strip by creator Scott Hilburn—for today, June 24, 2025, and check out other great comics, too!www.gocomics.com
like this
Susan ✶✶✶✶, Andrew Pam, Tony Langmach, John Hummel, HU Art Sound (2) and whuffo like this.
reshared this
billyidle and N. E. Felibata 👽 reshared this.
Stephen McNallen, the founder of the Asatru movement here in the United States, produced a series of 17 different presentations and interviews with Odinist luminaries a few years ago called Gods, Folk and Destiny.
TalieVision maintains the complete list:
bitchute.com/playlist/n4lYXpZJ…
They're both informative and entertaining. I wish he had done more.
TalieVision is television for a Whiter future. It's a growing archive of almost 600 pro-White and White-friendly (mostly) full-length videos, featuring news, interviews, speeches, lectures, documentary films, concerts & other live performances, movies, and much more.
Already 92F here and it's not yet 11AM.
Fuuuuuuuuuuuuck
I'm dreading the 50 yard walk to my shop.
Chinese researchers have released QiMeng, the world’s 1st fully automated processor chip design system, making AI-designed chips a reality.
#china #technology #ai
Processor chip design technology serves as a key frontier driving breakthroughs in computer science and related fields.arXiv.org
Want to join the B-2 bomber team? Here’s what it’ll take
defensenews.com/smr/global-str…
civil-war.net/how-hard-is-it-t…
My guess is that the average B-2 pilot is not 20 yrs old. Just saying.
B-2 wings are increasingly bringing on pilots directly from Air Education and Training Command — and they have to keep training and developing their skills.Stephen Losey (Defense News)
UptownGirl reshared this.
UptownGirl reshared this.
foxnews.com/politics/trump-nom…
static-assets-1.truthsocial.co…
Rep. Buddy Carter nominated President Donald Trump for the Nobel Peace Prize, citing his role in brokering a ceasefire between Israel and Iran and preventing Iran's nuclear ambitions.Elizabeth Elkind (Fox News)
TEHRAN, Jun. 23 (MNA) – The funeral ceremony of a number of martyrs killed as a result of Israeli aggression against Iran was held at Behesht-e-Zahra Cemetery late on Sunday.Morteza Ahmadi Al Hashem (Mehr News Agency)
Rep. Buddy Carter nominated President Donald Trump for the Nobel Peace Prize, citing his role in brokering a ceasefire between Israel and Iran and preventing Iran's nuclear ambitions.Elizabeth Elkind (Fox News)
Israel has subverted our government and embedded themselves 100x worse than they did in Iran, yet people want you to talk about literally ANYTHING else.
“Pay no attention to the man behind the curtain!”
Nick Fuentes on his America First Show on Rumble last night
Nano vLLM. Contribute to GeeeekExplorer/nano-vllm development by creating an account on GitHub.GitHub
@redwhitebluedude
Truly sad.
I'm reading that the HMS Queen Elizabeth & HMS Prince of Wales turned tail & fled towards the Suez Canal afore Operation Midnight Hammer began in full.
Spatooey!
@redwhitebluedude @redwhitebluedude @spinmaven @Stefanie @Donjanusgjrdrm
🚨 BREAKING:
Trump on Iran-Israel:
“We basically have two countries that have been fighting so long and so hard that they don’t know what the f*ck they’re doing”
This is what I voted for.
😎 🇺🇸 💪
@redwhitebluedude @spinmaven @Donjanusgjrdrm
It seems to be real.
Israel knows exactly what they're doing, so for that reason I didn't like what he said. But I trust Trump, so am accepting there was a method to the madness.
> Israel knows exactly what they're doing
Fine, but don't drag the US into it.
Starship is the minimal, blazing fast, and extremely customizable prompt for any shell! Shows the information you need, while staying sleek and minimal.starship.rs
That's also pretty high on the f scale there, bub. (All psycho analytics are for the purpose of political, soft warfare, to keep the right wing illegal, perfected in the Soviet Union, brought to us by the escapees, and instituted by Ewan Cameron and mk ultra docs)
Anyone wonder when our lives will ever become "supposedly" normal again. Whatever normal we thought we were living in? Just curious.
Anyone wonder if they will live to see that day? Just curious.
Toxoplasma gondii, a parasite, is silently affects brain signaling - possibly altering neural balance even in people without symptoms.Rodielon Putol (Earth.com)
A one-and-a-half-year-old Palestinian baby was shot by Israeli forces near a Gaza Humanitarian Foundation (GHF) aid site while in her mother's arms.
The GHF has become a death trap for tens of thousands of starving Palestinians, with hundreds shot dead while trying to reach aid distribution points.
#Gaza #SaveGaza #StopIsrael #SanctionIsrael #BDS #starvation #warcrime
#palestine #Israel #Politics #Genocide #PeaceNow #StopTheWar #CeasefireNow @palestine @israel
SourceHut moves business operations from US to Europe
Link: lists.sr.ht/~sircmpwn/sr.ht-de…
Discussion: news.ycombinator.com/item?id=4…
Embedded below is an interview with Friends of Socialist China co-editor Carlos Martinez on the CGTN Radio podcast The Bridge, hosted by Jason Smith.Friends of Socialist China
BREAKING: Hospital sources in Gaza report 71 people killed in a series of Israeli massacres in the Gaza Strip since dawn today, including 50 aid seekers.
#starvation #FoodAsWeapon #Gaza #SaveGaza #StopIsrael #SanctionIsrael #BDS
#palestine #Israel #Politics #Genocide #PeaceNow #StopTheWar #CeasefireNow @palestine@a.gup.pe @israel @palestine@lemmy.ml
FDA, CDC advisers say lost pregnancies higher than expected following early mRNA vaccination
freerepublic.com/focus/f-chat/…
Comments from below the link above, check them all:
"They should sue the government and the drug companies..."
justthenews.com/politics-polic…
Lower-than-expected pregnancy loss following flu vaccine, however. HHS wants 18-month hold on FOIA litigation related to vaccines including for COVID, litigant's lawyer says.Greg Piper (Just The News)
Citrix Netscaler customers - keep calm and patch CVE-2025-5777 from Tuesday.
It allows unauth memory reads, has similarities to CitrixBleed (CVE-2023-4966) as may allow session token theft.
An update on CVE-2025-5777, explaining why orgs should identify systems and patch.
doublepulsar.com/citrixbleed-2…
Remember CitrixBleed, the vulnerability where a simple HTTP request would dump memory, revealing session tokens? CVE-2023–4966 You may have missed it, as the original CVE on 17th June 2025 referred…Kevin Beaumont (DoublePulsar)
: Why are you even reading this story? Patch now!Jessica Lyons (The Register)
I hope nobody is still misled by the pre-correction CVE into thinking that this is just a 'mitigate by controlling access to management interface like you should probably do anyway' thing that they can just defer to lower priority maintenance.
Relatively severe either way; but that teensy little correction was not loud enough for how dramatically an otherwise plausible mitigation turned out to be useless.
Citrix on this one:
"At this time, there have been no reports or indications that the vulnerabilities described in CTX693420 (CVE-2025-5349 and CVE-2025-5777) are being actively exploited in the wild. However, due to the critical severity of these issues (CVSS scores of 8.7 and 9.3), We strongly recommends that affected customers apply the updated patches immediately to mitigate any potential risks."
NHS Digital's cyber alert database has been updated too. digital.nhs.uk/cyber-alerts/20…
I highly recommend bookmarking this site for the alerts, they're really good at filtering noise:
E.g. if you select 'high' category, there's only one a month on average
Citrix just published a new Bulletin for CVE-2025-6543 (CVSS 9.2)
CVE-2025-5777 poses serious threats to Citrix Netscaler devices—discover recommended actions to block exploitation and protect accounts from Citrix Bleed 2.ReliaQuest
Over the past two weeks, Cloud Software Group has released builds to address CVE-2025-6543 and CVE 2025-5777, which affect NetScaler ADC and NetScaler Gateway if they are configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR an …Anil Shetty (NetScaler Blog)
If you see this GitHub PoC for CVE-2025-5777 doing the rounds:
github.com/mingshenhk/CitrixBl…
It’s not for CVE-2025-5777. It’s AI generated. The links in the README still have ChatGPT UTM sources.
The PoC itself is for a vuln addressed in 2023 - ChatGPT has hallucinated (made up) the cause of the vuln using an old BishopFox write up of the other vuln.
详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件. Contribute to mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC- development by creating an account on GitHub.GitHub
I’ve heard that Citrix are complaining me billing this CitrixBleed 2 is causing them reputational damage, and isn’t related in any way to CitrixBleed.
For the record - it was a dumb joke name to attraction attention for patching. I know it isn’t exactly the same cause.
But, ya know, it is a memory disclosure vuln which reveals sensitive info, and it does require ICA sessions be reset.. which only happened before with CitrixBleed.
Continuously assess, fix, and verify your security posture. Securing enterprises across many attack surfaces.Horizon3.ai
I've published my scan in progress of CVE-2025-5777 patching status, listing IPs, hostnames, Citrix Netscaler build numbers and if they're vulnerable to CitrixBleed2.
The scan isn't finished yet so these are only about a quarter of the results - unfortunately my coding skills are shite and it's really slow - should be finished over weekend or early next week.
Also, the SSL certificate hostnames are separated by comma which throws out CSV - sorry, I'll fix that later.
github.com/GossiTheDog/scannin…
Contribute to GossiTheDog/scanning development by creating an account on GitHub.GitHub
If anybody is wondering btw it's 4047 definitely vulnerable (so far) from 17021 scanned instances - so 24% unpatched after about 3 weeks.
But scan is still running obvs so the vuln number will keep growing.
If anybody likes stats
- Of the 42 identified NHS Netscalers so far, 37 are patched🥳 The NHS are really good at this nowadays.
- Of the 65 identified .gov.uk Netscalers so far, only 48 are patched 😅 All of the unpatched are councils, which are obviously severely budget constrained in many cases - I'm also not sure they actually know they're supposed to be patching.
First exploitation details for CVE-2025-5777 - the Netscaler vuln - are out. labs.watchtowr.com/how-much-mo…
If you call the login page, it leaks memory in the response 🤣
I don’t want to specify too much extra technical info on this yet - but if you keep leaking the memory via requests, there’s a way to reestablish existing ICA sessions from the leaked memory.
Before you dive into our latest diatribe, indulge us and join us on a journey. Sit in your chair, stand at your desk, lick your phone screen - close your eyes and imagine a world in which things are great.Sina Kheirkhah (@SinSinology) (watchTowr Labs)
Updated scan results for CVE-2025-5777: github.com/GossiTheDog/scannin…
It's still partial due to bugs, but about 18k servers.
Contribute to GossiTheDog/scanning development by creating an account on GitHub.GitHub
CVE-2025-5777 (Citrix Netscaler vuln) has been under active exploitation since mid June, with people dumping memory and using this to try to access sessions.
TTPs to hunt for:
- In Netscaler logs, repeated POST requests to *doAuthentication* - each one yields 126 bytes of RAM
- In Netscaler logs, requests to doAuthentication.do with "Content-Length: 5"
- In Netscaler user logs, lines with *LOGOFF* and user = "*#*" (i.e. # symbol in the username). RAM is played into the wrong field.
Horizon3 have a good write up here, I don't think they were aware this is already being exploited for almost a month: horizon3.ai/attack-research/at…
Worth noting I was only able to find exploitation activity due to the WatchTowr and Horizon3 write ups - Citrix support wouldn't disclose any IOCs and incorrectly claimed (again - happened with CitrixBleed) that no exploitation in the wild. Citrix have gotta get better at this, they're harming customers.
Explore the CVE-2025-5777 vulnerability in Citrix, dubbed CitrixBleed 2. Learn how it works, attack details, and defensive steps from Horizon3.ai experts.Jimi Sebree (Horizon3.ai)
Just to be super clear, although Citrix claim that CitrixBleed 2 is in no way related to CitrixBleed, it allows direct session token theft - Citrix are wrong. Horizon3 have the POC and it's already being exploited - Citrix were also wrong.
"Not the most novel thing in the world… but this is much much worse than it initially appears. Take a look at the following video where you’ll see that it’s possible to receive legitimate user session tokens via this vector. "
Exploitation IOCs for CVE-2025-5777 aka CitrixBleed 2, these are actively stealing sessions to bypass MFA for almost a month. Some are also doing Netscaler fingerprint scanning first.
64.176.50.109
139.162.47.194
38.154.237.100
38.180.148.215
102.129.235.108
121.237.80.241
45.135.232.2
HT @ntkramer and the folks at @greynoise
Look for lots of connections to your Netscaler devices over past 30 days. More IPs coming as also under mass exploitation. More IPs: viz.greynoise.io/tags/citrixbl…
My own honeypot only sees activity from Private VPN. No fingerprinting first. Most POST /p/u/doAuthentication.do, some POST /nf/auth/doAuthentication.do. User-Agent: "Vuln3rableVuln3rable..."
2025-07-07
190.60.16.26
103.27.203.82
45.9.249.58
185.94.192.162
128.1.160.146
200.110.153.22
2025-07-06
193.37.253.202
200.110.153.22
217.138.222.66
82.221.113.209
80.239.140.197
I wrote up a thing on how to hunt for CitrixBleed 2 exploitation
doublepulsar.com/citrixbleed-2…
CitrixBleed 2 — CVE-2025–5777 — has been under active exploitation to hijack Netscaler sessions, bypassing MFA, globally for a month. At the time, I noted the similarities to CitrixBleed, and noted…Kevin Beaumont (DoublePulsar)
“Citrix declined to say if it's aware of active exploitation”
It is aware. arstechnica.com/security/2025/…
Exploits allow hackers to bypass 2FA and commandeer vulnerable devices.Dan Goodin (Ars Technica)
First Victims in Switzerland and Germany
borncity.com/blog/2025/07/09/i…
Ich kann nun eine weitere Informationen zu den IT-Ausfällen bei Ameos-Kliniken und Einrichtungen beitragen. Nachdem ich über die IT-Probleme berichtete…Günter Born (Borns IT- und Windows-Blog)
I believe Citrix may have made a mistake in the patching instructions for CitrixBleed2 aka CVE-2025-5777.
They say to do the instructions on the left, but they appear to have missed other session types (e.g. AAA) which have session cookies that can be stolen and replayed with CitrixBleed2. On the right is the CitrixBleed1 instructions.
The net impact is, if you patched but a threat actor already took system memory, they can still reuse prior sessions.
Tell anybody you know at Citrix.
CVE-2025-5777 aka CitrixBleed 2 has been added to CISA KEV now over evidence of active exploitation.
Citrix are still declining to comment about evidence of exploitation as of writing.
This is how Citrix are styling Citrix Bleed 2 btw. In the blog there’s no technical details or detection details or acknowledgement of exploitation. They also directly blame NIST for their CVE description.
From Netflow I can see active victims - including systems owned by the US federal government - so strap in to see where this goes.
this feels very much like a corp Comms team in crisis management mode, thinking obfuscation will make the situation better. It's a natural reaction, but not one that helps mitigation.
A brutally honest 'we screwed up, here is what we can share without making the situation worse' along with some willingness to offer hotfixes rather than full releases is the better path forward.
On the plus side, I did get to read their latest Tolly report for lolz
Some CitrixBleed2 IOCs; this is a cluster of what appears to be China going brrr, going on for weeks.
38.154.237.100
38.54.59.96
Contribute to GossiTheDog/scanning development by creating an account on GitHub.GitHub
CISA is giving all civilian agencies 1 day to remediate CitrixBleed 2. It is encouraging all other organisations in the US to do this too.
therecord.media/cisa-orders-ag…
The one-day deadline issued by CISA on Thursday appears to be the shortest one ever issued. Federal civilian agencies are typically given three weeks to patch bugs added to the known exploited vulnerability catalog.Jonathan Greig (The Record)
Set up lab of Netscalers just now & owned them.
Two learnings:
1) the default logging isn’t enough to know if you’ve been exploited. So if you’re wondering where the victims are, they don’t know they’re victims as checks will come back clean unless they increased logging before. FW logs w/ IOCs fall back option.
2) the Citrix instructions post patch to clear sessions don’t include the correct session types - ICA will just reconnect as you (threat actor) still have the valid NSC_AAAC cookie.
Updated CitrixBleed 2 scan results: github.com/GossiTheDog/scannin…
It's down from 24% unpatched to 17% unpatched
The results are partial still, the actual numbers still vuln will be higher.
Contribute to GossiTheDog/scanning development by creating an account on GitHub.GitHub
Imperva WAF have added detection and blocking for CitrixBleed 2 this weekend.
They see it being widely sprayed across the internet today - almost 12 million requests, log4shell level.
The only major vendor I’ve seen who hasn’t added a WAF rule is Citrix - they sell a WAF upsell module for Netscaler, but failed to add detection for their own vulnerability.
Updated Citrix scan results will go on Github in a few days, I've found a bug in the scan results setup which should add ~33% more hosts when fixed.
Spoiler:
CitrixBleed 2 update.
- Citrix have finally, quietly admitted exploitation in the wild -- by not commenting to press and then editing an old blog post and not mentioning it on their security update page.
- Orgs have been under attack from threat actors in Russia and China since June
- It's now under spray and pray, wide exploitation attempts.
doublepulsar.com/citrixbleed-2…
The ‘good news’, I suspect, is that most orgs will be too lacking in logs to have evidence. So they get to hope nothing too bad happened, I guess. The reason for this is the exploitation activity…Kevin Beaumont (DoublePulsar)
Perhaps time to refer to it using the more appropriately descriptive word... Wild.
This vulnerability is WILDLY EXPLOITED.
As a bonus "exploited in the wild" can be changed to "wild exploitation observed".
Citrix Netscaler internet scan still running, it's found another 1k vulnerable instances so far - will probably update Github later today or tomorrow morning.
It looks like we're back up to 18% of boxes being still vulnerable when the new list is out. It looks like a lot of orgs are patching from my list.
New CitrixBleed 2 scan data:
raw.githubusercontent.com/Goss…
+7000 extra hosts added this round, host list is so large you need to use the raw view to see it.
Next set of data publication likely Friday, a month since the patch became available.
3832 orgs/hosts still unpatched.
GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept was released on July 4.www.greynoise.io
I’m fairly certain the threat actor is Chinese and they reversed the patch to make the exploit.
Citrix continue to be MIA. They still have no detection guidance for customers, and haven’t told customers the extent of the issue.
With the #CitrixBleed2 patch data I publish it's possible to view the history on Github for each new scan and see when hosts change from vuln to patched.
It's proving incredibly effective at getting orgs to patch. I tried private notifications via HackerOne and such for CitixBleed1 in 2023 and it took months to get orgs to patch. Putting the data public brings accountability for orgs who later get breached - so there's a rush to patch.
It's definitely interesting and may need a scale out.
Citrix have a blog out about hunting for #CitrixBleed2
netscaler.com/blog/news/evalua…
It's what was in my earlier blog - look for invalid characters in the username field and duplicate sessions with different IPs
This bit is still incomplete in the patching instructions btw - if it's a HA pair you need to additionally reset other session types or you're still vulnerable to session hijack after patching.
I'm still trying to get Citrix to update the instructions.
The Dutch Public Prosecution Office have shut down their Citrix Netscaler and removed all internet access, Dutch media speculating CitrixBleed 2 exploitation.
techzine.eu/news/security/1331…
Justice minister David van Weel told MPs in a briefing that it appears the weakness had been used by third parties to access the department systems.
The justice ministry said the department had applied Citrix’s recommended patches, but these failed to fully eliminate the flaw. dutchnews.nl/2025/07/prosecuti…
Public Prosecution Service offline after security breach: hackers may exploit vulnerability in digital environment. Crisis meeting leads to complete internet shutdown.Berry Zwets (Techzine)
Update on the situation at The Hague and the shutdown of the Dutch Public Prosecution Service internet access, NCSC Netherlands issued an update today saying all orgs should hunt for CitrixBleed 2 activity, citing my blog.
They also advise clearing all session types, not just the ones Citrix say in their security advisory.
advisories.ncsc.nl/advisory?id…
Updated #CitrixBleed2 scans github.com/GossiTheDog/scannin…
Fields - IP, SSL certification hostnames, Netscaler firmware, if vulnerable to CVE-2025-5777
I've had a few orgs contest that they're not vulnerable and the scan is wrong. I've assisted each org, and in each case they've been wrong - they'd patched the wrong Netscaler, the passive HA node etc.
Contribute to GossiTheDog/scanning development by creating an account on GitHub.GitHub
I might move the Dutch Public Prosecution Service (OM) Citrix Netscaler incident out to a different thread, but the latest update an hour ago from local media is that they are still without internet and remote access, and they're working on several alternatives to continue criminal trials.
I expect we're going to see a wave of Netscaler incidents over the coming months, although how many will publicly disclose is another issue - the Dutch are culturally transparent.
nltimes.nl/2025/07/18/dutch-pr…
The Public Prosecution Service (OM) has disconnected all internal systems from the internet. The reason for this is a warning from the National Cyber Security Centre (NCSC) that there is "a vulnerability" in the system that gives users access to the …NL Times
Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2025-5349, CVE-2025-5777 and CVE-2025-6543 – Update 2Canadian Centre for Cyber Security
Looks like Arctic Wolf referenced your info as well! arcticwolf.com/resources/blog/…
Meanwhile still have yet to hear from Citrix…😭
In late June 2025, Arctic Wolf issued a security bulletin addressing a critical out-of-bounds read vulnerability in Citrix NetScaler ADC and Gateway that Citrix disclosed, tracked as CVE-2025-5777.Andres Ramos (Arctic Wolf Networks)
Referenced Double Pulsar article.
You fuckin’ legend!!
Het OM koppelde zijn systemen vorige week los van het internet na vermoedens van een cyberaanval.NOS Nieuws
The Netherlands faced a significant Citrix related incident in 2019. The Dutch Safety Board investigated... report linked below. It is now 2025, and another Citrix related incident has led to the NL public prosecutor office going offline.Infosec Exchange
There’s a bit more in situation at the OM on Netscaler here: volkskrant.nl/binnenland/openb…
The OM say they patched quickly (and my scan data backs this up - they patched around June 24th) however it appears somebody got in (or took a session cookie) before patching took place and now they’re trying to contain the situation.
Het Openbaar Ministerie blijft mogelijk nog weken afgesloten van het internet. Donderdag haalde het OM alle interne systemen offline vanwege een gat in de beveiliging van bepaalde software.Daan de Vries (DPG Media)
You'll be remembered for the yolo cowboy styled action advice regardless.
But I would be more impressed if you leveled up towards Notepad and started doing ASCII art instead.
I think this thread exposes something about the cybersecurity industry and org posture btw - it almost all runs on Windows and EDR telemetry, hence why there’s little info on this from vendors (Netscaler is closed box appliance - they’re flying blind) and why orgs aren’t seeing anything, they don’t know how without vendors.
I keep contacting orgs and they have no idea they are compromised or how to investigate.
The Dutch Public Prosecution Service #CitrixBleed2 incident rolls on - NRC report on an email from the Director of their IT service, where they say “It is clear that it’s a massive and dramatic incident”.
nrc.nl/nieuws/2025/07/22/digit…
Cybercrime: Het Openbaar Ministerie is gehackt. Het zou nog weken kunnen duren om het netwerk veilig te stellen, blijkt uit een interne toelichting van het hoofd ict. Er is aangifte gedaan en melding gemaakt van een eventueel datalek.Rik Wassens (NRC)
your name was in our newspaper on saturday. Electronic version volkskrant.nl/binnenland/inter…
Link in online article goes to 'CitrixBleed 2 situation update — everybody already got owned'
Vanwege potentieel misbruik van een ‘kwetsbaarheid’ in bepaalde software heeft het Openbaar Ministerie (OM) donderdagavond alle interne systemen offline gehaald. Mogelijk zit een Chinese groep achter de hack.Jasper Daams (DPG Media)
Het OM koppelde zijn systemen vorige week los van het internet na vermoedens van een cyberaanval.NOS Nieuws
The great thing about "as far as I know"/"not as far as I know" class statements, unlike almost all other types of statements, is that you can increase their accuracy through the easy work of knowing less rather than the arduous task of knowing more.
It's epistemology's any% speedrun strat.
I had a look at network traffic from today and some of them are proxy exit nodes; some do broad IoT scanning.
Two of them really stick out as they seem to exclusively target Citrix endpoints: 78.128.113.30 and 38.54.59.96
Thanks so much for this info and for all the info provided prior to this. I was able to confirm with our Citrix team two weeks ago that we were patched already, and I'm just getting emails this week from higher ups to look into this, so I'm very much ahead of the game.
Aside from social media, is there anywhere you suggest keeping an eye on daily for vulnerability info?
Attached: 1 image @GossiTheDog@cyberplace.social Patch appliedFosstodon
@privateger It's honestly darkly impressive. ICA vs. RDP was a pretty compelling beatdown at one time; but that was a no, of course I'm not that old, time ago; and basically everything they've touched since is a matter of indifference or distaste.
Normally I'd jump straight to blaming the private equity knackers; but in this case I can see why they were headed to the bone mill.
The hostnames field can be properly CSV'd by something like perl -pe 's/,/,"/; s/(,[^,]*,[^,]*$)/"$1/'
(Assuming a unix-ish shell. With cmd.exe you probably have to turn the inner " into ^" and the outer ' into ".)
Thanks!
#RSS alert feed: digital.nhs.uk/feed/cyber-aler…
Other #NHS feeds: digital.nhs.uk/about-nhs-digit…
I was sent this for reference:
reliaquest.com/blog/threat-spo…
CVE-2025-5777 poses serious threats to Citrix Netscaler devices—discover recommended actions to block exploitation and protect accounts from Citrix Bleed 2.ReliaQuest
I also like Cloud Software Group does not provide forensic analysis; however, customers can contact Citrix Customer Support to get access to IoCs.
And
Does CVE 2025-6543 constitute a zero day vulnerability?Cloud Software Group became aware of limited exploitation activity before the patch was released.
CeceDuBois reshared this.
In the same conversation, this lady told me she doesn't eat fruits, vegetables, rice or meat. Also, she always orders the same thing when she goes to a restaurant.
It's nice to see someone with worse eating habits than me.
(I'm not a fussy eater - I fail to always plan a balanced meal.)
Pasta and milkshakes. That woman certainly knew her milkshakes.
- Πάνω από 900 συλλήψεις στο Λεκανοπέδιο ρε γκουμουνι.
- Τι? Greek Mafia?
- Χειρότερο ρε πλεμπες.
Χωρίς εισιτήριο στα ΜΜΜ.....
#δεν_σας_έχουν_για_μαλακες_είστε
N. E. Felibata 👽 reshared this.
Sensitive content
Hace un tiempo le soltaron un bofetón a un youtuber (ricky edit) por llevar una de estas gafas.
Para mi son una red flag total. Hace unas semanas una persona que estaba en una charla con la gente de la Marea en el teatro del Barrio en Madrid levantó la mano.
Dijo que estaba con unas gafas con IA y no recuerdo si dijo grabando o sin grabar. En realidad no existe forma de saberlo.
Es como un espía quien la lleva. Grabando todo todo el rato.
Sensitive content
"Two out of three Germans support the creation of a European nuclear shield"
Well,......no big deal.
Two out of three Germans supported the Nazis once...
I guess two out of three Germans are extremely susceptible to government propaganda.
Disisdeguey🔻Pavlichenko🇵🇸 reshared this.
I love #SarahSilverman. Always have. She's a gem and a legend! #MichaelRosenbaum #podcast #InsideOfYou
Thank you to our sponsors:📞 Mint Mobile: https://mintmobile.com/insideofyou👕 Quince: https://quince.com/inside❤️ This episode is sponsored by BetterHelp. G...YouTube
Marble Blast
Link: marbleblast.vaniverse.io/
Discussion: news.ycombinator.com/item?id=4…
A web port of Marble Blast Gold and Marble Blast Platinum: In this 3D platformer classic, race your marble to the finish as fast as possible in more than 4100 diverse levels taken from Marble Blast Gold, Platinum and Ultra.marbleblast.vaniverse.io
Starship: The minimal, fast, and customizable prompt for any shell
Link: starship.rs/
Discussion: news.ycombinator.com/item?id=4…
Starship is the minimal, blazing fast, and extremely customizable prompt for any shell! Shows the information you need, while staying sleek and minimal.starship.rs
faab64
in reply to Michael • • •